A858DE45F56D9BC9 archive

201208111220 y15q0

explained decrypted filler

3DES(name+name) ECB, 26 GUIDs, seed 362

Metadata

Post ID
y15q0
Title
201208111220 → 2012-08-11 12:20 on A858's clock
Posted (UTC)
2012-08-11 03:17:30
Timezone
UTC+9 · title 12:20 against posted 03:17 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,680 hex characters · 840 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
26
Filler GUID seed
new Random(362).Next(9) ✓ verified
Run
Run 22 (seed 528,385,484) (seed)
Draw
49 · predicted N = 26 ✓
Machine boot
2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 1
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+namerun: seed

From the post to its content

As posted (encrypted)

BE971CDDCE1FDF7D FD35E6AC1E1DE1C3 D5BD6EF2B30CE794 480C90A7581F1645 83BBE6418E951CFC 71C2C9F4FF5A047C 857E8C7B4CF66509 2546D21851EA4E7C A4591C1EFEC64534 E7327C469E405911 4F66E2977F2E74D3 DC1310D1D473953E 8D30E30A50A55F74 DA22BE0A67843771 B3B9386DF9DCBBAB 83902497BEC6612C EA67D2F097F746F9 E41C40205722E51D 2620FFFC3D3CD182 CA96D46E7478AEEA E5B86A94DA27AA4D 0AFD1CFE6D07338D 1A1518BD8713D2BA ACCC57AC0B78BD7E 34C461AA6045E136 4B4C92E2F36185D7 8A9277C40EA66B3C DB1B59286A3E23FC 843A626D83A32B9D B2F56EDF95DA5D0E CFCDEC43AFB850D3 D2C2A24F20ABDE16 5FC6A1426AAFF7D1 9046AF5B1120B9D0 A3E6E8765D3EAB3D CA4313DF63808AB1 0C9118BC8AAA4D19 6C2D7FD65D65B45A F37804B8052504E8 6FF156A4AC4CA07A 94519446053CA6DF 88989A808B6CB2F9 0D5DB6506271476E 53441240A5F929CD 77B523BEA27A0A01 C73606724CDDE894 4157D33D66674885 72BFB8096EF6BA84 20073D66D223738E 7DFACF499357F6AA EB83C3D899677CA2 7D130EBD7B4CD5FE 7557816E1BE97B39 BE1244F83F62A86D 26C515BF50F65D6E 4B0E979C34A81712 E5C6BDEB8526EFAB 5B5939F453299B3F 517DE0C64EF40550 EC855E86DA88DB72 47F2280094B38070 2243EEE7773963EE AA598060659EC2E2 09E0BA0A84DD2CB1 AC6750395D9FDCA3 50AD517262E78985 A5AF29FE8AA85F1C BAD4DA31CBEEDACE 2DA2B2184DCDA10B 80B0F70CB3BF813F E72FC0F97DAF50A7 F1E83424CF52A81B FDB2FE50B25EDC0F 7E5D5A1D6C39C170 BEBF1E9DE2184FE1 3248DE4AEE44EE1B AEB1E4B38B6338F6 81B19243DCFC4D4A F599A34C647249D9 8065E5349FC5944D 5026946772B202BC 34D3C1E8E505EF94 281586BF058CDE3F 8D5F43DA328DE172 09FA12B840171144 8D94CC9B4441B3A3 117D052B37B92579 23F60F826933D781 F42A85F99AEA660B DA033A6A573673CF 8A24DEDD6FF59BFD 00395F00B291C347 9C5BB38B0E204C5E 62E78E5A0AC42DAC 1310EDF5EE2543AB 6BD57F2AE94D3F4D 1CAFD7077C629BA8 390BE750F5A98894 D0B87F168DC33B95 358C26DE935275E7 C52FE3A9D1E6354B B02A80599FEB2D58 B7CD21F4FC226C57 0BA65A80AFF35A2D 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,680 hex characters = 840 bytes = 105 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 26 GUIDs as hex (shown below).

Decrypted: GUID list

  1 6b29f010-8d96-7458-857d-8ee0714c8d2f
  2 06b3099a-467b-0ed1-af8f-fab8384c40b8
  3 9c4137e4-0b8b-7e40-a510-f24591ae5099
  4 fca0b34e-1579-7455-b998-20c035ea0159
  5 8e57183c-0287-59f8-a64c-67fae3950940
  6 75489b20-dde4-834e-ad7d-2162da1b5835
  7 c90d4970-885f-0d84-a659-5c153c894f4d
  8 e7a0a8c0-4919-06a3-9926-b9cdd3ca4af5
  9 cdbe6579-5cd0-624f-9449-244fdaecc723
 10 4308a177-2463-6a84-a074-edac68f269fb
 11 6882da26-1dd0-8b38-bc80-203c5294fdf2
 12 658f1100-89c1-0ec7-9abf-3172c32131d0
 13 9b8b16ad-8f29-44d5-90fb-63d4e960a92b
 14 57d543fc-7b44-747c-bba5-553dbfd7fbba
 15 42eafd31-24a1-3b43-b8d8-deaa1babdcf4
 16 0cd13e3c-3ad9-0aa6-aa14-7382be5cde27
 17 14811dc1-bd89-0d2d-aeac-4e59aee7df0b
 18 138a088b-26a4-3b58-8ab7-f0d8035cb9a3
 19 b7bc1c18-e2bc-412b-a09d-25ab96898e28
 20 071ef957-1445-46f6-8b62-d6e0b1220fdb
 21 6509d297-aac7-8d2c-9ab3-da83615de821
 22 aeb41311-c2e6-5b29-86ec-0dd5a4813370
 23 91d6de91-faed-1706-8313-34ad994f4ec5
 24 cad50090-a7d4-4237-8547-58934f181637
 25 d4b9e9bf-0aa7-1f32-b8c6-c97c8a0c4268
 26 702a391d-1b0f-3c45-8fe0-f6f75f339ae7

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 70775800668047300344851413. Exactly this sequence comes out of new Random(362).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 49 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 26; the post has N = 26 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results