A858DE45F56D9BC9 archive

201208101652 y0kt5

explained decrypted filler

3DES(name+name) ECB, 37 GUIDs, seed 310

Metadata

Post ID
y0kt5
Title
201208101652 → 2012-08-10 16:52 on A858's clock
Posted (UTC)
2012-08-10 20:49:29
Timezone
UTC−4 · title 16:52 against posted 20:49 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
37
Filler GUID seed
new Random(310).Next(9) ✓ verified
Run
Run 22 (seed 528,385,484) (seed)
Draw
33 · predicted N = 37 ✓
Machine boot
2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

7E88CE4C3F31AD6F CCB9CBC9D02DBD9C E36EC5C7FAB2D6E1 5E515007468CBAFC D2B293A2D3E4F7BA 05ECDBF92138AC97 B98EBEF5D7D1F5C1 5BAD6152AE73B571 95ECCA5B59BB0EEE D6ACBC3C9928E5E3 903707186ED63E42 E8D4DD89E9E7F9EC EE89E34F5760380E B3D6988326F78394 22AD012D17B70459 07C126E53BBE5D54 E956DB971AA61F18 9C1D5A71215CBFA6 2FA98DC30A853849 FBAFA17157FB6BF7 DE14854D3CCD20FF 317AFD8E8579033C D25A111A2D2D22DB E851FF0D55D383D2 6775520D4345EA0E ED93AE6E550C7B0D F31A2B9CBC820CD2 0736B473AB76BC06 EEE6F8559C624636 AA6D87B6E920F794 08A7BDE4701A1F4E 32EE847D694FD1D6 3A29219C5036ACB6 EBB1094B56F0E1FA C923FB30F2AF772F BCE71D35B5EEB243 3860268D5DCED4B9 0D28E11F076D824D B776194549F0B4B5 BA40FB8C456698E0 0B8225E4FBA0EDC7 61CF1857CA079823 3F77305F9AA6FB85 724457B5824F87DF EAF6ADC2A3BFDA9F 5B1EBAB7EEAB0ECB 225ED10C897772B4 AD7E60BA000827E0 35F85371C8C6B50F D56964C2B1BC0F87 E3E05AFC86A87A27 50C68A0B89E8EBE6 96A883FAC72CF055 6BB22F0A9DB8F665 7E07B4BE0F671269 865338318E72B661 4ED583363FCA0D63 87F0D578BC098915 B9F62DDE67340D2E BC3AF64FE3E9C83A 7C316C0AB336BDB4 FA9E397B5EDBE17F 727F78DA0B6C844C 41E38ED947BEFD00 9A16D44681794437 8EB329C3DD3FAB21 246E4B242B6EE581 F4F05FD38A013973 A520ECA23501C9E2 E6F2E153759480B1 8F2655A6B67B43BD 98D1E9098D4A7896 BF5634F6C664318F 13CED6A5DFA25D8E 9F64D6B589045875 F3746D07FCE92C78 372B5324498E7164 1D5539DD4874F18F D1759AFB640C93A2 2A6585F34588292D 53ABB884282F00D0 51F8643E0C2B0D7C 2F947B7F96B0C66E BA9E194C90E440E0 21C84919137AD0EA 0DD7CAEF1B3591F8 87B5ED52E1E75ED7 D3369FAE2F759E78 2AA65349C3148632 C7166B91D1D5A00F FA19B9DE7D30362F C7263A90241E5E50 361F9B81C22D5B29 4D9CBDD4C997A8D2 34A288B4FDA69015 3957962AEB8EB611 664E3AA7FA39DBB9 6F862D99658AEB22 73901FB566A3C86D 6297CBC196E3E850 15DB9112932C1EF5 F85135C1B1F9199B D3FC8E80C180CDF8 CC4FB466AF686ED7 DD5B8DE15632A24E 688071F1E60E2869 DC973FA2CFFC65BA B309F453F1D200B2 D563B4E9E4DB1AFB A1F30AE15C3F26BA 8C145F87F55EB590 727071D2C840F5AF 2EEEEFC6283226BB 4E1997559B277FC6 BF7566152C5B3C92 6F0E733A19970190 81B5FF4F4E0AE625 612FAE0E3814DA71 DA8DF503DABA7184 E5B31D2B8ACD94F9 E54830496D43565F 545EECB9B8A5A94A EA5459C0F1B904D3 3091B86A3981B3D4 6792E8C2CFA72EBF 908BD8B1223C8ECE A2818D53C785CE09 0F30A65330691AC7 4AD3545EC0BBA328 727D61176C793315 7A1DFDC1119CA5C7 8D5465D1BD816371 D7402FEE6AD8CA60 9C64AB171300DD3C 8B9EAE23B53230D8 5DB274C5154973ED B1037809ED593DB8 6FBA0A5E5CF8F6FB DBDE52F2968092E6 F9E32099FC9298FE 77348E11E7A3D205 6DAB4C9AD59BFBBF 51EE2C54691D6393 4ECF8E691AF4C1C7 2096298BA886575B FF98DE8505C807F8 EC6D9FD7B37FE84C 2151232D2577866B 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b3d36902-b133-6cab-b325-787f2a7608a0
  2 d1fa329a-3305-6794-b67d-032f767186ec
  3 ea1de999-77ae-476b-aaf8-5090f65e44d7
  4 9b1da0b5-4d9b-62bf-813c-3c0427a114e6
  5 460556f5-6184-1847-a113-47872cd590fe
  6 a1b89756-189e-497f-988b-2a8e9000596d
  7 29d33c5f-0c5d-77ea-933b-b175d0a9a31f
  8 d8a20ab3-a5be-8735-8827-d57ec872fae8
  9 67b82e3b-389a-2c51-bd30-70352be5b4f2
 10 6807e582-2e84-5c61-8b9a-618d77e00cbe
 11 61b54d32-e0b0-6dc9-8620-cf77e0eb18ef
 12 042ccb3b-b8ba-4738-abfe-7b48d8d52592
 13 15719975-a9c1-658b-9f78-b85ff1c4b47a
 14 221ba960-317d-6177-b1d3-83460da58a57
 15 17257709-911d-8f8d-96bf-9fb34c8e6e4a
 16 f391cc63-d2dc-593f-ae0e-8e8177f8b2e6
 17 a3e3811b-6092-1475-b980-fc18e78fb136
 18 79785930-d5b4-1f06-a92d-a3e8754b6758
 19 8581653e-6a0a-0a72-a084-36f3f54136eb
 20 c8fd58c2-0069-30e8-a211-022f184dbd70
 21 57fae6d2-ed0b-0df6-9a6c-adc6142b321c
 22 f5f8ff8f-f350-8c65-a397-a75480a2ffc2
 23 298abd28-a2b0-304a-bcb6-15535066f319
 24 d0997afd-34f0-227c-8933-6f36a7ed9152
 25 ab1a9815-fabc-0c37-88b5-566234fa76da
 26 e144e237-de44-83be-afae-5cc732008288
 27 6a3e948b-8a86-4bd8-843e-fbc3d39a36cb
 28 f8643d3a-da2f-6045-9d17-3bded10ee084
 29 3d28f706-1f6e-1eac-bdec-e7410b706e4b
 30 9af82993-10eb-626e-9c2f-6166ca61cc27
 31 08377809-2e54-5964-a2d0-9aa7831aadb4
 32 285198b3-8c2c-0d6d-b2f8-f94e27e95bd0
 33 6fbccfe8-cc42-88c9-bb28-0193f0a1c2a0
 34 901dbc13-67bd-66fb-9384-d525dbf3768a
 35 fdbda02b-5de3-7018-b108-c48c109751b2
 36 af165276-284c-101b-aa20-9ba866967b9e
 37 0597be77-9523-7ea9-b5af-09bcde8fa96f

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6646147825646685110308320846165086717. Exactly this sequence comes out of new Random(310).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 33 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results