A858DE45F56D9BC9 archive

201208170443 yda9q

explained decrypted filler

seed 858

Metadata

Post ID
yda9q
Title
201208170443 → 2012-08-17 04:43 on A858's clock
Posted (UTC)
2012-08-17 08:43:48
Timezone
UTC−4 · title 04:43 against posted 08:43 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208170443) = 405db907ccff3129449ab68f7cbb5916 (name+title)
GUIDs
24
Filler GUID seed
new Random(858).Next(9) ✓ verified
Run
Run 25 (seed 158,297,437) (seed)
Draw
14 · predicted N = 24 ✓
Machine boot
2012-08-15 10:14–10:24 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
6 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

DC5309FD0692F910 54CCB714D30F0498 4DFEA6AE531DF76F 222176FD12C86086 5F1B9301A57F0FD5 6A3BCC2913C1E853 76D420950719C3F2 E2A6DA3335A1CFF1 912769A60C90B640 90F65DBD226B2FA9 A61DB5BD40110F9E 1BE8938A7EEFDBD2 0F6BA7548743EB2D 81949652B711A7D8 BF0DD247D48C2FA1 61BDE7499ACF8B44 D251798A62EEE39A EA5A3DDDC7EE70F5 0F476D5FF96F52F1 9DB4F7D176D55BD2 E1CB5CC520C393DC 8DE0B1DEFB1A4438 853C73692E3E199F 6937C85289EF23BC 6B3183FB84A0E055 69E0BEAE26890507 0DDB9FE9C351A9A3 C4A8903F7513A6CD AAF1EF69CED0F4C3 F4E08E9E94B93912 478A8F8DE8314AA1 60D5A910B3BB2462 B9FB387113DBD6D8 51F27863DEB767C9 04323CEC841BDA06 8B6408868182C397 4E63A4008A60B69E 02E6BE2722FC47CB D4143DA40091E32F 0D42A28E1992CB44 A81B795C3E9BBFDE ABBEC518094B05F7 0020B9FADC797768 2BDB30600B495BEC 1D170FCD9165B046 806996629F71BDA9 B2BAC9D411F2A1A5 23A8FD87BDD302AB 28B912E39067DFDD B45941E7940944C5 1D990376B54B6978 26C4BF4C0DABA30E 0F594E0213407EE9 C59897874EC70565 46C9B8B3D256311B FB34C7323EE6A10F E18A88F7D50FAE19 E842116C283CE4C5 298B8042CDD6C05B 68E9D881DB4EE188 05F178FADA2C7E68 A139C269A1B77C94 98BCA356918B5D13 464A4E4C0996C17E AE34E88198FC3458 1634C95C904D0356 F857987AF295ABA7 E4F6763C78D43315 8C7DE0AF43EAED35 4D376B5B27C427DA 50FAD0110FF5486E C5DBFFFAF80FAA5A 860620428D0FEDE1 626763FEDF1E4A8E 7898CD7469128CF5 59741225DF66272C 40C77FAEBB690891 A241B4A5D8FBECBD 148A30E606E14E73 5CD46DDB1B17BB15 E8A76F3972059F06 06A0699294614D80 F12661DF07A41910 58E7544B8F9598E1 BF15D7A3071D416D B59F519C95FF452E 79FB1BC94893C00D 2E3E59CF25C27AF7 DD260824B769F567 F5FB366B37408A3A 7A40DD3020C3DC77 35DDDD461945B495 70D101565DE20386 BF8AA89A02D16962 AE34835D3F429DD7 C876FB910DA93484 8C186DCBBEA38C22
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208170443 (name+title). Key = MD5(password) = 405db907ccff3129449ab68f7cbb5916, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 20180d68-5cda-8a32-9203-3333d1bb9a1f
  2 9de35a7d-ad60-5895-bf5f-0ce54ae6d989
  3 a7e6a1a6-d591-4e5f-a394-94210038f09a
  4 16d2c869-1e79-6f27-9553-5e0092fa4e7e
  5 5a92294a-46e4-5160-912f-707b6fb74cf5
  6 bb975615-10c4-3353-8143-eefbe094645c
  7 f9f163eb-2c02-30a2-9bcf-3e1c77206021
  8 f7ca6f45-be06-7843-92d6-e1ab4c2c2a9b
  9 61af988e-de92-1a50-9f3f-4edf3ed8ad02
 10 cbafdbb2-5abc-5c91-af28-c32eb683fe88
 11 84f66d4c-fc4a-3592-b367-b9dd1748db1b
 12 d98e5522-7f22-2419-8747-c5fe36dc0f09
 13 01b8e117-ab12-44ec-8c36-bb2c2690bc48
 14 ba3a806d-dbc4-71f6-80e7-253b6a4bdd75
 15 ee6d7f3c-7baf-5eb9-b448-da9e1c9a2c02
 16 4dee56c7-4726-722c-846c-0f35f99dc1f9
 17 71e25c98-c08e-44a4-bd73-94e621077c86
 18 af42198d-7526-85af-9188-e20c15d620b3
 19 3bd48058-95b8-8274-8385-033e0d692bbf
 20 58bec451-695e-474d-9df1-2986815d0709
 21 96d77bce-abec-731b-af62-27b2dc67b92a
 22 f627ec01-2fcb-35c6-ac6e-a61ffaee4e6b
 23 740a3d88-74fe-827a-9606-2fa6417c2826
 24 0d90c95d-d33a-6a00-9cc8-4a8df8564be1

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 854653371532475748847386. Exactly this sequence comes out of new Random(858).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 14 of Run 25 (seed 158,297,437): new Random(158297437), Next(8,64) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:14–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs