A858DE45F56D9BC9 archive

201208170424 yc3fm

explained decrypted filler

3DES(name+title) ECB, 29 GUIDs, seed 334

Metadata

Post ID
yc3fm
Title
201208170424 → 2012-08-17 04:24 on A858's clock
Posted (UTC)
2012-08-16 19:24:44
Timezone
UTC+9 · title 04:24 against posted 19:24 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,872 hex characters · 936 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208170424) = ceefbaa892734f0842fdc9102d4ecc2b (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
29
Filler GUID seed
new Random(334).Next(9) ✓ verified
Run
Run 24 (seed 39,416,093) (seed)
Draw
30 · predicted N = 29 ✓
Machine boot
2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

ED54174F52D9A1E1 253ACF4F285E81CB A1454D4A4CF1EFBE 5C5F399F6FFC52B9 F7E08B2C6CC0F0EE 250B88149AD0C37F A9B99D7E57F8F091 9F350C04AA3307A3 1A42D6F063112186 2F3E387C94B6A066 9DC025E356DC49D1 899156D64DA6E101 5D51D86D36963C18 C48DF216B828DAE2 205D59EBE53A3F35 A56195D83B3FBD45 52707F7BF528100F A1B6ADF7209B002C 26B8CF5EA223ABE9 6F2F4EBA0BFBC9FF 6507A170BBBEA09C 58E964BF9E80970F F780B1AE1E2384C4 1894D2E2E003A304 732FB5D92649E408 BC70194E8614F8C8 09BD70ED47C63D81 B23B6E62BA33AEA4 DF45DF890B5F2119 91CB4AD6157439D2 84B040552F0BE5D4 90D9EA8BF9CF0F91 21CB7AEA548D6A60 C82549C82EBCE114 CB067812446138AC 6755C2650DD0D10A D11C3EAA8FDDB5DF EFC6D69DADEAFAD9 E34B05A013A7D48D 3CE8F000D6059E98 1950612E23402D6F 2A0CE4B7243ED276 20D6FA5024BB1BFD 729F235610752382 3C3E8285025F0DF3 69F057BC7E37C6C3 6B56858C2669DED1 C2443BCC2D24C793 CA26F18E8203B497 D17DD0E613230E21 628CCE31CC0008EC 98E8762BC6D7807B 9F581D19E3DDF770 F98D60D13F56F7A5 BEB06DF1179AB979 E5D5A2DD2E594E15 E80215154BF4DD8E 16063FCF92DD44C6 CFEB71BAC82C02DC F80765E3FE835185 5397EAA592BA4133 D1293A8D3BDFEE2F FAB014FC6355C2E6 62F6E1A6210F07A0 702DFCB49561F6C6 A0809BB83B798AF3 6F7DCDF1424CAEB7 09577C6CFEB5B02E 700D0F956FB0ACCB D97411506FA90F2D A759CF097F577B61 DED075C3855D1E5E 1C2EED2DD460539F 59489A90DDE45E0F EA7DD52FC99A626F C83AE7EF054CE3E0 BB18AF0BE64F8EE0 D095FD41240DFF73 06BC5F1B6B79E392 7E7570D2EA7ED190 B0D0068C127D075B 8B367941E1A72026 ACA3B054FADA9CF0 91C3EACA29B064B4 D840135D898DCB30 EA07A0DF015BAC1D 8F71AE5BA3B8D41D 69DD4889E0D38ED0 75D740E7216823ED 83638C1B4717A5E0 E5DB778D4B250CC9 77E6EDCD041A00DF 7D601281A11C229B D51ADD1ABD4AA5FD 618C8DB99E688179 C1A67AF233F7BDDB EECFFD86863EA2C6 EF2122F6030DFC26 25472E865FBC58D1 986368E2431BD650 9F7F54239337D270 FB8808A470414875 95DDABE8C9A16559 F9EC74ED5769F774 8083DFBAB3745224 6C819E99B8A7A187 1BF5D80D74E45421 474C6DAF5357FAB2 5C4BC2952C5C84D3 2C431AF9C67D4C70 01B541D91A34568D B9CE4FC47963F7C0 45DB022B7AD64338 E86E462A289CEC86 DFF2A06E9DBE8170 3C047CBAB396B508 CEFE69632E1A4018
  • Read the ciphertext. Strip whitespace: 1,872 hex characters = 936 bytes = 117 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208170424 (name+title). Key = MD5(password) = ceefbaa892734f0842fdc9102d4ecc2b, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 29 GUIDs as hex (shown below).

Decrypted: GUID list

  1 0b367911-9ee0-1d1b-93bf-b401c23fb4ba
  2 0811f41d-5d4d-7a90-aa86-5ea3eb09be5b
  3 10cb99cf-17c8-20ca-91fe-2ebfc8344b68
  4 2eaf79d5-d251-73ea-bfdf-087cf29055f0
  5 009feb2b-5aa9-0b65-ae8e-612af9c534bb
  6 bc7a71da-b0b3-36f0-ac5c-23499b82d40a
  7 37e1a497-73fc-5857-b84d-924c223fa07d
  8 e817a09a-f86d-067e-97bb-6e7e03cfa1e8
  9 622177d1-e049-248d-a770-e2c666a316ed
 10 81dccdf4-da7b-314f-aeca-fd3cf750b085
 11 644a5e84-06ac-3a41-8514-1cf080d30782
 12 f452f274-905d-2b6a-8206-9ca08196c06c
 13 62eb347c-db00-2b39-adfd-2babb42cb919
 14 db93db1e-d251-226b-a56d-15c9d7069561
 15 6ebe10ba-d8dd-6ef2-a5cc-5973e67e0333
 16 6484b858-2225-541e-b5e4-07d0b18386c2
 17 e8ed4360-38bd-2c49-a47a-cfa4fc57d0d6
 18 4b589a1a-3020-0412-a6a5-e24fe0b27abb
 19 ae91ca08-cfaf-6cfd-a6ed-8158dc18e4ab
 20 7b274d06-0d89-5279-88e3-b2b624f06304
 21 545cc822-dcd7-1c76-a7a5-dd7ce63ed56c
 22 0493429e-7997-7167-b3a6-f6a02baf3e6b
 23 62302ddc-fec2-328b-b7ba-c1890ac42b7e
 24 9caf8295-3545-6482-a31b-6c24cd153b9b
 25 79542575-c580-3def-b7af-f131c98f0e27
 26 99acc12a-6fe1-3a81-a84f-50082ff748af
 27 b0071a0e-ebab-09ed-a5d4-3cf95ec7e4dd
 28 475e8484-f92a-54a6-b9c0-a00f72e39962
 29 b155b068-7dd1-7893-937b-a3ef0ddeb68c

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 17270350233222652065173633057. Exactly this sequence comes out of new Random(334).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 30 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 29; the post has N = 29 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results