A858DE45F56D9BC9 archive

201208112350 y2uwy

explained decrypted filler

seed 548

Metadata

Post ID
y2uwy
Title
201208112350 → 2012-08-11 23:50 on A858's clock
Posted (UTC)
2012-08-12 03:47:46
Timezone
UTC−4 · title 23:50 against posted 03:47 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,512 hex characters · 1,256 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
39
Filler GUID seed
new Random(548).Next(9) ✓ verified
Run
Run 22 (seed 528,385,484) (seed)
Draw
67 · predicted N = 39 ✓
Machine boot
2012-07-27 19:02–19:13 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
13 · 1
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+namerun: seed

From the post to its content

As posted (encrypted)

4D231D74C0E6E572 AA5F764296F7B9AE 12A1112D720536B4 62A096C155FB52BE 42C19DE3C699A064 F9A8F044842474D3 2C0038D75BD1B671 2907B951A95A0792 32F612DB5632351E 6FF39081D20783B5 CF47206A4A2961CB 841D112AFDEAFC09 78EFC479D7B35577 8460DE6AA167F8EB 1DD823D8102404CD F8FDACC857DFA45D 59F1ED82593BAE6A 00E2FC5907DC8CDA 534E94775061703A 9443FDAFD2759FC8 B331F08ED642BE9D E1497B53B8733CB4 6B22D84AE9850A95 A2041EB2A5612251 4858EA0ADDFF7E0A 74BEE6BB45CF7805 E99A93EC4A510C35 9496D75E5F8C93A1 6590801A164CDED2 910F3ADA81CBC993 B3636ADC05799461 DE7C4DF3F8DEA3AB F815AA3FAFF990FF 3886E1DAE008C1CE 45E358E21A34108E 549250D5A6C7F7A0 3EC53484AD49882E F5D98A55682786FA 59C2DF4FBDD997C4 FB5EBE3151BA181D 1F2F3CBE2A8F6EF3 26CA4C358CCC3210 1244B4B42AE893B5 6F5F9C8D48133F0B 066FE120DA209FD0 B2D15071CBD136B6 6CA77B898D95BF5B FDA0A0491623C301 CD418477D96E92D7 DB40A938DB6BADE0 74DC39D2BB79C03A 82941170C1829180 B1E6E37F3D349430 82086ACD67C09448 256709ADA4BD31BF 92882FB0D639CB34 B92E2518CCFE3296 4066FB11154A2FEF 3A7458067FEFED72 2CF901A92DC9D75F BD6D4E987D228B75 88731F47D25B43A8 731A31E70049B1F0 80E6D3EFB9BA000E 14FCDB694EF5B291 625C92E3867E354C 87BA6967E15C9241 9D136556ADF2BAE0 90D9CE02CA1E66F7 6CD28C2F8DB0363F E24F0F4A660C44DF 5D524F669A86B4CE 8FE8DA09802A0EF4 3E3EFF690E5F0DD0 DC6955B890560484 123C6BE5B07E1AA4 78A6CF66743703BA BEE6CE9D9B001C1A DF8ACDF56012C200 8D87968284D1B10A EE829981970781BA C51C29685CB0051C 335996B39A073BF5 8E31CAC6B1933336 EE97579069C08012 A9F9E6572560EE55 35A63134DD600B35 676FA3AB3BA5320C 85DBC1A8A1F05CAB 8FC68B2AA1B248D3 C8322705E7494438 A8BBF79749556C64 167E3A6BD689CB1C BDE124E76AA35D58 753DBFF0DF9F0DB8 112886DC7CDF17A4 2DF2E57ECD263010 551B98018EE2E207 653D3C700F39D822 75C0DEB68328A7E1 FB0DFF466CD4BA75 54E9833C4F874D84 E4654911E43426B4 816C5988BCAD281A 294846ADE275E0B6 71D71EE8FABC2022 885DFD034F22855F 1570C10E9F86300F 6E048B9947A7220B 9084052501DCE456 C02D5F22A2BC96A2 8B5A42E5F3FB6631 A5552DD921F1FA59 E1E5D5FD17E8820B AD8BEF23E87AB22F 90C71FAC66A3DB16 3F532FB54C31C8A4 03697C54FDABA7E9 A31B60B1E69CD0CE 29A52A22C5790FBD F425F31FDF40DAA3 96607A25834148B2 233D18463F635AF7 087B952D4E390E82 D6F16891256664D9 CEF71BC7E7B4B73C 9DFEE6CD42C5A9FF A78A1196BEAA58A6 A0FB721685910E76 0E3A8D286CEE5D96 CF4358F1E59DB2B4 9C04228B5741EEEC 914AB062359D8ECC 1693E60438B90005 6253058182D4FA47 C69010AC41F0446E B90A5564BBFB725A AC90D21E1E2E8DA7 2A19BAE1E7327B4E D0A4B7F287B4DF54 7EBC950184312320 E7201C976F4B9787 84F77A18EB9948CB 7301A6FBFB06B7CF 01A62B31E174C4A9 06FECCA85003E9E1 BD2B8DEA9DEA24B2 315C8F06A72E4D57 D8D422270F50B581 431553BBD797A708 1CE936AECF03311A 76C85CC1B8316B8D A73DFC04DE969766 F2401EE4223D737F 13AAFE1A9C0F3867 219884E96BE81E04 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 2,512 hex characters = 1,256 bytes = 157 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 39 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2f49f98d-5069-0c03-bf02-1e8b6b0de72b
  2 8c652102-2168-5790-8725-9fff62df47f5
  3 d9b957b6-686f-79e1-9db4-36124cb9f17a
  4 b2f44dc2-a86b-403f-a4e1-b22ea8bb994c
  5 3cf0429c-d1e3-5f82-869d-e5678f8d11ce
  6 b1880089-028d-4ede-8a4a-3fcbae7c0180
  7 24e75c32-9766-3217-9342-e5baceae67c6
  8 e991c7a8-1027-3f3a-8662-6d2420b5e0f4
  9 85490a4b-884b-66ab-a021-33fed90503ff
 10 839224b9-0716-3937-b007-5efd3f32bc6d
 11 3728f2ba-048b-06c1-a6e9-227d941898bd
 12 c0e8c70f-aea4-226d-ab90-eaf361e6fc04
 13 b8cfb55a-9a41-3f94-9f70-f4f696e32de9
 14 73318b97-bc42-5f1a-91f1-bd1ca3f23be2
 15 536a285f-d470-52f8-b3b4-965b8e266b21
 16 118c0df9-10a0-2c3a-a347-525661e91e1a
 17 0861dc46-b7ba-106c-a67d-d9b3fb7bc350
 18 6a838ae8-9d8d-60d4-b764-46753f089e6e
 19 9ef2d1ae-e78a-4de3-a267-004931e3e843
 20 51707dc2-b3e7-4307-affd-5f366644c975
 21 d932e54c-f7e8-5b7d-b0a2-40f500162f6a
 22 a1f2f445-e954-22e1-946c-e28c7c1f510a
 23 96bed70d-f8c9-5921-a98b-35c29053ffaf
 24 cf2935ab-21a2-44c8-adec-9ba226b84bca
 25 06715303-54d1-362d-939b-53dfee63b83b
 26 6e03c54b-a591-884d-bc78-faef8f0a6099
 27 76aa160f-4272-0757-a78e-0624d42ff64a
 28 38144488-9258-233b-8c34-bbdd7e2ee769
 29 0335e9ae-4eb6-8676-a93b-26b3205eb117
 30 384b5cc8-0982-3b59-92b6-de6be5bdc899
 31 907c7322-045d-4e19-bf68-82fac9c8a012
 32 53cd0d19-e75a-733a-9a4c-96d6b41cac71
 33 6d06ec11-9b39-528d-a968-7dbf57fbe207
 34 0b3d11d4-1081-6c4c-845d-fffcba69fdd7
 35 dadfaf44-0192-83eb-918b-85887b941823
 36 20b07a28-9a3f-4c74-a0cc-047aa5344359
 37 e32167e6-5e55-8c87-aff4-f20a59ae9e0e
 38 e397cab3-7dd7-7a48-a19e-9f457f9716e2
 39 29c57049-e15e-1bd1-9820-fe6f8dd0f261

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 057454336302355216445254380283475684871. Exactly this sequence comes out of new Random(548).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 67 of Run 22 (seed 528,385,484): new Random(528385484), Next(8,64) per post. The RNG predicts N = 39; the post has N = 39 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-07-27 19:02–19:13).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs