A858DE45F56D9BC9 archive

201208170735 ycfdx

explained decrypted filler

seed 416

Metadata

Post ID
ycfdx
Title
201208170735 → 2012-08-17 07:35 on A858's clock
Posted (UTC)
2012-08-16 22:35:16
Timezone
UTC+9 · title 07:35 against posted 22:35 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,488 hex characters · 744 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208170735) = 2dd578cd692c9b457f6d683428559a95 (name+title)
GUIDs
23
Filler GUID seed
new Random(416).Next(9) ✓ verified
Run
Run 24 (seed 39,416,093) (seed)
Draw
93 · predicted N = 23 ✓
Machine boot
2012-08-15 10:18–10:21 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

2A247D0FC4CC270B 5C31CFC8695C2BFC 48A46BB52CA74E9C 0CA471C7BF73CDFB 3EFB29CB8001EDF3 6891FE3682348CA5 228883AAF5CAC925 B1F52C3FB695F47A 4FA8196407669186 821A94642D7D6B00 9F7DE5564764E263 492ACC73A5E143CB 3CFA7B2A9B21A8D5 351B3E97198976BF 4795935E57361BCE 3637691CDC2F49AD 78B923EA396BF368 D49FD3860F8D1E88 D572FE04A5D1CFA5 8841B9DFC682031E 966123F8518F9B29 4F776B9BB1F0B381 B95DFDC3A44511DE 9AB4ADFB372FDD65 4D1D75513449B745 4F4BEBAA95A2B862 8695B2EF3CB7EB18 6D25319F4FF5F90A B1C2C9AB35E16885 E1D318C6FE0A6125 BA02429ACB60D889 FDCD33F0C5890F20 494E209F050DCFD8 4BCC999F022E73AC 939D4CC250841E20 08F65A0EEF56145D D31E8D6B875A2A07 0AC34D0446CE5427 71066C9250AF8197 003F5F1117BFCD9F 18D457924A6F7052 0891036482412601 DE1C2DF411F839D2 03E780D6EF267F29 9E5255D7EB338F31 B50EBC95EB9ED046 D7D2703F0406A865 3F06E6D51C17CB21 81E6020A751AF8BC 74145D5661C39F49 A2A0B65B9C5DB22F 318A7AE59F26FE03 7065128A59E70065 9C5F566E2CC31890 13387E7B8AC8FDD1 92D91F124B7FFD28 2B48E96B879BE1FD EC4D13A28FDEA2A8 2DBBA55169110F4C C199939A02E04557 03765798BEB64090 E86D1349619A13E2 E8D14BAEA3ED510B B86F38FCCE7296B5 28E1ED87470DB385 4DA957399C1CDE88 F8A4CA06EDA5D36A 6842ABE27A8BAAF1 79980350B6C0853A 70FD8B0AB876521E 8C14C7F2295BC1F0 FE14765E58185825 0DAC2339C652DD0B 1E3912AD592A9D6E 452E9F8163ED3D4D 778AD01A536417AC DDA3C6320E6420D2 BAD7806940BDECE9 B5175B4DC6D27429 01420E6498FD84B6 408B6DA81BFA80C5 2B4C01F37817ACF5 75FB9D0C149859B9 C89FCCC185859A39 F42AEE15A3FD400C 14B1B9751346AA4A D873E123CD748465 1AE8822805D630C7 3EE55AF7C1A49556 0DFB0CD885AB19C3 20C779DE1A8DD872 4823C7758CE5A0A7 390F250ABD44B203
  • Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208170735 (name+title). Key = MD5(password) = 2dd578cd692c9b457f6d683428559a95, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 c4dc8399-15cf-0f04-85cc-420fbb473032
  2 36efd017-f496-7d04-8bb1-afead30027af
  3 d97faf8f-612f-4cf9-b6a0-5987d4e970a0
  4 08bfda29-5234-3027-9ce3-6c553e43164d
  5 140f8c46-c9ab-0af9-8bc5-b2d100bece60
  6 8ff770b8-95ac-0e88-96a6-2b3a006249f1
  7 5c7235b9-6694-273e-87fd-f571f7f3e3c5
  8 1238f4aa-cfbd-13eb-8391-907ec2bd9126
  9 38f8653b-3b1c-3595-84fa-cc75fb68b621
 10 bf4dc6c0-a74f-6904-bf5d-9a552cb5384c
 11 17e3d860-017e-66b1-b24d-3d08bed4f56b
 12 b8b32c4c-9089-2931-9b62-b0f2e955524f
 13 ac37385c-a5aa-589c-a4e1-ef0d296ab62f
 14 ee40379b-9a9d-808c-b785-51b3e423c2cd
 15 6fd98777-eee9-155d-b55c-8c7cc3b8c6d5
 16 8e693571-9453-73fe-8382-d24ae8020f48
 17 c7ca548c-8e02-6369-a06b-fc77b2dbdd40
 18 3f209ab3-61cd-8a25-b438-dae686d13f5c
 19 d56056e7-117a-875e-a249-105225aee2ea
 20 6b786374-2324-3b3b-aef9-aa88370c16c1
 21 028f4de0-940f-0f22-b264-9bb4adee658c
 22 276f438c-f709-8d45-98cf-2dfde353b5b8
 23 c47c38ae-0a97-2fb2-8be6-3189daa5ffa3

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 07430021366258176883082. Exactly this sequence comes out of new Random(416).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 93 of Run 24 (seed 39,416,093): new Random(39416093), Next(8,64) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:18–10:21).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs