A858DE45F56D9BC9 archive

201208170503 ydau3

explained decrypted filler

seed 540

Metadata

Post ID
ydau3
Title
201208170503 → 2012-08-17 05:03 on A858's clock
Posted (UTC)
2012-08-17 09:03:50
Timezone
UTC−4 · title 05:03 against posted 09:03 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,488 hex characters · 744 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208170503) = 529b3e5e4d9aeb645ad5a78545900105 (name+title)
GUIDs
23
Filler GUID seed
new Random(540).Next(9) ✓ verified
Run
Run 25 (seed 158,297,437) (seed)
Draw
16 · predicted N = 23 ✓
Machine boot
2012-08-15 10:14–10:24 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
3 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

E75A2C7003B48481 F33B2A3B9247DF02 7C3FE43EA775CB00 E04BC75FD8B967D2 A4DAE16F4168DCE2 C3EF8842B3B4E182 D1B05B528634F628 81DFAA9D729A0F9B 12454722F1AA6619 5160FE74A11DA189 5B67FEC02B645D6C A2EC1738DCDA8B81 7CF4550DC381E723 2A56D0401BDB118B 020377A848201295 1D1B8A6C122F094C 24B2B9481B1A0DB3 0D9AA1A9764E23A7 83B10EA5773EA730 D5B03A31E84A02FD 3EBC4092811AD842 7C0A996EBA21CDEB 0064218B100C734E DD5F6A0F538D71DC 7CECDF5787CBDF11 3F886AC096D378F7 6B74B098FEB9823E 8A68EAFA8B7995AE E3AA8B63DB8003E3 FFD4DE9E8C0CD982 89930557C8F044CA C2A0A3A1BB704D91 F1750C9C9C393F67 0493D05F128D0214 71A300FE917A83D7 5D62C1D06FDBB313 086F8F77A17030B0 C44A881574ACB67B 6B353B920BD6A462 61BD9F1E9E56847A 77D4086C3DEC949B 15607560D5F12207 7DBFBB3F40AD51A0 8295CE524714BA42 8CD009F1FC8C929D BF4D23F8CD21ADCB 18367FF638750021 EA4EF80ABF7AFC0E 65EC8A692939E7F8 FB76986DED3218F5 2E03F4CC740E098A 0E3A6BCF9831A380 DB9EAF6CF337975C DF2D548ADEDDB396 9539ECED6C0B9A10 243B5F19A90F9D44 A6CE4189AEE209D3 415D3C5C94AB17CE A419D7DFBB29C4BC D401E8ADED97947A 25570514F9E50B68 BB2C91BEEA27BC15 3C523219B54D1950 AB59570165FEF080 F190288F71C720B5 EDC3170D695D0776 4CC9871792E2075C 92BED7EA76ADAAFF 027F04189865436C 97E1F786DFE63CC5 06D79B35ADD8B7AC 08D5E10D4F25C986 57C8E06E0FEAE6EA DE75E9710F987463 F76E63E5E7CF7542 2A884F87C12733E1 4CC7B7E96DEB168A C5A3541C0626C253 BCF23EC52C581CB5 387A43D02D9D0154 33B0E1A10654ECE2 97C5566F18D16C03 E6628DD42E351E41 667696CE40136AE7 ADE6E07E43BAD3C9 622BD82485A78DC3 54DD28ADA2B75786 E5955CF3D5CB5204 3CD12809CB1E7000 5BC0A69CE880CB33 7A9EF6140F0DB05E A789912270467AC9 32D7E9A03FF04F04
  • Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208170503 (name+title). Key = MD5(password) = 529b3e5e4d9aeb645ad5a78545900105, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 61dbf8b7-17d1-77da-b132-75198285219d
  2 543bc2da-0308-2612-95c0-8051dd9e58a5
  3 bc924783-4dd5-12ec-b7c7-7da0131fec17
  4 368f25af-e141-7add-bd2d-53ebad398285
  5 a784e6de-d943-0bb7-9f42-5ac5cf98df86
  6 8a748716-8ac1-4727-a3dd-e6124985e939
  7 d2b66d21-de92-73b4-be17-718514c8bb29
  8 2caf0110-9b08-397b-b3bd-815e6a988a00
  9 e0ddd32d-6db1-7ebc-b3a1-19614a1cd6bf
 10 2a2d6e7e-6313-3901-8ae1-1719e00ec79d
 11 40580e05-faa2-1dc6-ae12-ca6c473b0e8f
 12 647949ef-91ab-0ba1-984b-9b3038be2ce6
 13 e9fb1bf3-d4f1-7dc2-a527-9ed5b24cec94
 14 15646a8d-9e39-3b1e-86e2-78b488ef0e80
 15 c5bee0d3-c135-811d-93c3-055605a1fcf8
 16 e90c88af-558f-20ef-862e-3d069601e82a
 17 d147c405-2fce-7101-8c80-767cd9f652d8
 18 3a0e0515-459c-7b8f-affd-d23e98fb2214
 19 f532c6e2-e5c5-2147-8611-0fbf5f53f07f
 20 d89a8272-df32-3001-892b-5e53862feb3c
 21 30006c67-11cf-57bd-8b4a-dd9a427d9d8a
 22 f2981bca-ebaa-23c6-9cfa-15a38fbb4ac0
 23 869ef0d4-0a49-201f-865b-b14264ed96d8

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 72170473731073827723522. Exactly this sequence comes out of new Random(540).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 16 of Run 25 (seed 158,297,437): new Random(158297437), Next(8,64) per post. The RNG predicts N = 23; the post has N = 23 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:14–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs