A858DE45F56D9BC9 archive

201208281637 yzbdf

explained decrypted filler

seed 140

Metadata

Post ID
yzbdf
Title
201208281637 → 2012-08-28 16:37 on A858's clock
Posted (UTC)
2012-08-28 20:37:10
Timezone
UTC−4 · title 16:37 against posted 20:37 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,808 hex characters · 904 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208281637) = d6c3215d49a9a766d374f6beb6dacb61 (name+title)
GUIDs
28
Filler GUID seed
new Random(140).Next(9) ✓ verified
Run
Run 26 (seed 1,159,248,375) (seed)
Draw
4 · predicted N = 28 ✓
Machine boot
2012-08-15 10:21–10:24 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
8 · 2
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

7E9B657C393B7411 E40B986201B70FA9 58A3DE57338503B7 B4B1F6B4643885AF 1B7D2DA669AFFEF3 32CC920CC377CBBE CF16ACC8F8796B14 A2DFFE27EEB426EB 63691EF8F3705401 E39ADCA2A100797F 7DE17C0C45737163 DC521BC37963D88B 8BD2D9FF0A6AC0B6 EEDF3EDA492095F9 24FA05F6A422CBDB 96E73B91B08AE224 C16AA8C1CFF4C03E 8E86E0AB0ED7D05F EBFD969D8AF54D7D 693C60F9D4ECED43 FA44F6721A33C304 A613A46D0580B925 2A6A4640AEFBCD0C 5118CA24C613E748 B27BDF51E59B56D3 7BB4CC58A69ADEC9 73D4916443D2BCC6 7145534FC49249E0 24E82433DE2F7EE9 0F3B76006691CEF6 1A67D50CE05586D4 F9271BA5999DEE3A 9B583A5ACF5EE634 3588CF4980217BC2 BB1D52D0B749B228 3303F1FF24779A3A 29ECBB0ACCC00B14 7CE8503BB77AD415 A6E52CFF0786CB79 28BAE900C45C9238 4A9515BCBA96E8CC EDE896AE4C0A7025 20EE89DC5BB89745 1294228572FE0064 A3DD8F7E75C4658B 1133BA6DF36DFD86 1FFE1C3763F04334 830D5FCDB5BF34D2 20B43CE8A1E3AED4 9F3A89DAB972CF33 12C0205DD82ABA89 6E71DA5EF36258DB 05672E5A8CB5CA60 82B15128F17DE059 B614B2F3AFAE6791 5D0AE80C9FBB4ED1 15F528D41EF68D59 A009F0B86012F8F6 A0086017BD3A71F3 A9D9D34E4971B7A1 BEFA3E04A063A825 6BFF8DB116856DDB ABB594FEFE8FAEB9 9B5F9AB2AF931B31 30DDEBD543FE7650 90C686C5AA010837 473E8CA64512993B C86B441C409FF08F A474AAD01E4220CC 27BB6A6AD6F161DE 88D1C3527FBD9408 0D212D67F0D202A2 9804569ACF22A500 B7878D8B179C2921 65BC7A53250CF4EC 90896B43B73E1DCD 9B6CFA80F5420E02 8C3B4ED96A80A518 6AF22B2EEF43A0CA DD10E6DCD1963D08 4D1996EB2BEA9684 79102A24D59E9B59 54BCDAA949D0D77D F0F692B47AF0FFF9 83C54A6149135496 3BB1AD7FF605A50F 03DACA1B1757A1EC DC22986878A53DD5 ACDC4D3398D7F474 84FE9D15FD919D83 1505CE26F4D19759 84253F9B1997F43C 5E8A4B962EB158CB DE689112DF526576 6DA323D816407BD6 B0702EDAE1707E32 2B77142A5A2280C4 57964BB6C79F1D6E 35291707F5D00BE5 06EE1312AE2E7427 BBC18DB153B1E9C1 83D9BDC0BFCD41F1 28C35595DE43E455 B5F3DC288A6BF0BA 7BB5CF019C32A71D 4438F8D49B21CD41 99E5ADEB6135ED56 ABF97AEE43B893F8 63D43BC3102DEBF0 BFABB795C2D8DA55 5656CA8BE5C03F13 5AC70F358283F324 99F8CB380DC33463
  • Read the ciphertext. Strip whitespace: 1,808 hex characters = 904 bytes = 113 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208281637 (name+title). Key = MD5(password) = d6c3215d49a9a766d374f6beb6dacb61, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 28 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4cd201e8-3d11-7347-b050-8807d75ba82d
  2 1505548f-bc9b-81e4-bbbc-cb1b45682377
  3 8b30b0c4-220d-54aa-b2ef-24dbdb661743
  4 52c9cda1-03fc-3c5d-a1dc-889969373e92
  5 538edbe5-ba20-3334-b4d5-9a5c6d405218
  6 0a42ac17-cfaf-8e6b-8f9d-2a5da3171dcc
  7 bd96de2a-8ac9-5b75-892b-4756f2baf957
  8 dd8517dd-51ec-601a-be9f-8f735a05726b
  9 16a7fc4c-b6f0-2e1b-b4dc-5e0e3abbc65b
 10 2457542f-e6fc-8ff5-a205-ab4bebdd6d4c
 11 4a1e8fec-5455-310f-9e71-35cfd847bf98
 12 5f3eed5b-4567-611e-bfb7-faee78f262c2
 13 e459ba99-5d06-7619-8f15-3acfd08be466
 14 40dfd382-07b3-281d-954c-5f0705823765
 15 d197467e-6e91-8e01-b506-93f376f359ad
 16 aa8c4e84-f5f4-40bd-98b3-37ae5d26dbc6
 17 3b3bc6b2-db81-63bd-bd50-b79a405e5d5e
 18 0b0a5304-a87f-7153-8641-1204439b1411
 19 a99fd911-1728-4bf2-879c-be3267ba4d71
 20 a8328aa5-b41c-4844-a722-9e02149516a8
 21 c2b54bf3-1524-3bea-9dfd-00038828c930
 22 f92f2630-5048-1165-bae4-34ad00f6fece
 23 c861f87c-afce-5c6b-a3ad-680dbb56b857
 24 6bc002a2-00a7-8fe8-884a-bb8669732700
 25 cf686cfb-aaec-3fbb-b1a2-2b2a26e9af10
 26 84f93bc3-5198-5256-9e80-6d22aa3b9101
 27 210ec3e6-48e0-23fc-a7a6-0ee91a551213
 28 82b7ade2-f9f5-3ed2-9e8c-5c3672f4d921

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7853385628367284674431583523. Exactly this sequence comes out of new Random(140).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 4 of Run 26 (seed 1,159,248,375): new Random(1159248375), Next(8,64) per post. The RNG predicts N = 28; the post has N = 28 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:21–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs