A858DE45F56D9BC9 archive

201208170448 yc50y

explained decrypted filler

3DES(name+title) ECB, 36 GUIDs, seed 734

Metadata

Post ID
yc50y
Title
201208170448 → 2012-08-17 04:48 on A858's clock
Posted (UTC)
2012-08-16 19:48:53
Timezone
UTC+9 · title 04:48 against posted 19:48 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208170448) = 9e041749c70b1b592a95a57fc4a02414 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
36
Filler GUID seed
new Random(734).Next(9) ✓ verified
Run
Run 24 (seed 39,416,093) (seed)
Draw
38 · predicted N = 36 ✓
Machine boot
2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

BBACA8C1D60DC06C A047D58A33A171AD C3AD785D47C0B216 0726CE0D8ECAB61D A28D1FFBD6900FE8 7277F2879A6BB272 8795DA27AAAE0026 BF00C1D57C0052EE 5E4478575B29462D 64A813450C9337E0 4E87B036987F5E21 334BD00BD7804A0A FD7EF9F0984706D8 06DD76D37DD34109 5346C8EFDA39D940 E65FA092F2FB6811 7720C47A62D0A042 901C6B151D7D6784 15DA3E028D399ECD 3B249273E688E0AE 9CA11D6AD21F5D4C 647B147C38F3081C D79D544CE2FBDA1C 833B6B15982F1C1D C896C13CCA1E3E6C 361E8F114A38900F 2D504CA48FADA571 386AFBA83EC0D5A4 43F2161C389FD7AE 20B2E423EB9D261B 7CE1A88B18397F30 8216EC0A77EE1981 87F210B0D3C7D52C 535FF82120D4DF1F 8AB7042151F7D22C 191D7B633433C9AE 6BF00E4B8A40F757 9B0A9D4B9E7E3970 1E1704BAFBB0396F 25A6AA0B196B5E15 A98786C2B3502D2F 56CA166A1214B6CE 14E83255DD849D37 40415DA2896BB129 6A68F112CFD9ECE3 D515CFC381BAA8C5 218739F150E5537C 4C22C36FF9FAF87C EC1D8540947DE285 44E20D4116364B51 8B18900107DF25C5 A83E4BAE7EB23A75 95364CBA2D81D6A0 1A437F080C24A207 199A752835CFE362 CC1D81FDE286408B 5F062E9B1CFEBFFC B474FE175B6887F7 6C5D98F8563DC74F ABB2EEBBA19E832D E596C68B3F2ED509 0C6363FDBCCF98F0 B7614C1D403A81F0 0EA307A156D02274 61B0D171C99EC53F 2EEA562E0B309CE5 608CE46968C8E394 F2842EDB05223FE7 5BE68B17B495DDC1 E31252704B8D8AA0 322998F8061C7D30 726DD6BE6EB1A4AF 3476FD41184C7653 ECB113D56D2C977B 713FF4C91878B3EF 06B4CCBBDB5D8A68 81A1E4A8199B5F56 32AA1E680179262E 88A50BEB1C1BEC15 0525E686593A375A D8910814FA568324 D9AB7B1A6D585073 CA03CE50BA2DB458 C8D47696C3B78C47 7DB3CF0CDFD07181 71FDDF93CDBDDDDA 3A8FB470DAE71B00 88B90BBF298FE7EE C217B562D2721B00 FCBC910FCABFEFF3 A48432B3A8EA3479 BE03827FB32D20D5 0291A1905E447831 1279FAF826201461 A64DE727315685CF 38076A5115E911B5 4FDDE1BF27AFA483 FA5BF7FBB16902B5 1FC1DBDA5549BD94 0A753A1DFABC7F04 4CAA737ADD119165 C0035827C4228A89 E4FECB67F2E61CB9 4260A52D74D2977E 7B5CBD3BCA434659 45B47B060BD416D7 DE9FDAB060A9EDBE D43326E67A0E8638 D649D311A854F949 50E0747D761A566A 10891C54ADE58815 124BBC848D880EF8 0E4A387388271308 3D45A52CEC834C8F C69EE8377DB6F1EF 2622159186041C4C E9E43AD15C37EABB 81E8803A2ADD6398 AC46FB3E19500CB1 CE56075018A3D0CA 65A167177F5DB2C0 9C1E1A748DBD75ED 3338FF0C37351707 A2152A06A6A8807A E5987703C2472B15 3C93843E9FED0811 DD1ED39B3B29D27B 594BA7C2844DCD96 4B01DC9BD52260D0 E1DA333200DC56B6 DCDA40620F0AF1DC 522CDAF8B22A90D1 1CD703678C67C9C7 ACA3E4EAF9D1206B C3FD7D2A5EC0C7C9 2BF927A2C8EC93BD 584526E2D34EA67F C7265888753250DF 68DBC90EBECAE78D 7D192076DDB248D2 AA1CAF0B3CC9E5A1 AA82540A334441E9 65C10326AC52425D D461040ABA275883 5CCDD12D0FC3B7D4
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208170448 (name+title). Key = MD5(password) = 9e041749c70b1b592a95a57fc4a02414, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 27e60e33-5b6a-175e-8ece-e4b33c653fa8
  2 4b3367e2-c11c-1d1b-9b53-3ce095476f92
  3 df8e4f4d-41e1-731f-8489-c4f3433fe367
  4 2983218f-7a5f-2665-acd7-49306c0e9d1b
  5 8c37562c-16e7-5876-a49e-796306e75171
  6 99eb71f0-2978-8bfe-8dcb-69450b091902
  7 58c7f98e-bb15-7837-b027-c10a1c74d02a
  8 e5464ab2-f34c-63ef-bfca-40b30bbaf9d5
  9 6571c199-4ef6-73f7-bc0b-c62ed6e46b5c
 10 833b1a2e-ce29-87c8-9d48-cc282a55c874
 11 c8c9b762-d9ed-04ef-91d5-d0497f88f2d0
 12 33693e73-de75-47ae-8fc3-3d7f6c24431d
 13 999d4f5b-7660-1404-ad5f-c909e5fff395
 14 a347e861-7cd8-37f0-b123-f700218dd170
 15 b73080de-7d01-6c04-9db1-54e1dd3de8f1
 16 6cef8feb-00d8-35b5-a354-977aac8a6c83
 17 8bbd8f40-8c56-3f45-b00b-bee1ae2e137d
 18 50e831fa-b663-0593-af4c-134af6f49f7d
 19 bf40db14-b27a-4efb-9d41-72e3dad2554f
 20 63dfb401-2bbd-4965-a8bc-a63db10c1948
 21 79d2ad95-d9db-3d27-b73c-27ee440592ca
 22 88d44f1e-4c35-803e-ae2a-53b3d74e0be7
 23 a57798b7-798e-0348-8215-8caa67e4670d
 24 87776172-b8b7-47b3-8681-6a9f226e8374
 25 ad44a939-c828-5822-aad8-3e2189c8976c
 26 08d0e833-a42d-5891-9af6-9ad42285e53e
 27 b4981676-272c-078c-b6dd-738b853ba4c1
 28 629383f3-b959-4df9-9a51-f7c55dfe0597
 29 829555e5-1cb7-2506-91f2-8e16df24f647
 30 75f53d15-1f56-1a1b-9676-6542f5eac744
 31 0e2c5eb0-689b-18d0-b44a-2a2143f5eace
 32 1465816c-abc3-7b24-a6ae-4a4510e58797
 33 2c2311be-fe32-4104-9d16-22ec7bed613a
 34 5403990e-5ed0-3597-9337-f69459aed4a1
 35 3621ef29-846a-8ece-b7d9-34d3acfe79fd
 36 56ba66c9-e6f8-5987-a22e-adf7c1d0877c

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 117258767804136330443804550421174385. Exactly this sequence comes out of new Random(734).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 38 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results