A858DE45F56D9BC9 archive

201208080057 xtx19

explained decrypted filler

3DES(name+name) ECB, 28 GUIDs, seed 144

Metadata

Post ID
xtx19
Title
201208080057 → 2012-08-08 00:57 on A858's clock
Posted (UTC)
2012-08-07 16:54:39
Timezone
UTC+8 · title 00:57 against posted 16:54 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,808 hex characters · 904 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
28
Filler GUID seed
new Random(144).Next(9) ✓ verified
Run
Run 22 (seed 528,385,484) (seed)
Draw
27 · predicted N = 28 ✓
Machine boot
2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
7 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

97314CE121D04648 C3F52D99BDDE7ECB B342BCB0CA2AA5BF F6ACFE6A1D37C387 E1A61269DEE7069C 45307CA6681C2148 620BAA7978D9AF06 FDDEF3191D980199 174B25DB4BC65AC0 F84A5AFE5A3EB444 9C083E4AC5D13E31 B50AC9AF9D447EC9 A5192E23CFB3816B 5783795B371CD4BD 896720873B6787D2 ED7AA09BF15830C3 B747BDA9B92FDFD1 B3192540BDEDD18D 01B6708307E0130D 591AE269DE1BE4AC BD15907B4315A3E1 11E0911B527345E8 8C2E2F16DD26AAE6 4C1F93A73136D614 09B4399AF4DE7AEB B10D3028A1632519 4395FD4E07DA5C29 18A0E1B70B2C0C47 1B4E4B41A1744997 1FD59D16BA7C0D88 0597431203904FB8 B67E46B02B5AF675 1012267DD933DE3B 051E46AB300582C3 4FDB9A01D0F0B700 7A9996A84C539389 F1FF7337229E82FE 0D687BE8AA616402 A3D345FAC35A16CF 100AC90EE172887A C50C47B0E8D840A8 8895E1E54A4636E7 D39F1845E4423044 9CB38706EA44AB3E F13B95BFACC8ED37 25FFB645A7E0B296 557A9D467656CBA2 677D68F88BC050DA 31ABBFFF8E2D76DB 6AB175A9DADF6245 447D8602E81A5CF7 26C2D6C9234AF9AF C576F5158F9EE1C6 FFA4BB672A862FEE 7DC880D1E2E61F63 1383E42BF28269F2 7D20C07055932DD1 758DDDEDF90A0E91 52AB2F7A78B215DE 3E46C8C366B1A2C5 F54B94A10D2D6055 C70302DEC30DFA80 B508918360525348 FF95A8DFE3AAF1E3 A0433608C1863F91 B21412BE0361273D CF584ABA85B83C15 1B0F8AB3374F3F4E 5AD788771093D21D 9EB7120B7F51DBDA 33468EAFE5771D24 83D74648A23CF0DF 24E2E1ADF0E270BD 883049A51A3E79EE 182FEE386FDEE991 E61B6FE2CB3740D4 5968114BB94AF990 7F13C71087834B31 C5ED1966FCBF2EA9 E006980E634E8997 A9E816626A7F756D 8BC4B167ADDD98F0 AD8DBC45020D13CF BBF6A151BF949DF8 EC44B3ABB4CD5AE7 8688AE527DD3F6B4 2D0FA9149FBFEF02 251F572DF739B781 57E3C43CD81E9A48 266383B841644133 568F5328E5E86D15 00B796D1B9FD4C62 4E03CBDD3D248D85 479BC62586E35CF2 F227C46411462853 2C877AD2D2F8B88B C22605E664458230 82E3693682D84537 4938FEB9DF29994E 9D294BAECAB84FD6 984AEF7BAA7A240C 2A82D916514B9B93 F1967A2E884382E5 6D18E207DE4EC2B5 3780552B83F2F7DC 788F1D0E7F69C79B 5A7583BB7F8C9F98 31756B1DEB646426 FEA156771199B926 4BED23872249128C 129E9A2C19722146 25677231804791E3 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,808 hex characters = 904 bytes = 113 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 28 GUIDs as hex (shown below).

Decrypted: GUID list

  1 aca9ce29-1bfe-8563-8fff-9e69eda844c6
  2 21c1fe0e-381b-0f58-bfb9-2d1ef3ce90c4
  3 970149bc-afef-3b9e-a25d-f9677bb20c72
  4 4bd2f46e-dae2-2813-bf2d-7d6690fde222
  5 387f4698-e5a9-1894-b7f5-18a03d1f614b
  6 b2234bf6-c561-3812-bb5a-4bdad13d21dd
  7 e9522adb-6b05-3db3-8990-e064fb5589b6
  8 398709d9-9adb-6ab0-bd35-c6e28b0b882b
  9 015f7c76-e033-7ac1-8ce8-b7883da6e1e1
 10 069c520e-f408-3ec9-8550-0f395a389496
 11 6853e665-7a99-3e10-8fae-bfa1488aae20
 12 8c0d301e-abcc-8cd4-aa13-008865c14bca
 13 9b92a8b9-e067-5f87-85e3-c7f29cf0b30a
 14 3fa30a5d-100a-3299-8541-c2e42de29598
 15 949069b4-d0c5-725e-8b38-fb081d9ad73e
 16 951253bb-c8f5-8327-b2ee-6a11ae82a277
 17 32248177-45c6-3641-b67e-5724e17cd2ab
 18 df953a1c-4832-2fe3-9f85-f30757e3e1f3
 19 2ce80330-a18d-5b35-a95a-7794070c80b0
 20 bd7f3afb-4010-090f-911a-6a0e7ec695e6
 21 dd4676fa-ef3b-8f1b-9922-1bebe3178bce
 22 fcf57ccb-16d7-19f2-a913-43fc092bc0e0
 23 71518ca0-00fd-27e3-aa31-4ba90749e748
 24 e4c467b0-81b2-3915-942d-5a718079b976
 25 af8ce58a-475e-71f5-b8c7-feb04a2b7579
 26 8a989b6c-231b-1bbf-8e07-efe65aacb932
 27 196b91f6-ecd9-62ca-964c-2c9c86df0d60
 28 0028eae1-6a61-8f34-bf64-74d8fe71ba6a

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 8032133673385378325081237168. Exactly this sequence comes out of new Random(144).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 27 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 28; the post has N = 28 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results