A858DE45F56D9BC9 archive

201208170616 yca97

explained decrypted filler

3DES(name+title) ECB, 35 GUIDs, seed 71

Metadata

Post ID
yca97
Title
201208170616 → 2012-08-17 06:16 on A858's clock
Posted (UTC)
2012-08-16 21:16:38
Timezone
UTC+9 · title 06:16 against posted 21:16 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,256 hex characters · 1,128 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208170616) = 5667804da890a69a12735fe12504446b (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
35
Filler GUID seed
new Random(71).Next(9) ✓ verified
Run
Run 24 (seed 39,416,093) (seed)
Draw
67 · predicted N = 35 ✓
Machine boot
2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

508844A9AD0B0579 90F66CA641AEAF31 B1A004BF7A6BC6E9 1454BF1BD802EAD3 6010F038FD8AF9B6 51F01F926C8CA8FD 95DA43A928C63B1F CB7BB9DF0E7A076E 5EA168979247D38A 8664B1A27A914A68 0D4B54A252DE47E4 978438C856284658 948A02B11AA85CAC 2A0F918836A3DE81 EA935A08EEA42D90 CDF33936E7E72080 92413E28822D132D F8A2CFD67444CEE1 BDEBEA6518F78E10 2E5563F9EB4A07CB 50401AF4BFFCE498 3BAC6CD1F303FB2C 24C0D66006F3DD13 100E622E5ED89999 895911725B20EE56 6E9152DDBF5604CF 8107E03A17C323FB 92B1842393F85E86 161484CE6927F717 5461059C5FDF6B99 BAC275E2D4E232DE 73EBC42E32BD1C93 E97F4AAA6D24D9EA 39EFF17594638C91 20940FF3327516E8 6E31A293775E29BA F8004857BD73F61B 1F130CC292D8FA15 4479A1F582378FA7 68D1C339E001D626 F8BDE5568461247C 7F417B9B054B7AC8 B8ECDD56CC0D8D23 6EBFD53DC2ACB53B 77F87D23CF54C166 BF6837F4F81D50D3 197CF0B1045823EC 715E9C19879F16E2 7EFDC115295CA58B 4B92514C7D07EC22 362E04B56C93FD73 E4A8B54B4818A3E4 45CD372F2A61182B 8D9288877C7E57A7 787D80510565B512 FC4733551B2AEAAC D6600EBD942C4349 F9B60F1B52588978 94E56A85A68A4B45 0480EF11BDAD979D 66F58D0D698A03F3 885EB3F3A7EA6BC6 3DF35E5652043871 73F5CB51F7196240 504768B5F19A2595 AC524D64641447BD D1E25FFDF458F9CE 670C5413B785CDAC F1CD77F6F5BE98DF AB9C2F48DCB96DF9 65C8ECD317CA63C4 77D1D7879C6FF96A D342DDFFC096FDEB B4825B9E39E0957E A7DCDE3850AB7ED5 76AFD9B544174323 313822B0D58C72E7 80C17BEBB8453807 E76842016AACD6CB 2DEEE5E16E8C278C 02D52D5767C54BA9 BF3CE839C4C710D0 45F3736FB0FCCA49 14E833E8EF16D7C5 BFEF2BC67D295ED7 27E080119905E4FE 9E9981CA73D55F95 7A6604D8698817A3 8DC13305B97C8693 2457EDE8DBED9350 153D8B75B9187EE7 9C912ED16922FBA7 A68E63D9A9F172AB 9C2739BB7D4F9C4A 08C09CC6D196A5C3 AEA2E82ABE2A2117 F9C6C77300B9FF02 CFF54F610E5BF2C6 CCA3C5FA89FED535 3D5FB8BDEAFA757F A626B5D7C4BD7DD8 3DDE50576C4AC4B0 2C2147DC4CF49458 4F7B395166C2FD13 B13CA366CDA98B25 DDC086ABE2E8C6C2 52229DF40DFCDB44 C5C02AB25A2B1571 B75A2F01A4907474 4EDC3ED9D99E15D7 5949C92FEA0B6065 7CE99DEA31ED636C 5C73EC3D7942E410 B27CD64277E7B5B3 CC1997DC7B00A115 173E501104096140 1C5C2B6F9C3D6D3E E42371EF58739240 A33C129AF5E7DBAC 80E97AEA192EE944 758083014D586A1F 8D98EB9434A3FA2B D7625913BC5D9225 CC61AFA7BFD08124 21A17436F3790577 4851490728F4C82B C519F9C06D79D263 00F395852E5152B8 E2C6D76654C53830 C1D9EC3A247AFAB0 67A7BABE5484384B 59D302713852EEE2 616A16B2531DF295 2051150F9866D662 40C8C7149321CE73 A57ADC5BC09A494D 1F43080F5784D6B0 8EA4E3F1FE9C95CF BF9177B9BA74802D A9A260FB958AA079 CF05B7F18DF69EDC
  • Read the ciphertext. Strip whitespace: 2,256 hex characters = 1,128 bytes = 141 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208170616 (name+title). Key = MD5(password) = 5667804da890a69a12735fe12504446b, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 35 GUIDs as hex (shown below).

Decrypted: GUID list

  1 da9c86be-adb4-7ab0-a865-7ff24b800b0c
  2 0a4d7e95-bcf7-5dfd-b1b7-c32380fbd9bb
  3 01ff16b0-c680-3672-9fba-db0a432948e3
  4 41f214fb-8eef-6267-88fe-aa75c9346ed3
  5 00e6122b-a912-2783-b9c1-f3db6a0959f9
  6 5c018edd-fb6e-5723-a62b-210ca27e0fcf
  7 95be8432-a5ec-65fe-ac97-59cf72070259
  8 d17ef91f-4adb-030b-a286-3bbf66062af5
  9 a2ed0381-4f31-67b9-9607-b4e178c1931f
 10 725e7c50-a114-4729-bd65-56c4bcb4effd
 11 0f487eb3-7ccd-5f38-95ff-a8932dc6a20f
 12 f74ab28c-b75a-836f-a0db-5c9d6f9d8b8b
 13 b3b6cb99-017b-384c-81f2-6e7d0931ff67
 14 7b5bfe53-1ca7-3c8f-b6bf-a321e43087b4
 15 123715ae-2bd7-63ca-839e-35989171f9a3
 16 c2581328-4ea6-3cf1-8987-67df36e2b92d
 17 e13d85c3-f231-6f1e-ae58-7f89a56ae4da
 18 8b897c5d-3131-091c-97ea-3f39b18fc487
 19 1bc111e7-03a7-5b05-9dcc-353c2361cf87
 20 b963cd28-f19b-7480-b48e-05a14a6cf878
 21 37d71478-2fb2-231d-8e02-b24b6d8d3164
 22 01b3e8d1-c307-2e1b-b7ca-a52513b636a5
 23 3a3aede1-a5cd-8e13-b9c7-8f0002d697c1
 24 935ca64d-f187-72cb-9d7a-0b48ac760557
 25 a0a5b71c-fe16-5d7d-a782-87ae0503560e
 26 7fa823a8-be79-1c08-8e64-5c3619402227
 27 bb27723f-f378-8b7c-ac3c-eac67f19e292
 28 8a4308f7-2f00-694d-a70a-69762eca309a
 29 50f63c9d-56b2-11d8-9746-8573144695a3
 30 a6a423b7-f800-29d5-9c02-a51cd0a74b94
 31 4860af64-3fc5-3389-9b8d-2ca6d7f41575
 32 06a76f22-9a31-16aa-9fe8-c3571c910ae1
 33 89d4ccdb-8803-7568-b46f-379ad47ddaae
 34 56c1122e-80c5-62eb-8582-26196fe18e9f
 35 4fbf7f88-ce59-3052-86b4-89ee6e2536a0

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 75362560645833636057228751861231763. Exactly this sequence comes out of new Random(71).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 67 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 35; the post has N = 35 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results