A858DE45F56D9BC9 archive

201208151117 y9uer

explained decrypted filler

3DES(name+title) ECB, 37 GUIDs, seed 893

Metadata

Post ID
y9uer
Title
201208151117 → 2012-08-15 11:17 on A858's clock
Posted (UTC)
2012-08-15 18:17:03
Timezone
UTC−7 · title 11:17 against posted 18:17 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208151117) = 7e5427965a4d578e23de789b4cd98cf6 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
37
Filler GUID seed
new Random(893).Next(9) ✓ verified
Run
Run 23 (seed 21,083,000) (seed)
Draw
1 · predicted N = 37 ✓
Machine boot
2012-08-15 12:23–12:24 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
6 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

63094D4D0BE8E434 C5428845AA6E4092 53A5C8BA5EC0C737 73A632D58B331EE7 8068B981BF067945 386976A3D466C2C2 2F734AB2B30B2A38 D5456B1CE5E9DF44 D5ED3E6A077252C1 468C87B1DFB3A524 30433DABCC27BF68 1D8BCCBB020A1EC6 9167B25FD6B329BC 5AD613B04934DE60 BE740174C1F46D9D 1670E48FFB22041F FBD05ABA3F740BCC E6197687433B29A3 9A15A7EFCD9F0471 6DDFD2AC2085BC4B 90F2AA2B0CFACBD7 F6054AA7D3C9E39D 8F8CC0066CC72C18 FED20853E31B0E09 7E9C47246A873B1B 3C96F1FB5BC0071F 4111D5060FC734C1 10F291B507B809CB A68216C792740582 AE6D1E79640F0DB8 00E2291F09D1038D 46B603467255AF76 68C5E92545B79E63 1F8FA2CEA3DE7B3E E4CF253EF8CE28C1 DED670559760537D 4E38770F31AAB05D 8E2660CF487FDB7E FCAC58621E51E1D3 4074A01FD2598550 40CBE38C97D86E80 CDE0F58FD59EA846 39B4E9FB07910E98 021CAAB7EF215157 C636868D6088C799 6DAD641CCAB4BDAE A1ABCC8A8C758BD8 F4D05450F0F141DE 9BF31F65AC54AE5F FDBABD5E9A97BB02 6DC72CE9D0B33BDC FDE25322467DD347 58883EB0369C034D 2943E30674756229 81F91076A02B1687 01C6371B7CB14195 FD8601D303F69682 DF1C1EA37F812A53 B0D743632B78B48F 1DCEF4538845A8D6 0D64C8F10062B623 D667339FE48B971C 3F3CC0549DCD4D31 E5BCA54245DA0DCA 9DA636AC9B3D486A E3C88B141D9BC2E0 2F54F5F91358B7A0 FFB091E97FC185B2 4808614809A1BC27 18D983460E01B5A7 1D2465D83EABC1B6 5C4132541100EB7B F13D8100F4F3B0B9 ECC7D72E940A86FA A41C1B25F06FA6CC 8FEF20EF80546F41 A6AD863562542A5B 73AEDF7B620FD255 08C18FC45EA3B51C B0C79CA456DAAAC0 94BD861F518A8087 29995BF96C33EFEB 0FDA17B1768F4930 9BF35758167547D6 CAAB2D8DD837B683 069D7F115DC291BF E167807B7E9BF397 E00D3B09505777A3 03D0A7B7886CFA07 06470F7005205C98 2242B69EEFC335AC CC42D4FDDCE34CED 60F51BBDF75C9273 EB0C7FB2C19AF1FF 01B46C5BB7DE7F42 FAAEA881D8FB03BA B57FE6BCD4C2453B 07765DA6B26D7615 0B493C65ECEEC3AD 3B19A0202E4BAC0C 207B43CEACFCAF1C 23A2082C26C34341 1179184808C2888D 81A79E87328B708D 2CFD2B3F93BD1F1E A7536739A3600700 FCBC7EECA6EFEC30 B85F928BE29F809E 89E4AF49CB618900 AD82802D98A6787A 0E490D2ADC3C5445 B2E2CDAAB8D98BF4 13178FF57F646B4A 095595B1CEC85CF0 5876E57190DF5DA5 EAE1A629105BEDBF FD33E21EBD495500 19ACE6A35FE3BACA 5CEB0200E981DCBF 97C765CC1CADB3C4 95790EA92E6C8A36 A23D19FB465DA9B6 B3119468437AEE69 F755D59FB45F5EDE 9DC96C2C837C5C8E 1329EC72098DD30F 8289BAEA4E58F40C 297840304F02E612 04F302502A85A487 114DCE87D9226EFD 79D2D1C01464C73A D70AE772B18C9EC1 87296F258310060A 1335B94B06BCF3F1 B75844F32DA9A9AA 37D3D0C280AE16A9 47BC8A55B6DF8996 752ACAB68DBFC61A 820A1FDBD5F77280 59F6D61E58A9E7CA 1E866EBB517F1B8D 8053A7AB6D1FF91A 654FA75C0AD16E31 15646D4D5E5BE0B2 152DA41888EACDD5 9B5694841ED61F97 A934714531821BFD 667BCC7DB6704721 CFB78340E5B20409
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208151117 (name+title). Key = MD5(password) = 7e5427965a4d578e23de789b4cd98cf6, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0f307b68-ddf9-26b4-ac1c-f9cf05bdb404
  2 b47f90fc-c9e4-769a-8272-6d338ee02371
  3 b697959c-f2c6-8c77-bade-c5c9c8bdd1ad
  4 15bd50e1-64f2-1ea3-8a81-0f8c8ad5e6af
  5 c64d7123-c354-36ae-a71e-946ebdc7777c
  6 f3a8697d-6ae9-8296-b8ed-0fee9285179c
  7 3522e4e9-53a9-0b39-87f2-f02268ffcc09
  8 ca5d4708-0365-4e70-8f4e-d7e97e155f00
  9 ec58b25c-3eda-4d0c-b8f8-5b2d6d17292d
 10 e9293d43-741a-56a6-a675-96bbe3ade091
 11 23d8fc4d-1f00-124f-988d-940f75fb9244
 12 78268833-6527-5154-96df-97e19b0c2820
 13 fbe79263-26ed-425c-8a30-5e11dac8abd7
 14 f0de3953-767e-06d2-a74c-c5405be0bd02
 15 e6cb0d10-cf51-07e2-bfd5-e1e574a05fa4
 16 a44d1d42-ab72-60be-86af-3f137a4ee787
 17 510d6bc9-3d3a-2420-a891-ebeae4c22f3d
 18 a663b5a9-7c37-53b2-83ac-125366a81e1f
 19 744f25f3-50d1-72e9-acc8-de2282f77b20
 20 8f804003-691f-0366-92f1-fb3a4ce5b2ee
 21 50d24091-637e-4f86-a63a-394be86724dd
 22 2e761f3f-b011-85f4-931a-8045729232a3
 23 4a43951c-a28c-8b5e-b9ef-ae170c72c113
 24 a534b6a6-c6ac-8d8f-9f6f-a2f38af23b3f
 25 bd31f200-1383-1089-9530-ce3355440c54
 26 4cddfbe7-d7f5-7f3e-88dd-b74a2a20e52f
 27 96ad4158-c004-6e6f-88e6-c4fc71b76922
 28 5e3128e7-e57e-8d6a-a96f-fb5fd0c71760
 29 6b75c53c-0e0c-1359-9132-c878623fb681
 30 b266b222-8e2b-2fa7-a6fa-a004ec259530
 31 43c40d60-34dd-793c-ba61-f77d5a600c33
 32 ddbe65a8-95d9-6b93-b664-57d0e25887ae
 33 142acd9d-7acb-340f-9af4-edb95ef00d5c
 34 f029c6b1-06c5-3f64-8ad6-ebb1550ce23e
 35 e87152a5-28f8-4cb3-ba98-4f899fa67163
 36 16789d21-7ae8-4515-a965-92d7ce182bbd
 37 abac23da-dda3-6563-940b-38bc6953c136

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2781380445154006257048881768127633446. Exactly this sequence comes out of new Random(893).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 1 of Run 23 (seed 21,083,000): new Random(21083000), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 12:23–12:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results