A858DE45F56D9BC9 archive

201208170604 yc9ma

explained decrypted filler

3DES(name+title) ECB, 27 GUIDs, seed 557

Metadata

Post ID
yc9ma
Title
201208170604 → 2012-08-17 06:04 on A858's clock
Posted (UTC)
2012-08-16 21:04:32
Timezone
UTC+9 · title 06:04 against posted 21:04 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,744 hex characters · 872 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208170604) = fbefd686cddd487f6f6153c31057120e (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
27
Filler GUID seed
new Random(557).Next(9) ✓ verified
Run
Run 24 (seed 39,416,093) (seed)
Draw
63 · predicted N = 27 ✓
Machine boot
2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

6F394DB3AEEAB4FB 26412B40A141E4B4 C3FA86F29B657302 15BEB9E80DF87039 7CBBAE10B15B46FA 3BAD76A83BF02851 5E68363C56E306C5 B419C2F16494F3A7 4C9E55FC46268EDC 1203C79B6C642F8E 38A852BBFF5EFF9B 0E9F6F54B5E5886C EAABBC2844F45C84 7FA9824067A3BEF4 A9642689D2CDBE7C 488BC7973B8ABFA2 4342CEFF1F710B45 C033430776B08071 24C9A44AC973DC09 B02A8C86484B215A 8E46C9E52B16F40A 9934C963C10F2922 E333BB0091C75044 0FC3CFD3B748A349 1CC618ABB3D1BA1F A663A35C126596EB 99522C86B38F9F0E 87D15014B7125B5B 8D38B7728C7D9A20 804A9246F5AC083E 21210F26FB255056 EBB43F4CF3D4E9B7 45827D7B4CE93EAF 152027455B76D815 066E50C7B628CB24 64C169E0AC845B64 F1DEB8AFF152EEE8 2F9D8752941D31AC C491B89A56529983 468D8D703012C015 5D66D65C36AF819C 5A229713B98FD0BD B9D2541CDA32BFEA 6E68B2F499D1ED21 ED752A1CA5AC027F 842CE54E79BA9AAC 2E3104A17183A668 76CEEE362265B557 A8C7D2D301F40516 6D377294AED2C2E3 1D74988885F096E9 1FA4E53911209426 81310B470277474D 8C4A17ABBF4F22E0 129CA083C64F2759 D421B42A798C36A2 B42223F48FC20AC3 01A77D67CD9A4E91 3E2FB607E4C24B24 7B3C2C691B98EFF0 53A6144E0F0A4D6C E88E7BD8D8FD8F8F 54B1B9A258514B7D 8BF2F5B321333428 AF489C4D34DBEF18 EC509AA72E54EC53 B2DCD51864831F7B 2882727D8AA6156A C20F97F39A2DE7FD 2981C5B7A973B19E 104F800363C58532 EA4FE656254C68BC C87B969D34190BF2 BC24C8A8FF7AD3D1 BDE14FAB108EF729 3A94230A9F7FB71F 809439CFB145D875 F4FBA36A7757D13A 82F814470BE8A40D 75FF850977F868EF 45A5D440B5F6CA6C 153F1FE924DC0FF5 0C9C397DA5D294B0 77BED73985ACBE98 E432DA1A8ED405E0 052ABD02E2DBCAC7 70E26EC283962AE1 B4D6FCD9211CAF24 21A05BD849A84AC4 740E5B4EA6273233 55C0F3CC24D058B6 C9424E1827A386B3 48C35AB515EC1170 089405CDE0BDBE30 CFA45CE40065F9B3 ACA6FBCF31A19F0C F88A21DE35002B95 BCD14145351B065A C8C3C73C09EE70F1 4FA2506717B70366 E8E1F6D6925C0D5C ECE2F0277C760B7C 5E0F7583912564F5 C13565FE7BF99020 384417954FE950A7 C28EF04364037E73 30D696DEFC34D5ED 37038A6CC6C78FF6 27C24CE470E13BE5
  • Read the ciphertext. Strip whitespace: 1,744 hex characters = 872 bytes = 109 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208170604 (name+title). Key = MD5(password) = fbefd686cddd487f6f6153c31057120e, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 27 GUIDs as hex (shown below).

Decrypted: GUID list

  1 46be1886-e3c1-6724-9626-2a4937942ce9
  2 6e7ad850-6d6b-2737-8358-590571ce3c35
  3 f57f2d20-f636-05ae-a7ba-116b3a5a058c
  4 aa1d32bc-852a-41f9-98b3-6858d6c68aac
  5 f25f79f4-3dd6-64e4-819e-c65dc17ee412
  6 9549b558-2e49-21f1-ad51-d25a057241aa
  7 320ed468-6b1f-4b5e-b243-079458090ee4
  8 2bf1ce6f-1d95-77d7-bfb3-aac0587b3569
  9 47cc1076-adb3-7c0e-94a0-a3eff2fce9e7
 10 3d7cdb43-a9b5-66c9-88a2-fb0679c5f601
 11 ad19e12d-0250-5fec-8474-0288a42012d2
 12 73fa58ea-ed2b-2f72-b0b4-58a6310606a1
 13 bfcebf30-103a-48ce-827b-b732bc6bae1d
 14 5268bf22-248b-2b74-b07f-502b312fa1a1
 15 6ee926a1-4c67-7cef-b0a3-fcb9b882c42d
 16 deab35ef-5cce-710d-aee1-a004ed6caf84
 17 870af063-e7f2-0144-9df7-ab31d730e761
 18 7be99e2d-b7a1-3ad4-9364-802fe705d2f4
 19 41cdc27e-3813-69e0-85e9-7b04cb00b73e
 20 72577834-9c47-82f6-a6f8-a4fb15f58034
 21 b9cbebef-0f5a-7649-b65a-854672c041c4
 22 5d581bb3-8273-420b-8a43-2828d3aa7f60
 23 0ce5f27c-3838-1931-a763-47d0bbd661c8
 24 115ff59a-da64-5194-a00a-a6610657b98f
 25 3635e8f1-6436-22d1-9c19-3e1e869bc99b
 26 7695dbdd-6644-75fe-b164-42adb92c5397
 27 96f19bce-65b8-7bf9-8b2f-e84f81915244

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 620462477652427703687415277. Exactly this sequence comes out of new Random(557).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 63 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 27; the post has N = 27 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results