A858DE45F56D9BC9 archive

201208112130 y2ntf

explained decrypted filler

seed 923

Metadata

Post ID
y2ntf
Title
201208112130 → 2012-08-11 21:30 on A858's clock
Posted (UTC)
2012-08-12 01:27:27
Timezone
UTC−4 · title 21:30 against posted 01:27 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,256 hex characters · 1,128 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
35
Filler GUID seed
new Random(923).Next(9) ✓ verified
Run
Run 22 (seed 528,385,484) (seed)
Draw
53 · predicted N = 35 ✓
Machine boot
2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

C566285C0D7109BF 5F83A3CEA7C155DB 419D34C4201F0D60 6EAAABD8006455FD 324D26D7BD395464 83D245DFFF8D95E3 A2B80F9B06500C06 675F718420AB4A8C 6281CF90EC9E643E 85B9222434B7042C 9A5C51B95B48B87B 4CE92BA6801F9E2F 3268EF28D69F774A 4A547BF452BC43CE 17E1F4204D7EE6E4 483C8160C160E7C8 64596097094B3F03 582733E0216F127B 0CEDB162873B37CA 883F0BFDD05611F4 083CF2C455EEA852 CB60DE1C0EB5F9BC B492C3CB772AF140 715DCF73381A2554 D021EC17B0A340BA 2BE39E07F54C3425 474F151372EFCF4A 15726666C6519837 35D505AB61C736B0 B044DFF50C4C550F B96AC2D7ADC2F2D8 D4D764CBAFD0C83C F4B98CD57B4AE483 B7405D84D070FFD0 00964A6CE1D5BEF8 7A606C7670ABC106 E7A6C69C9F7A5CB9 1698C7251B972DDD A06424DB78DFF0CA 33DE60C1F8AE4D4B 0A8865D3E3CD361D AD0D5572FD2D8DD4 2DA24A6C6A05F469 AE2580C306BD3C33 BC2CB74AB7117209 78C2AD9039ADB21E 0659A0A751080CEC CFE7B4CB17F3E531 BBB8E719CC9BFBD9 3FCE9C60C3BBF727 9BB8AC940BF034CB CBF657283EB0FA43 A8DE2297A43A3328 22CD07355185993F F2FCCAA4F340A058 722A46BC92C836B3 17C6836B4E50E243 1782455AFBC02EEA 06C9B83B99F1BFA4 C4FB2C6CBCFDFD9E 21559033D16BEA7D A8327A1B826155DC 8F4DEA83914D53CF BE94653A00FE6D6A 52568E15EDE25793 EB3226D5013ACF18 4EACD43D57B11CD8 BD0DC3042E709ABC 68006992F6095FE7 C4A48E06AFDF1CA1 B50EC9DF27B8A6E3 E1332D9B22A827CA DEB91C1759F493C4 A2229F09BC5E4977 40AB02015B80D617 77B160548A47AF24 723612B018A6506C DFA0DD6DC93ACCA6 54D3E6037A3A8596 E134231D78B79F67 EBAB99B1A4A280F5 A97CC1302D7EB0DC FFB19E9120F64FF6 B5628D3730399A1E F211A02FBF26EBDF C1D43F2295312B05 BDC37C8DBAD9FC1C 8B1B3BE228AB79A4 3271C14B1A02910F D57FF98FCFAE5DF0 7A6F905839BC284E D13E734A4CF7613B A62835CAE7802A43 C5E0DCA95237B63D 5E47C2798C87458A 245C4D8C422D4B9F 8C572637BC6B08F0 9D521BBD68FB036D 11AD311DF738F76E C853F44A7D74536E DA7F753329E3660D 05A97E5E77369C06 87B63219641E35AC 428CE00058031298 408DD9080D235E3D 0391FEAF886AB078 594EB4BC6895E462 524C4316708A6DA0 57A8A04F96F2ED42 0E9D28C977FC6B5D 08EF996B031B807B F2C50A1A8C31FB9B BA28DE436791B59A 25F65557257C7B32 6C13CB6D73C5A48F 69567B9A30FB6731 2C845CD7ED944FFC 85E7FD0AE194F83F 7B9E439335F942D2 AAE278208A1980BF FE9B80F078199906 9261B40172846430 9167DA663CE29CA0 2E54CE5CC4F7BCBF 3597B10D5D90EFB1 DCDDA16E61AFD547 2564886522DBC93C CEA262E1D30F3EC2 35EDFECF6110D1A1 766EF59D1FD3F04A 3AED30EA25C94222 7B9D15E7520F0D53 3EDE51896971F24F 091238C9C3E45440 7BE4EC43F9E94426 E5752B13AF029062 6376636ACD888FE9 72B7C3E9B3840D0E 7FBB5BB613300E34 3991BAACD5EE00CF 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,256 hex characters = 1,128 bytes = 141 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 35 GUIDs as hex (shown below).

Decrypted: GUID list

  1 15beb377-3a6d-8a69-bd76-abf310e837ba
  2 c548ca3b-3302-5ce0-840a-99197ce8bfd3
  3 e7555646-5e0a-8980-bdaa-a221899ed3ab
  4 756a39b1-4e1d-51a3-a490-b373d4b20e6f
  5 4def3f3b-b6c5-81f5-add9-9d8f1da728d3
  6 80060075-aa66-1e41-a58e-9e3ed6f97b0e
  7 e2584faf-4d66-40e1-b779-3a095b3e6c95
  8 6bf1c981-e3a2-46a2-a8a5-2480db4a797f
  9 bbfe86ba-f20a-11c1-ae0f-438d031b45ec
 10 e64bef0c-dd64-5488-a3c9-67a79abcaafe
 11 eeb67691-c200-23e9-bab6-b8691cf33be7
 12 848a9aed-4b14-0acd-81c7-658468ea9bbc
 13 8f9d52e2-198a-13ff-973c-e9bc1147c70b
 14 3feaf822-7bb4-5273-b9a5-4f1bea52b832
 15 7011c638-94ab-0f43-aabb-237d812b773c
 16 5ec68916-c54a-4f8e-8ff8-38ec358bd5b8
 17 4a396bd5-8175-7e87-a68e-90b7ddae72ee
 18 30ed5e77-58f4-2fdd-956a-e053b2d9fbe9
 19 9536fb69-18e5-5a81-ac57-99119cfd9e9c
 20 ba94dfa8-f306-6725-926a-ff1790480493
 21 77f79ae8-bdcb-4e9a-b654-042c10fa640c
 22 ac2ae65c-dfb2-2ecd-8a5f-2be415d37525
 23 ee3b11e9-f427-8a0b-a196-53c2e75e0503
 24 714f11eb-1961-4fbc-84e5-acfbb0a589e6
 25 8fd81cd1-980b-14bb-990c-b68ff3698f19
 26 67b3137a-4e1d-173a-a576-98a7ed27467b
 27 89e0a0c4-dc81-4310-bd8f-73245af64cc1
 28 4f4d77e3-f959-55df-9d1f-ea9dcfff0900
 29 28a9f8d7-d894-4bf9-8072-97d8f980685d
 30 e23ee2c0-1891-3162-9485-e3c8901f6c4d
 31 f297e637-de8c-8d8c-8d55-3bf28b75b40c
 32 deebc797-105f-5652-98f0-3c792ed0d651
 33 8bcb6280-c5bd-4166-bdfa-cfbe36b1149b
 34 58202455-6d56-1f69-a7aa-9a977e3ebd6b
 35 1491bc55-1d41-819b-b32d-c468f7b4d228

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 85858144152015047256428411454385418. Exactly this sequence comes out of new Random(923).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 53 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 35; the post has N = 35 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs