A858DE45F56D9BC9 archive

201208112230 y2qwd

explained decrypted filler

seed 876

Metadata

Post ID
y2qwd
Title
201208112230 → 2012-08-11 22:30 on A858's clock
Posted (UTC)
2012-08-12 02:27:32
Timezone
UTC−4 · title 22:30 against posted 02:27 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
37
Filler GUID seed
new Random(876).Next(9) ✓ verified
Run
Run 22 (seed 528,385,484) (seed)
Draw
59 · predicted N = 37 ✓
Machine boot
2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
7 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

68FE22C074FFEF8E 93219C66110E4607 B6B75E81623C08C3 1D08AF795AE36071 DF422551CA770A1E E75EBD2E49AA514B DE60B67A9372F960 0973ED86E09E8022 303999CC52A4086B 85D41A3890063A33 22545B68B0ADEB37 2A913E88AC4EE547 08A95C41D2F677F9 5052DF904FD873AB 9F176BFD24D8E2DF 1296F5B962C95684 C331CE5CDD1A698E 633D852E5D33C688 5329FC2A45FF3934 292A3EB1E081F138 E8DDF3971E1C9B86 8718272F81E069C6 ACD725DCC4ADB032 F5E3CFA87EBEFCCD DB7B425043CB7926 B56A010750679669 5458AAE6C349ADF8 975CA4B4178A7625 92E9C31F520F2CB3 353784F592CA97A7 9E72FDD3E937558E FCECF1FBA5F31BCD 23127464441733E7 0B1B6D871008895A 7CA22F8ED35BD679 DE7346074EAF2114 96C5BB61A97131DC 1E2211ADB8156FDB 4547EA01F1A6A5CC 94BE138D8307DDEA D23BD2BAD7CD2999 4C9306BFF8A6B9AD 056B4FFEA0271806 1E7FEFAE661AB7BA 9EF65EC3485B2EE7 8253B6593D196A55 5688A8D981A1F5B5 5AD607BDED71E3B6 E642C6E9B1E3B03C 127D8A02D6188B11 C64D14E4409D786C F4D25993D727C362 9EA459F159B4E999 66D7887D998B8646 A4D1E0BBEB9C86C6 D32EAC41CB8A4510 1234456D03E95ED2 FE5EE8BD13C2A522 A0D977C3BD844BFA 1E4DECF5DB22FA50 6A612703F1E118F9 93BF47B4BC5F870B D2AECA754ECBA126 8827C64127BC8C24 FBFD339AB967291B C1DA3924B59DC42D AB1663371620DD0A 300527ECA2190F56 0DAB2D64588FB86C 402960097D8D8657 FB1BC3AD3CD4A13A 457F14C222651B5C 16761BF530EB1A4B 6D1121BB4DA6D857 444604A53CB46A6E D9E89D4633D99CAE 4F89CAB4F8BB563A D3CEDD5641B67430 A1911B9B72159852 E6FA22B4BBDB6D1E 5F6A4B6DEAA512D6 B10C4CE024966528 F63944135EB8CD86 EA236673DEC17767 82E706B990EF4DDB 2D1EBC67E34E0FA1 5295240C1E9F2479 7A21BF5C4632832D 609117B49A67912D 7F560C568301793A 2D326ECD0311CF1E F35426BD6418DBBF 0583ABD0382E7CBA 83681A903CF4D54D 20412CE3CD688EC4 224548C8A3F605EC 892B1F0D6E1FD4AA 2DB2EF4A69A6A937 0F08ACA89A2A0A75 C50E6FF216E0B17E F434AA1999192753 C6C00C3561A41C22 0C101CD73A926803 7489399E667611F4 B9DA95D6E1798814 2F4E9E6C9062F521 E0A19287353FCC21 D0D2411DB2A15DCD 46D316C03FE22A28 7A102A3DF0A22CE2 6FF420BEB6CF33C7 175B63C2E538E1F6 33CA2C3163D5BE80 249654F53657F2FC 2B5CC98884770776 70A08555CA511DC1 1EDC15A85D559F00 15248EE4D2623051 7A55037A0EAF0566 7DFFC48CDBB07868 A0A9BF32F01C313E DA62FBF747A4D2CD 4DF98A974E0A588C 3B79EFF44CC1BCAA BA5C56D3E606332E 6C3B494BE4598B58 E4DCC03AFB5F5440 612D0815977ECF9C 785B971FDE8DF207 550D2CEDAD3021A1 A89CCD710544D18A CE6356DBDF3C1EE0 EB2BD652D2E6CF81 8E38F6D2AED6AD56 FD165622569E830C 4B4F6ABA22C1ED56 6EB3DC55E0FBCBB6 A474364A5CE78661 3B56F2912225B8C0 5A338278009864F6 E0C8EE510CE27E72 F9701BBD1EB51E8E 20EEC4845AA7CF25 8FB770F1E3671884 A07E6D9DD9294A9B F62510BCFBE6C5C0 6989E0F3619C4F6A AEA45794134A3F64 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0df23c33-1998-38a0-adcd-0e1e2d878706
  2 8938cee3-aa40-7adb-a0a6-58c03cc791d4
  3 3098dcd4-6848-0d67-b20a-11c77d841f34
  4 3e0b135f-c7ce-483a-83aa-130ae0abed42
  5 b3fe775f-9f3e-6da9-b450-969d84c46bcf
  6 c06cd11a-d8b9-0650-8383-889749e8eb6c
  7 0df6a861-8773-3782-aee8-a859ae517c28
  8 4ba8c884-799c-8232-ae40-3e15db826fcb
  9 b4ffb420-702f-3b78-8595-1d6e4a3009b4
 10 b36ceb47-3a72-27d0-9a6d-4cf1d343b498
 11 cdaf49c5-5274-6038-9efe-339c522bf837
 12 9b3305f5-9389-312b-9493-f06a37f63417
 13 762836e5-8a6d-7935-9631-f7db7e08e7ef
 14 10536fcc-78ed-13a9-b607-86dbb3f9000c
 15 f8939155-e376-12a9-8507-ddb9ed420d43
 16 ec8aec3c-d76b-0b3f-ba67-6b9b0768f193
 17 78bfa11a-7b8b-08d4-805d-5b0ff4534420
 18 549837c6-9021-1ef6-8b5e-f9d16794ea5f
 19 5de897d6-2901-3c3a-bb67-ee6d9ae4042e
 20 b300471c-e38c-4719-b4a3-760d4399a752
 21 f419a8ce-10e9-12db-8934-c4cc2eb28956
 22 46a57b8c-2bd8-683e-8cd4-34911fc15e63
 23 b19781c1-2807-06ee-8953-ff82b460ff6a
 24 5ba0eda6-9d8e-0320-a8bc-5b37cf0373e1
 25 46277915-94f7-467e-bef3-64453c21fbc2
 26 0eaba3ad-2ef6-81bb-9833-fb2706ec7cfe
 27 3fb8d4cb-5370-0d8b-b224-2137215456e9
 28 049898fa-e323-4c6c-b1d3-bd003a0827c1
 29 40df022e-6099-418f-991d-51eb55c29b78
 30 9410c4e0-80b1-54a5-8240-d05e3ed22a6c
 31 3a7dec1a-c29a-59d8-a43f-bb81682dbf94
 32 99c9bbcf-37c7-13e1-af27-3986c04f4a7b
 33 172f51c2-0dc8-50b9-b3d5-492763f74dc0
 34 8b2d0282-ea02-8635-a800-5934ae90abe8
 35 c7086c36-be83-46f5-a4ea-e328cbddbede
 36 da2d60f6-a71e-66c4-9c16-26016def64a6
 37 7c011dad-c98f-5755-b911-feec971e3801

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 3704603832637110013416004804455158465. Exactly this sequence comes out of new Random(876).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 59 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs