A858DE45F56D9BC9 archive

201208170330 ybzo7

explained decrypted filler

3DES(name+title) ECB, 36 GUIDs, seed 527

Metadata

Post ID
ybzo7
Title
201208170330 → 2012-08-17 03:30 on A858's clock
Posted (UTC)
2012-08-16 18:30:09
Timezone
UTC+9 · title 03:30 against posted 18:30 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208170330) = 812ecd3a57eb7d45bd2d329800388c79 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
36
Filler GUID seed
new Random(527).Next(9) ✓ verified
Run
Run 24 (seed 39,416,093) (seed)
Draw
12 · predicted N = 36 ✓
Machine boot
2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

30095E3853789EE3 0DCD962B56C51FEF 14441E3D228DE74E 99E7925FF71D8A1D 0DAED1DE7AF98A72 AA3F3088D3F9847A 609A043F4CB5966B 61A77839C0461D65 C98D086937E41D4B 2E628501CC64351D 924F4477C536B14C DFCDE4D5A5EB65CA 9D2B123970632AC3 7B12C50EE8F7B91F 1F849AD05A710614 E87CC963BD672C0C FE5B1DC4B9EF9DCC 92CAFF173545F069 079FAA262A4663D3 FD08E0193AF7121D E23F1B37DB10C7F5 DEDFFB338BBDE03C 3DFF640E7C5116E3 AB4961453FE12FCA F0951B56FA12F0C6 3E02D7073D3C6B99 1A0F492A0299778C 040E778C43CAA7D5 C6C4F7EBEB083215 B345E36F43E41FEF 817FCA0C0174B0C0 6F25F3614D323C1D 268FCE19DBF2F2B7 C46071676DFDDF18 9BCEFB3F7CB0A353 165845A9A9771F6A CAAB03C880329639 1CCBB24DDA1EACAD EE144A39B08165BC 9AB67F6127735910 23793622EAA28692 0C6FE536E3AC5659 C615E2E807679AF1 BE7106390685B948 F525144D624BAF36 2F88DC0BE06D24D6 16E3B61244999736 928FA5F44E5B4D60 6B55F2C1E95A44BE F8D8AB73AF84D4CF 3946B695BAC39329 2DEC86A3A4807738 093ABD6ADF60A80E 976FC7C386F2FA06 D89B8F7339CFB9C8 94159AE59CCAF667 514D587343563224 393CCC3B9EBF2F2D C674F9C1B941D5AC B46A29C7C2F1ABE4 E029E54627A1DE35 24345016A8DE47C3 906144F3DBD3F109 C480C7C9663B6D5B 4761B00E4F12E2F4 86E94CC7F5A5B2E6 DFDC003918DAD6F6 CC1B96CC0FFB8333 C96642B8377D5A4E 52B8959E88AC9D34 D11E58CE7FEDD171 678956A026ACDC9F D4616B2747616BF6 B020D5F5910653F3 D8AF40EABBA3D073 FDFF9E66E341E4DE 9C14357938D428C6 94CD56FFB7A3BC89 9AB489E7DED4677D D91CF2EB9C8E0328 CF700A8160B02B17 D82C4C7ED1FE0A95 B243BCBCB7108B58 6DAF6BAC3F3F2CE0 983B721EF412D21E C687546E69AE336E 5B4B4B45962AD3CC A825EDFB980F9B66 18F7BDCBB56397FB 96C2D8CFBE6ABBA7 F0C6D099C13E1C62 B82BB9451ED9F191 5B6F9F2EF2C1C004 EE905D25031CA5B9 62457BD5B79C75D6 D9FCE02A5EECE226 3A8313B18B3FBA35 B44748EE89D562B4 BFE252079BC88EAA 49BB5F3F74E06F01 CC27E30B0AF5F69F F6F02B1DD775D89A 503729B7A2CBAE09 B11C5FAB43C3BC2D 70A93B2A166BD450 514E8F1518049ECB F37F6B1CD3C17706 AB4424EAB9DDE205 176DEC5FB32F0BC7 752B173187875AC3 4C49AD081C3845BE 23D511462091736F 019A8A3F60E50F46 FBC7B564F53A6773 568FE96C7706CAF3 1B831569D54C9B57 8F356BF47A41357E F6C2E1B2B6C3E486 41CCFD540A881E81 0E7CC33192692D00 0F176F35F1FE988C 4AE8CD07E450E130 01A4CB8743024A74 0192C2D178C1F1C1 0E4E9100774C2514 9EA52BCD735042AB E85A3C2D9A937E23 BA3B17C98FDC43BE 0083B6FD42AA6DB5 6683B4BAE26904B4 8535177C839301C7 2FE88898B48BD3EE B46B1CA128791733 9A89B6D2E76C2924 E119ED8B9B9F1CA1 F9128D2A3F4E2BC2 D6C3562E628795CD DF581A9BC8A21F00 4A53CB80934A8315 EFF36BEFCCE2D98E BF8304570350391C F1C2EAF053ADD412 ECB32333FCA6122C 1A1E64A658B26947 FD61547B5AB3274B
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208170330 (name+title). Key = MD5(password) = 812ecd3a57eb7d45bd2d329800388c79, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1820e000-5021-00da-bed5-2fdb56dc035a
  2 086eca20-ce56-4d1b-ad5a-d3df505c28ff
  3 a9aa1e79-aad7-1a71-9c61-5982678af5fb
  4 05124b19-1b3e-0dba-b7e6-e0aeb815ec03
  5 f03e9a81-e370-1485-b49c-476e2a92b6a4
  6 67154830-2417-0b21-a8ae-a559666ddfac
  7 eb728866-9e9f-08cb-8fae-2b8be4065983
  8 4af78aa0-0942-7776-8439-952fa1727330
  9 ff098d62-dc79-1a35-a5f6-e73cfa9bb3be
 10 e5f7a01c-2d8f-539b-b064-4c1db40c644b
 11 674448ca-fd80-4ab7-a26b-81ece0d573ef
 12 50fa8e84-4968-86a7-a32f-be9757ca1cda
 13 93f6bfc2-e8be-894d-a5ca-516c19ce7bff
 14 0a015a93-a13c-53d1-9de3-e7892e1bc03c
 15 452decb7-53b4-725c-93f2-a6073a84477f
 16 3c1eed66-aaf1-1230-8899-533136df15b6
 17 1a51ccb6-7a96-380f-a1fc-41a6f49fc9ea
 18 c464f86e-00f9-6066-a209-5853d9e4b2ca
 19 7bfd1c83-b52a-8225-8bfc-e3f67b4ca9e8
 20 c3b084ab-e5c1-308e-8b75-521d5e508188
 21 19247a21-de06-7b47-bf9c-3592fe50b51c
 22 bcdc5102-f152-1100-9ecb-1837468d1478
 23 10f30dd3-c325-0937-9a41-ca438bf71546
 24 1b9ebcc3-bc74-14c2-85a5-3d5286006574
 25 7e32afbc-6579-3fda-935b-943563cbc207
 26 3e3e6563-996b-4dfb-8f31-39523d7c827d
 27 df4f2f13-2c52-0936-92d1-9b97d20acbea
 28 209eb2b4-0a25-1523-89f8-0114d130d299
 29 21473c66-fa89-0c76-8c2c-ccb9844100d1
 30 27d30f15-5b1c-4032-923d-84df00619e40
 31 7e19090b-887e-6dfc-bea4-2c5c773651d9
 32 6640adcc-5153-28ae-bb09-2e7328ed98d1
 33 6a4d63ab-3820-1f93-ba0c-5d8797aa8d9c
 34 5749c079-54bb-1835-84a1-6d8ed60f3a8f
 35 5b7f9457-b83c-5437-936a-7e0620ed83e3
 36 9082e614-dbd2-584d-b556-1bb8fd08f209

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 041010071548857136837101340104621155. Exactly this sequence comes out of new Random(527).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 12 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results