A858DE45F56D9BC9 archive

201208281643 yzbsp

explained decrypted filler

seed 383

Metadata

Post ID
yzbsp
Title
201208281643 → 2012-08-28 16:43 on A858's clock
Posted (UTC)
2012-08-28 20:43:31
Timezone
UTC−4 · title 16:43 against posted 20:43 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,256 hex characters · 1,128 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208281643) = ff56f6e0124b404b1bf431d57dbf6b94 (name+title)
GUIDs
35
Filler GUID seed
new Random(383).Next(9) ✓ verified
Run
Run 26 (seed 1,159,248,375) (seed)
Draw
6 · predicted N = 35 ✓
Machine boot
2012-08-15 10:21–10:24 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

CEEF4A89B5A35C21 6D6AEE7BEF27C3EC 19C76F2C43AD93FD DB06A0D0D98D3560 4EECEE8A6AA77C4B 4E2320EACC15FE60 34CE2A8FB5D0B3B4 E382E15F2113B12F 6A396CF1259EDF40 3F0058FE7EF95759 618909E710E471C2 9369EE87A31C8CA0 CED204EADCDBCBBB 35AA994AF669070C 6AE6C45BC45D6DC2 FB8DA9470885CCA0 3E03C9D6E8B2E495 5B4528A7EE5F087F 4F2E865072EB6B96 BE938289130019CE 52E5BB41FC5BD782 D4BE396C8508D4FE C7746F08FC7DB081 A7886B5EEF914824 163EBF80F6B4274A DA3E1AA0995D4517 7B9C49068C8B6C20 82CFBED232C551D9 5C9F42F9C3B1AFD3 49DE15C396858B42 8DC92E4F5E1DDFE5 57686CDF5EA1F96E 2DA3C53EF36C20E7 1BC9CE545F7B4244 3FB5FD6F49B248A6 80EA69B64B66C292 49C334823EEE11D3 B2CDA82B5FD1A9C3 1C9862992043D91B B8FA78D74019B588 589DA4D3BE05EC09 31A472E275CA2E4B 8C9FFD98323C839F D4C7F1A4040658FC E110D3439ED2CAD5 CB3B13A9A32072D8 71112EE3AA14FEBC E12E5412D4F5AB2A E0B2040D416AC028 173003D86D887C57 5197D46C5FF60F44 505EC2D15635D134 C73D6B00F046B63F 8E606EA65E8EAA9F 9858590B65DCE65E 09B9B0D97A46AC34 DD58C1E78AB4082C FA8F99417D23D1BF 0EBC8671097946AC 91E7524A4AAE22E1 D5178DD279AF7307 01053E10C77915D4 2F9EA90AC93F301C 5AB5989174F99E03 0BBF1CA03DFB5A13 F0F026BA7A87CA6F 61A536E3292588D9 7C462434F0177AF9 5C5A879486A07F02 40582C955E0E94F8 7D9B68441F6F8CF1 E913F40CF4B868BC 884C68B45C7AEE78 1AE8F90385C90A27 9D7B807C84D6A224 40EDDAB641F0309C 10ADF6803278A442 9DF2DB75E687DB9F CD60E5A9453231C3 BA43BF22F0854F92 CA0ACB79057099EC FD5A1C35C5380DA3 27655ED6B261CABB B013A8C667C7FA42 F8D7F8DCE78AB9B6 663031FBBC5D818D B5468DEFD1E13DB3 473B4E8DA6261F37 AC6045401353DE3D 073981DE3824930A 728D31F226FDEB2C DE778268A0796C03 6A4604168FD93FA5 D6FE5F53B74BD5D8 EBBCD792F087CE7A B6E23655E8F72481 0D3F8F6EE691141A 5404995D54FC6E4B A36CF461EA57FF67 D23283612CD9FFAA EFB158561F3A80A0 E3AA78D787C1BC08 0CBF07804CD4157B AFE94188067CD294 F6DC0B81BC0D39C1 05EF0712A2F05876 A341D8AF0BCDC11D D7860A6004137E20 5A18C5EE2BD4FAB6 9E9802E7F5F31FA1 978FA450864CC780 09780AC539073544 FA6D1E36D94645A0 968ED7D037D2D8A0 AB4B3FBD8E8D1371 5EA7005D434BA35B 48E4C1ABECBE0152 EF7FB3B8FD6FA756 C996AD82FFBBE5A4 C227841DB6A12115 E4BFCB8261D14B77 7803E1EC4392D688 FC884D2E02BBDE8F E7574113F9F42DF9 8B4615BFF061C7A5 FB4333AB2B1C671B 6ACDA8FED705872E 356055F22F1C074F F19E87624CC65E56 9C9E2689EF8E2CED 0FB28E88F7BFEF9F 156EDB87898DBF9F 348E0E50E3BA0E0A CC3A105BDDB7B3A7 4BC7364EA22C50DF AE470586E0214DBB 7117F2A16EE81652 8DF3710CF0EFA27B 498325F1E2F5016D 7C89EDD5EF2C6C3B BF8BC4E031FCDC47
  • Read the ciphertext. Strip whitespace: 2,256 hex characters = 1,128 bytes = 141 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208281643 (name+title). Key = MD5(password) = ff56f6e0124b404b1bf431d57dbf6b94, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 35 GUIDs as hex (shown below).

Decrypted: GUID list

  1 4c09a237-2f2d-78cc-9ca7-fbd1015d0194
  2 83ced0c0-2f3c-1a4e-89ad-4902e25c0318
  3 aaf41705-9814-48fb-bd66-265482302e42
  4 bd2de95f-7094-270a-89ee-e79e60841837
  5 8b2aedfc-7a15-18c5-b664-09ca9f31a6c1
  6 7e7d5379-6680-2baf-b521-c245db53dd6f
  7 30f4c53a-d15e-4c21-977b-1ce1c86a0a3c
  8 12b24f34-189f-5356-a830-61e9de5dc8f7
  9 e80941bf-ded3-3c14-9d8f-d3166cb5c40f
 10 e84c4858-e2cd-409c-b92c-926551e08943
 11 ba169313-4c95-4365-9dc6-bd1572484cde
 12 449f83e0-40d7-467d-9339-b54dacf97574
 13 1ef5c3fc-3208-81df-8cc7-9be754959bef
 14 89623954-65ba-60dc-bb14-72bdab2c1864
 15 fe1b7f7b-8fcd-0950-bad5-ec168ee319e7
 16 1e02ba71-0eaa-1618-a276-669068683f11
 17 62ed740f-d721-7497-a266-0c8eb87cedd9
 18 a0064366-eeb4-4f15-b894-d4c74a4ec4be
 19 1c4acfea-30f5-0802-b6d0-28b9b3fca20d
 20 d29b5fdc-e79f-5470-9549-e4e098342bc8
 21 0c85cc37-d07d-6904-b528-c561e84b76d3
 22 cd2dbe50-34a9-7557-b546-4e1ce104be4d
 23 21bf62d6-5b6d-62e9-afb0-d5d6175c47d5
 24 fa21b027-f123-7544-87cf-2a974b9033f9
 25 e60cf5c6-6b79-2f1d-8796-47abbc7c3663
 26 8813742e-efd2-78f6-bfc4-ed8683b2a3d8
 27 e8d1b7c6-39f9-20d4-92ec-5fda47a613d9
 28 13392eb3-10e0-864e-a838-cd8c72ee9482
 29 f25a4f12-97fd-3e12-b39b-7678e8e78189
 30 1b7e5ca0-bbeb-466c-a73d-cff8bd3b17b5
 31 7e3bc079-d1e4-5575-963a-ffbc55522b75
 32 3e278afa-5c87-39f0-8741-6f052e0872d1
 33 2aabc8af-d09b-2d96-a4d2-ecb04d950119
 34 9cd3c6ee-2bd9-5519-ad7e-03a3d6107ad5
 35 8d7dea40-c0f4-3ab9-a29d-14ad7fdf45b2

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 71421245344486017405676727283453253. Exactly this sequence comes out of new Random(383).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 6 of Run 26 (seed 1,159,248,375): new Random(1159248375), Next(8,64) per post. The RNG predicts N = 35; the post has N = 35 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:21–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs