A858DE45F56D9BC9 archive

201208170445 yc4uf

explained decrypted filler

seed 501

Metadata

Post ID
yc4uf
Title
201208170445 → 2012-08-17 04:45 on A858's clock
Posted (UTC)
2012-08-16 19:45:52
Timezone
UTC+9 · title 04:45 against posted 19:45 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,104 hex characters · 552 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208170445) = a2c60e7df18f7a9bccf628fa98eba158 (name+title)
GUIDs
17
Filler GUID seed
new Random(501).Next(9) ✓ verified
Run
Run 24 (seed 39,416,093) (seed)
Draw
37 · predicted N = 17 ✓
Machine boot
2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

86DAB9B61B089A73 7673BC79BAFC1247 CF258748E310E589 1EAA39056C97BC47 27FA1D969E27FD1A 1C7A9B28E168CFA5 B086624C49098DEC A9AE3B6A3D8E334C 83045D8A948FCFED 790724E741DB658B 211B127EA6D593A7 CC5EBE02A36BA1C8 C30DF51405C97B3F 9DB83599E5E5F8C3 D1520804D0B511BF 6463BC2F86733605 DE2083597784CAFE 0D18B264B6FF734C 8198C9BA134F1A2D B8F36A87BE7EC658 6883D9D2044DE49E AA8FE2D3B0566308 85C2F3BD953367A7 AD02588AAF918009 8890874812DFF141 F8E4FE602DBAA853 4E3064E5D22A9FF2 EFE0A724808FACAD 2FBDFF5D59683418 82D0189297F5ACA0 F12224AD7C53D2FE 4175E530B9988207 0ECFE39EFA0C82F0 8702A0DB8221D0C7 AACDAC340CFD6C5B 5F68D8B73CD87D26 4F2A011E74A32E11 EC206EDB983EE2C9 57715543E3AD291F A5CF72EE2DEFF1D5 4D9ABE53E0501F30 25CA0B9956797393 6CFE671D7689C705 AA67B291DAFFD05A 62CEB764D85CBE9A 7172A9CFB2935090 13E31E493462D272 4B74EB5AD8552882 3C6FAE3CC01B962C BC0529B75A76A801 643548E08D1A1094 B77C84A4F07F0559 7136D8A2BC31EF7C 0B70A978186C2CC0 E894D3D7CDF465E7 55B5449EEC3F8238 C6CA7F0104DBDE4F 3FA8542C2FF7D3FD 99CB558FB6614300 8C324016AB2AAE0F 55D70EF5A8A9B26C CB2A95306BE288AB CF02F037E5585ABA C7A6097843E912BB 5247B1F17906D2C1 3EC878736F5E7075 29AC5C02E5F4778C B03F80309C25EB9C 473B7ACAD091FC76
  • Read the ciphertext. Strip whitespace: 1,104 hex characters = 552 bytes = 69 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208170445 (name+title). Key = MD5(password) = a2c60e7df18f7a9bccf628fa98eba158, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 17 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3745751f-e847-4871-9367-8e95731e6c63
  2 bf751dce-189a-7c2f-85e1-5829759bdd9d
  3 1e0e8ee5-c454-80d5-a058-5ba9ecb5bda1
  4 493ce7a8-9c21-4f91-98eb-db851436483c
  5 99bb17f5-a328-3871-b590-d4908438a78d
  6 d84370e7-7a04-3e52-9881-8ed7e300e67c
  7 307973d5-17bb-3300-9651-0d2da9ffb4bf
  8 14d2f618-17b3-7a91-85eb-659a622262a7
  9 cade691f-b33b-88e2-8aa6-4accdd2806a5
 10 12bd3529-ba6b-0f9c-8f7e-c6ab60c9ac39
 11 a1aa41e0-4ef4-34a7-a888-8ced2bf4578f
 12 cd9e8c1e-b180-5558-97b4-308783171be1
 13 1cff1649-8e49-089c-8162-4b00f3d12f39
 14 3bacfb49-1272-1059-8de2-5487079b13fd
 15 bc2215c2-aa1e-6501-8831-f05a609ed798
 16 ccb8c3c9-5284-86ab-8feb-3498ba0379f8
 17 38b6b574-c79c-4038-bb5e-e6bee57b4159

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 47843337803501684. Exactly this sequence comes out of new Random(501).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 37 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 17; the post has N = 17 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs