A858DE45F56D9BC9 archive

201208080051 xtwo1

explained decrypted filler

3DES(name+name) ECB, 33 GUIDs, seed 565

Metadata

Post ID
xtwo1
Title
201208080051 → 2012-08-08 00:51 on A858's clock
Posted (UTC)
2012-08-07 16:48:38
Timezone
UTC+8 · title 00:51 against posted 16:48 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,128 hex characters · 1,064 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
33
Filler GUID seed
new Random(565).Next(9) ✓ verified
Run
Run 22 (seed 528,385,484) (seed)
Draw
26 · predicted N = 33 ✓
Machine boot
2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
9 · 1
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

E1954D3D419AE3A7 5FDAFB3415A2C298 7DFCDCAC77E7BD1B E25502E9B99A6EC6 8E94441192D6F340 D9EB37F4019B99D5 46DEEE2BF8BE1C3D 07D94DC21D759F5E 27E0EE9E7479DB2C 37F522E4033ABE02 8B7F4A315BCDEC3E 104A75FA606E07F4 5FDF1CC739734BD6 1529B7A4FE970ED4 D6E88A4F1C4E3806 D43D81A5BDD4191F E13B6D9ADDA70FE5 AC0153924F61C18B 43ED7D6FCA2D3346 382039C5E204EBDF 5BD3989000E0E214 5AC2A58FF93E2E3F 645DA2E6A50A4771 1C36DCF1511CE718 D13C3C04C132A1D8 0D66EFF4299039BC 92E832AC4E437792 3E671E7D5303EA8C 4BD1ED738E4F11E6 4A6167978058E571 539EA0202F7A5C67 6CF9F625044022E5 274015AFCE24E46A B534B4C032BB17C6 EA24779DF66C5EAE 8FB52AE1A4682938 6E7F9B0BEB791569 B0606568557479B6 0AE4E430066C6C9E 652712B0661025FA 8ADDAF711A341F30 C6F25837B660B0C8 A186BB595BD4C9E5 CFD74EEC251CF807 BD98B47EB2C736D5 4C538D0910A11F5B EB826B3EFE28A92A BD02F3E1030D4B94 E79CD5130140CA74 36A1404CD7F64EC8 097464E8B2E606C5 2BA23E097AD21576 6EE486D471EA8871 A48CA2541F13CA36 602C7450F6857BAB A35DC3FF0A7963EF BE8739C2FCD4F82B 76278CC17517996E B58DDF231F201E5B 6D57826D0CB16EE6 959D628D470997B3 13A32C4ED79F5A0C C9DB2297B74F5EAE AE404E120DE45C2B EABFC16710A0867A 17F5FF10C29FDE03 5A65C4E1D24572D3 F3484F1A809F6DB8 6C8161BAE46CA155 27FD1BCC38C33B47 F488ED0E3B225F8A 653C3B02613EB130 C66ABE8F4B5E6CB6 A0486B6F19F325B1 CC90D6103CB92561 8557193221C018A3 605621F49CF6D6F9 FC752400DC5C31C6 1BD53D0B81BF5B94 36D69831C90D19FA 65DAFDDE09BF5663 DBCE5597F4077D77 43C4211DD4252A65 459B093C9D437740 C61C73077D2128BD 62ECBD69B508BFD3 47792BC14A6098B2 F7712C2A3458AC8D EE097371D0235BB7 F2B44B7F7481F1CD 5C2D2FE499827EC5 54AB593D77A67FDD 959AE0C22144F9AB C1E638317026C365 B07D265F7A58F0E7 A2A20656FA00F922 E287243CE726A67A CFB2B2BEDC7456C8 72BFD334688D62F6 92C1A8E313F60C4B 7A153FE7A6048786 23A312D605A84CCA 5B7B960D67E1E0A3 A36ADEA43D7B84EB 0597BAAAAFE80898 671283D4992B38FA 4B592555C12954EF 77FF593944CD8DFC C0CE2F5848D1D571 FFC9F45B81C5AE99 3B480D3A6BE5D0BE 5BF225DB2FF80B1D 6DE9E549C1525434 29E99AF9583C8E77 B38677871544C9EE 9DB669E0D39E64EF 4E4681F12CF87ECB 79CF653DB6E5E815 7481995D2BC10ACF 9BA6D9C4F6D647CC 1331F3E5DCC546C8 23AE03A49F754B7F 2CB7F3B7185C0AEF 09DB0DCA8FE878D7 7F4FD81AA9884779 46BC3AF102B3A245 47D66147E6A2C59C C0D009EEBC2ED01A EBA12C74FE10E615 1572A695930CBD43 ACD66663543D3133 6544341EC0C4111D 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,128 hex characters = 1,064 bytes = 133 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 33 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ce25a8a6-3d04-8c3c-9ad1-bb79ad15b4fe
  2 02413f57-106d-5c19-9c1b-db2e9b61de65
  3 7e566c3a-928f-68b7-8773-241f222843b5
  4 3e1631a0-2286-1378-a8aa-2b9da33537a3
  5 c28231b9-a5ed-2230-b8ae-12009f0db2c1
  6 608167cb-27b6-265d-910c-857e08f39c39
  7 46b42f54-4ca2-0961-a7cc-abb979bf8699
  8 397d86f4-25f5-8392-991c-6db1216e7651
  9 1d18233a-6046-7214-938d-b14047044bc3
 10 306bd36c-9a56-5122-b155-713ff9c27174
 11 9581b103-3acd-48c7-874e-aee142f3af44
 12 953ed62f-2249-5e70-9b45-b287790fb1a5
 13 56e5e5fe-07e6-093c-a270-d03c4e87d118
 14 2729057a-da18-33c7-8c97-56a7dbfee3b4
 15 ce63dd47-87d8-440b-9b76-b78b71a05845
 16 208d630b-34ad-753c-9b8d-90c3ba70e609
 17 85c2a4de-108f-3d6c-93d8-5b108312a610
 18 05a52569-b68c-2b3b-ab91-14c86d88babe
 19 28c7b8e6-c797-8f6b-aa2d-0be7d9325626
 20 108428fb-5a1c-0a31-8100-883e29b25942
 21 2fa5d9fe-3e76-7e67-af4c-0a5eee5b83be
 22 e23ac649-997b-42d4-8af3-24707a234f1d
 23 1b088b49-3f99-43de-91ee-855ee1e02062
 24 6de6f57f-f112-341f-ad07-8f4e7c427aac
 25 4b9cdbcf-c094-0a7d-87a9-a52facbeba0c
 26 ac9dc424-21af-881e-8073-1aa8512744c6
 27 79a5ce93-a7c0-6158-b7c5-f03a82687156
 28 2bd51ad7-14a8-6589-b7ff-84548586572a
 29 ca50d1e1-1ae6-52d4-a6a5-635e967de331
 30 625ba036-f954-09e3-9991-3acc128f25fa
 31 39cc5d09-a6b3-65e0-ba83-175e31212521
 32 6c847265-5840-27d0-8c84-8abd3b167cea
 33 d328b450-1627-4463-9ab7-3a3f1fbeaebd

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 856122087545034732807443086650624. Exactly this sequence comes out of new Random(565).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 26 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 33; the post has N = 33 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results