A858DE45F56D9BC9 archive

201208112300 y2sgp

explained decrypted filler

seed 423

Metadata

Post ID
y2sgp
Title
201208112300 → 2012-08-11 23:00 on A858's clock
Posted (UTC)
2012-08-12 02:57:36
Timezone
UTC−4 · title 23:00 against posted 02:57 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,616 hex characters · 808 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
25
Filler GUID seed
new Random(423).Next(9) ✓ verified
Run
Run 22 (seed 528,385,484) (seed)
Draw
62 · predicted N = 25 ✓
Machine boot
2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
10 · 1
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

4EB43CF2BBBBA141 6BEBF73C1F002904 E4348CDFFCFA33EC AB82D970142A44B4 42F7AD4E29CFF9E8 7E4129A457B73834 BD63A9A46BBE125E E3DC881FBACE145B 94ABF229328599F5 5BE3A3D3AAD76FD1 573AABE858FE1019 EA3117C986F433E3 CCC98355C8BF011A 10C85BE091385BBB 92B9A95047528CAC 46370D4A8B4C0A95 FBFE37E368F37F62 1FAEC23A797B9699 C57F9560AA906F72 2A60905B36C9B45A 175CB0AD979830C0 CA3525A046028233 401FD3F465A46093 64442FDF6CDDBE0E C410220C2349E67B 134B204EDE879AD7 1B18345EC6E75494 33DFCD3E3083DC19 3BF617B3188B6E26 B0FF37C73B8329D2 0869BDBFBFAAA9E7 42C2DC052FFE2F11 AF5F8DA34E45B47D A68D4AA4D0DE740E B096498AD8DE465C FF37B36542038C51 D6A298F86ACB0869 C60B41E382356455 7F93E44F2E369D67 3960A00271EEE605 CC479C0425332A53 DE7908F120983F81 E06A07F01A7BCDFB 712D8BC6479676D7 79ECA8A286E876FE D0A3A108215B716C 5F9F145D7312A254 F33AF99F22116772 0318676B00E612F7 C3589B9BE312D6CA 66108B50566E6ECC FCF88F1455B8B00A A28D2CCE1D7EF777 E84EF0D13C61C589 6752E2F5CF1175AE 085E6FB276A8EEA9 81ED2675A74E51DA 8D719ACB4856FEAE AD855C1AE54BA43F 1A3A72E1985E740F B3513EB91ACAF8CD DC36809A2A006A31 0D59CF1E9FC00876 E5F80DEDEB44584B 9711118704F677E3 F6F90F9420E902F0 781C07FCAF308BF5 AEB8488E0B6AE6D7 2925FBABE2B8A78C FF5BE969624EF7DC 7FA5034928062D50 F3740670D7430621 EA9C237611451210 49234529BA487A53 9FF728A56F95D51F A1A5FA5A3F4F7626 CFD8D403A3AE18A1 14E9A993136B12DE 2AF68A0DB590FBC9 AAD72CEEFF72DE87 1700B198CDB70B8B BB66BCAB93313456 EEA9D84E705C19F5 156AA788B7E5F0AF 03211F993473CC4A 88471126A038669A 8CA41850E4D7E7CD A87952D30B747DAD A739F671CAB36338 C4497525694CB46C D338533F76844F9A 40F1EC2BBED1BE23 6C18974E6129132B 223C220CC332584B ED2470FCA4D1EE1F 078F4B876F2F5350 782070B64D295600 DFAE1D67E1C9B341 E26617E943AD1452 C476BDFD0945C979 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 1,616 hex characters = 808 bytes = 101 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 25 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0ad9b844-bfcb-69fb-9c08-a35b58872ee3
  2 79a5dcd9-1768-80f8-bc96-8b8a462b21b5
  3 e17317b7-4953-3db2-9285-081d5a954be3
  4 612d1c5a-307a-7de5-a106-ddc922c3b8e4
  5 721d2ea6-93e0-1fcc-abf4-b1ecfffae2e0
  6 bc7c250c-d09c-18bc-98a0-da90bf4c5780
  7 85eced6f-1368-30bb-b576-1ac0bba8400f
  8 85de15ac-2449-59d1-8f90-3cbb92451118
  9 19c3366e-72e6-2c18-a7f1-c61e264547cd
 10 c948cfe6-2608-23dc-8acb-d60759949595
 11 13de4c84-0430-8cde-8753-f85e1fd14d10
 12 3a4129e7-f885-6a29-97f6-879f0f457b4a
 13 c868210f-a21f-30dc-bf8b-91c681ecfa20
 14 7f3ed705-f11a-4bd0-aa11-748af8d2b428
 15 1d56a473-6e8f-0406-9235-214a5665256b
 16 e1e7b745-449a-111a-98fb-c088fb322962
 17 f9a7c97f-1015-6386-8c7c-6040ab96520d
 18 f805e72a-5e69-2d80-ab66-00641e0119fb
 19 ed5ce3ec-d0e0-1aa2-8c05-98f4fd84123b
 20 14138e67-b3a7-0fee-8ff8-9cbd91b78fa3
 21 df14ef58-591b-01e7-a1bf-3c331f5c2bc9
 22 626518c5-e279-577d-ace0-22273f64aaf8
 23 c23765ab-20b0-487d-a95b-ab6fecb85f2b
 24 b3989127-f991-7098-959e-99028a769824
 25 c4253b7d-e1dc-114f-b13a-dca4b0720a03

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6837113522863401621005471. Exactly this sequence comes out of new Random(423).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 62 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 25; the post has N = 25 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs