A858DE45F56D9BC9 archive

201208170423 yd9p9

explained decrypted filler

seed 981

Metadata

Post ID
yd9p9
Title
201208170423 → 2012-08-17 04:23 on A858's clock
Posted (UTC)
2012-08-17 08:23:46
Timezone
UTC−4 · title 04:23 against posted 08:23 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,616 hex characters · 808 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208170423) = ef51d8a1bdc334f5f382ee07132b2a4d (name+title)
GUIDs
25
Filler GUID seed
new Random(981).Next(9) ✓ verified
Run
Run 25 (seed 158,297,437) (seed)
Draw
12 · predicted N = 25 ✓
Machine boot
2012-08-15 10:14–10:24 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

6E92B72B5296581F 5953C8A9B3973B8D 331E02FDB5C09FCB 1C0EB03C13D75E32 E1350A47F4E2101B 4BB7EF82DCFF57FA BDF6269716F4EF01 67CFD6E6B28EBED1 C47B6318D5970196 DC0F460C59180C66 70C240053ABBC56E BAF9B6EBCC40D1C5 6C2774C64A3DB23D 36A40DCD400C122D 32A6D7760F2EF056 BA773E6DB9E6318A C2AD4FFE31ED5D0B 56191AF8AFF6D8DF D1F6743F91E57178 37F408AE0CE2BA55 BFA753495E15B134 43DD48D770B10C20 6B1BBF734DD5F4CC 4C8520891E2E7D53 916C19961B3C61A6 DFC6CBDC9B2058D1 D8D7D4583B369769 FA282E3DB4D7E787 23FF9EF37CD893E9 045DFBC5F32E0F6B 32AA6864A848F055 1BA3A90B01EC2D5B 38CBBEA431DF8CA8 518E9B187C038BE3 ECA9EC81062BBE29 03D0F53AC77E3469 CF05A9FD0CE40134 F6B1A29830E01DE7 5554ACB2A2C412C3 D84DF372DBC28B7D BF671DEFD969C152 A05BF2B56F282CF3 5A5583AAF0DAFF63 9552D9A892194CE7 4D371828A473BE41 826487F5A88ED796 D9F0A92AF2F12044 62BE30931982BF13 028797D160B42F97 ECB6AAC47DD06DB9 207ED674252A6465 44689BE56902382D C8572C5EA2E48FC3 A7B3544D583D59BE 85D71213C0A62A5B 99B068ADEBD1734E 10D08069C8731362 38E6398EAA4DF36F 6AD43E2E28071162 B0BE9EAB48770B54 ECA8805F2FA9124C 99C583350DDA496E C827EB0D15AB033D 90DBF4A814D1DFF5 CD9AA6CBC68F1247 87539D3221375981 8B32C23FED7C4738 FDDB6802D6B04667 C44868B3B89CF573 8A591A2D7033FA58 2492C536A36277F1 477016A68D8A2BC8 F02B2F75C8028131 9749C0CAD292717A 2B5A715B437C6EC8 9F34F2FCC44909A3 E2152277CE407900 D75A042932269D72 EA70E0A50AFB4485 511648EADA042A68 D42938831D7442D5 058B878643E07DE4 F945C0032F5550D5 F1DA3103BBCEBAF5 CB86202F27C309D7 32980FE1C08AE3A4 015EB558D0903091 0E4533A1A7125F1E 930578CADD5B73A2 2FA3B619E93DECCC FEB9ABE7D598D399 7A708556968A0861 6AC088DD442BBD58 CF748A8D1D84AC02 B32CD4004D54069F C475956FA1C82757 8C30949B4327A9C9 252F1425747B2BEF 19347E830191FD6C 9C1CB22398EFD201 51B183AD77FD8972
  • Read the ciphertext. Strip whitespace: 1,616 hex characters = 808 bytes = 101 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208170423 (name+title). Key = MD5(password) = ef51d8a1bdc334f5f382ee07132b2a4d, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 25 GUIDs as hex (shown below).

Decrypted: GUID list

  1 fc98a134-3f97-26b4-bf2a-2d6a9ecdafd3
  2 9cf3c0ae-6217-5e44-9772-b70143446a3a
  3 96c496a0-0bee-46a2-8d10-406d212bae1b
  4 b32786cc-b947-8192-84ce-47f2135e6da8
  5 57b07b66-973e-19b2-809a-8358dffb5063
  6 a193266d-208b-7401-9759-ccb98bfff298
  7 c3209058-884d-40c1-86ae-cac91d7d47b6
  8 ec5d3ad2-e5f7-5dcb-bee4-a3985e6b4d3f
  9 bd5cd357-255e-36d5-8667-d6728d7fae81
 10 e5f21960-1c05-0938-bf96-c027222125e4
 11 2fe2f5d3-6575-00b3-bd54-70540a2a837b
 12 4d2c1c58-2db2-3ef9-93d5-65ce6fb39a96
 13 eff36aaf-64df-0fea-942e-73abadca63a9
 14 c435dc02-deed-7699-a601-b03619aba581
 15 63412b54-ecd2-5472-b4f3-673a863de01f
 16 1a9cc4e4-0b27-61c0-a7e1-ede1ca3b4377
 17 ab59f41b-1dd2-2210-87a2-74605c5e099b
 18 06f5c49a-1e7c-19f9-bc5e-f3aed9ab3f11
 19 a70ac223-d8e2-2c4e-9750-061ae2061eb3
 20 fda140f8-0c85-1595-9291-caf95f9b0e0b
 21 71fd86f6-0661-13c4-8669-cb5ea721a6e7
 22 3be7caaf-57e8-4850-88c4-9743ce2a0a49
 23 0a1ce3f5-80c3-77e0-85ee-6e48680c2fe2
 24 1db8a325-a6b1-6967-a3d2-3e763a865412
 25 bd78f45c-00c4-703c-9007-b16dacf1e630

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 2548174530030756212114767. Exactly this sequence comes out of new Random(981).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 12 of Run 25 (seed 158,297,437): new Random(158297437), Next(8,64) per post. The RNG predicts N = 25; the post has N = 25 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:14–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs