A858DE45F56D9BC9 archive

201208170315 ybyob

explained decrypted filler

3DES(name+title) ECB, 37 GUIDs, seed 822

Metadata

Post ID
ybyob
Title
201208170315 → 2012-08-17 03:15 on A858's clock
Posted (UTC)
2012-08-16 18:15:05
Timezone
UTC+9 · title 03:15 against posted 18:15 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208170315) = 17e2394f2c9555b3518d974cd20a2cb8 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
37
Filler GUID seed
new Random(822).Next(9) ✓ verified
Run
Run 24 (seed 39,416,093) (seed)
Draw
7 · predicted N = 37 ✓
Machine boot
2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

B675EF36805CA541 7BC31E327741612A DE828365B77DEEBB 0A1D01F213E5699B 2E4A0A7BCCD937F8 C65CFB238BA6A752 FA7CA0F25940B73B 5CAFFC57E51BDAB4 CF14F8ECBE98C232 712FBB89FCFCE61E 01F2797B7A11D666 DA97A2A369C1BFA0 5FD983907558FBEE 9B57EE934F456DD1 E86D1756F2E96A48 530819C7DB9147B0 D65096180FFF53BC 6E62E07E8252A74E 55ED3EAF6B765305 3D7CF9DBE74EA03F 633470C1CD6742F2 5D86DE8F838A105A 0DC83CB15F609FFE 7875D18F50317549 CEFE4DB5CB0AB334 A76DE82A69C61812 E81BEE25B51E3F0C A5DDC54AADBF8317 2C69F6642A56EE47 A272743F5E5FA539 9460F56646F34C6F D8AD7823858F4ADF 27C54E606AE9002D 00CF60524AA70ADD 1FBBD885098E8D3D 07AAAEE07D5749B5 690A9FF5C62826BF 1FC61DC5F61CACF7 E0CB51DADE46C97E 27A583D5F730508D DC477D94025636E4 C76509812225BF51 DE9512E5335C0C87 34D3750EA699A735 86FDF9B149120E28 F0DE0976A5B0BC18 7D043166201E977D 6008DCD0A582C98D 32A143EC99BFB0E8 D5D740AB713B081F 628DA63B350803D6 62E9C81FD5C5A536 AB84B83CE2A1FF8F 8AD53D89E8980CBD 118E3D79F7146365 A30D15DA3DB1B91C 111583ABBF9A70D6 4D2B1FD5E430E046 2A44538301A91763 9473B35C6F45C0EE 360A2D8DE9DEE647 0C704F53B2EA6928 6EA8416A8063F325 1BDDD876D32E7D21 D8C16DECB76EADBB 6E46629641BCF909 8E73B9AAA8DB6D1B DBA85C52F7B380F9 5966BA9D3DBB5568 68148D27587575E4 6DE94449CFC0263A FFEFFFE6165BD694 919150219A6FB131 9515B75708CBD2AD 83E4482B5D32D63F 0E9FD8681C414116 385BA2707ED0F4D7 696E8E4C7D3D8EDC 935B952C3BD94733 584182D8E13C078A 6CD4D85D3E17FB5E 2C31CF82639993D6 92EED8D9A2F1394A 83A5F8C764F082C5 4AEF106D3C5FDA93 7BD688DB8934B6A7 153477B7CB94D9D0 BB093C66460EA552 A734F72DF558B48A 829574EA25C0CCB4 EC485C6AAEE901C7 82D2E7C16B19671D B72C1F8F8CFFE56D 0E388B6265D731DE 1226188B3DC1E518 5EEF2C3C42910629 9E1F51A8059BA26F CD96BE559D6F2EE9 33C49D919C5CAEC1 F9D78B2105EC38E5 A9A78516DA9B7685 D9D66F05883D07AC 1EAEBE924118259D 1657616429EC4E9E B0D1FE26DD29A5BE B3A1E9E842EA66AB 87162BB39ACACC2B C2795AD256F72F7A 39B95855029498E1 680B01497D6C77C8 0F030E49427C3AC5 6D058FF63F5C79F0 36B628B52BBCD73A 09AB015AA89265CF DA238F917F7C308D C32BE77F261755BE 81327E96F7713C12 85EA2A78BE967D72 188256A0458AA979 32BF0578E9B41DB6 28BC54F3C6CF9479 0B73BA7A28AF61C6 105543A259290511 C35A68D85689F5CB 8B5E002B41101155 DDA58CA8CA72A4E4 F3492956089F3712 905B95DC2156CC8D E6D3D948EAB33878 50E305AB284CFA44 67A602C00ECF2933 ABE38B9E17C79152 184DE86D2229C581 39CDC45122898214 D57C97EC02946C20 ABD2BEBCF213E455 39DFBB2E692097D7 1C2CBB886A1C770D 52BBDA6C96E8A2EE 8771D2FD49D08116 6BDEA2CE69D74C45 26C8473F6F41AD34 17989FE37960607D 850CB0D2BDADFA51 0AAE1807BC79B224 411022381E07089D A4A24A8462897936 933CF1393008ADEF 58412DEF565E25FB
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208170315 (name+title). Key = MD5(password) = 17e2394f2c9555b3518d974cd20a2cb8, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b69dd935-a650-1b4f-bcab-886226453d55
  2 2ecad600-19e8-074d-94fe-e35e446f1190
  3 00d59002-e3de-3e5f-a523-c560e9f3ecd9
  4 b5dd7873-a9d3-0397-9d69-ae5bc6c07748
  5 d59f721f-6239-2ec2-a68f-1fe12fab3bc9
  6 cddf60d8-fe5f-80ee-a73c-9408d670f8fa
  7 9650cc1e-e524-187a-adde-360938e93a28
  8 f43e807e-5b9c-7a88-a6ae-e04fe17f074a
  9 79a2be4b-3d8d-63c2-924b-f5abad68e5a9
 10 29547cc0-18d8-3a51-871f-4160d902b544
 11 39eec48a-f0cb-7707-b3f2-b61459638e4e
 12 9e67aa42-4bbe-1e11-ac65-ea3202a2e6ec
 13 be82065a-01d8-6ba0-bd2c-7f3c28d9104b
 14 77c367fd-d89a-1b77-83e9-3f9699f8722a
 15 25f43178-91fd-3330-bce7-6a81231c4d9b
 16 385b27c5-eaa3-3585-96b9-2117ad180ef6
 17 03e1e01d-d67d-331c-8cc5-b2e12ddc7296
 18 618e3839-c9aa-5032-b6ae-f7418b9fc0c3
 19 661b6f0e-5cb0-8db0-b192-e799651b552b
 20 a65f0073-58e1-5b39-a973-4ad4ad07c39b
 21 ebd1b6a6-f527-0cdc-bdd4-0bcac1e34fd9
 22 af42a892-77c4-4bf4-8657-f63dd07fbe23
 23 583234b4-f24c-8aea-9be4-517fd3024bd1
 24 472fb7e0-ee3b-1d15-bdef-09e722d9ca65
 25 9f1130c0-40fd-23dd-a9c3-d61e31fa2076
 26 be78a4a4-40a5-21ad-bf8a-a949bf9869c0
 27 7c14a1d9-5316-5e7e-b556-63ed2c907f50
 28 d9dd9435-b65d-0d60-a354-623a432fd670
 29 be479e95-74c1-537a-a9fd-c21b00369b4c
 30 ce9153e1-054c-01b4-9722-3a7e51bca475
 31 72fa1399-16e8-5c77-8722-3932b992ea72
 32 941b2365-194b-86ce-a055-ef1351d42e55
 33 d60ee206-2e75-7866-976a-436cda7c1b75
 34 915fcb6c-8c14-5929-87fc-f2ede35c6381
 35 34880642-c5a1-6e24-b100-a64794f5b03e
 36 a20e1610-3ad1-33ef-a4ca-84bef915c2d9
 37 a3a2f9cc-9152-8f6d-b313-13a26d003fa3

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 1030281763716133358504812250505875638. Exactly this sequence comes out of new Random(822).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 7 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results