A858DE45F56D9BC9 archive

201208310457 z4l7s

explained decrypted filler

3DES(name+title) ECB, 34 GUIDs, seed 647

Metadata

Post ID
z4l7s
Title
201208310457 → 2012-08-31 04:57 on A858's clock
Posted (UTC)
2012-08-31 08:57:18
Timezone
UTC−4 · title 04:57 against posted 08:57 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,192 hex characters · 1,096 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208310457) = b7d6d5dec96ebff5fc5b18180838e3d4 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
34
Filler GUID seed
new Random(647).Next(9) ✓ verified
Run
Run 27 (seed 1,337,299,625) (seed)
Draw
21 · predicted N = 34 ✓
Machine boot
2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

96AF61334B539D79 0AA1BF27DE998431 644462E8A4E1B891 2A18377749801A0E 76BBB6CCA4C2F641 6DA04AED91778B7E B8C84CF29ACD95E3 3FD59744183E0A73 41ADC354CB6F27D2 5F5C9ED8E5A8C302 B9BF7141322E8743 F98C2393DFF4750D AD559BDF8E10D73E E05674912EF6051B 5F7F26524B011310 FA92129ACD62A0AD 5AA950A0A1A178EE 2B548063E81DFD61 B008383B11677412 FDDA47DFB92DEC7F 34E2284140258552 30BEB4CB4383E7CC EA51F12AD7F76B27 1780DF9D45EE43C4 20C9722270476ECB E1E546850B9D1D83 570297B397F716DE 260D30EEEFB75DCB C59A19A7FA99E399 46E36B1125B9E87A 985A17E9FB89ECAF 4AE7D779CEF70AD7 00BF8BF770DCF1A3 1F0A0290E3E7B5DF AF1C9D626ED2855E 9FAFFC7679FED867 08A94D3707E02CF7 2B5A1D5343F6EE81 7F9A5171967A01CA 3D0782757A671FC9 BD322D9EDB731469 0D50F366BEAF24B3 ED9392EDD88016DE 18F23CD27D608827 ED5A7CB9C6130D5C 019E9FA8AD9E2502 DA6394B53674EC71 845AD82E5DF8554D 94DA265BA537330F 743ED12BE343D113 1246EC273317E04A 342539D802F8D7CE C0E23AF153E50E15 432483A26E12F3ED 1EAF889DA409D5C7 E22A44701C03E465 ADBADE45318A87F4 0972B1DEB5A9A6B0 DCECF6C548AB7D99 1D68C8F606CB3836 3B9E4A66E4FBF872 57A78E337D098364 5E0C7F789A390017 C94BB91EB2130EDA 6003D2B0D915707B 46DC471D9B077E93 3D9DD607DF7C6923 3E727D2C9138A89D 5930AAB0562024F9 426C3962D6A84AA3 35A55D626CB92DAD 8C6A2923AF3FBD54 00E4E7F428F97D86 D07551C544E5D2F8 D80388B5BF203CDB 5E8F514A8DC22693 6B06048A048667D9 3C8509904F6CB3D6 E5F2C977772558CB 702D5FC304CCFE57 44CA78ECE04A8A97 3FE81266911CBC47 AE96BA70A0793D32 57A95145F605B602 CB3F5ABA58FD7CE1 A3B314DBD1F942EF 43FC1CA7FFE5B310 ED8DE1219020ACE3 5F6707DD42E6E968 9FD69EDCA076FF54 649D67931BF10972 7CE14145EA0A8AE7 BC4DA3F4CE529BE3 640618D67672F7EF DC9025E67B4DEDF2 0FDA786276BD8BAE 24A54979DAD36713 0170C3F7ED96B23D 0C89792790990A65 991819E6E81F40D6 2595209DDAFD1593 03E6D5F692016E5D 898BAA2E5FB84D1B F730B8125B5649C0 B88B0388B0C51EB6 611C06CC6D0AFBD8 E64BB5966F73CDF7 03FB6D77626579F8 4CDBAA374A9A4797 4140CDF0EF4320F4 E797FBB3A7A59CF0 1F86F40015635E63 D5C760973ACC108F 35271FE10D068E08 D067043BE6855EBB 0C643FAAC50D7E34 70709D0F916E06DF C0858E310B9ABFC9 318FD2F2A58483A6 63CA8210A361BACC 153D2037BF5EE527 E1291DD82DCB9968 F101ED71BAE62464 19D80138EFB233D1 07D94923E165C52B C17151FCA0EF81A2 EAC5EBFBC110E76F F8D729EB76E58E63 9EB98925968E6A3A 8CD9414C46A8B6B7 6D58CEF345F3395F 9B915D26D4225056 E9C1938DEAA1C5C9 A3D1ABFBDE99F237 F683E8DC3183C41E 92107B105E9DACE4 00BA63A11C41AB90
  • Read the ciphertext. Strip whitespace: 2,192 hex characters = 1,096 bytes = 137 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208310457 (name+title). Key = MD5(password) = b7d6d5dec96ebff5fc5b18180838e3d4, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 34 GUIDs as hex (shown below).

Decrypted: GUID list

  1 88ed3ff1-95a1-6a58-873b-9ba61347fcb7
  2 858b42f6-ecd6-5aa4-b7eb-1099da62436b
  3 3c2cedbf-c0d3-006f-8490-d219f361675c
  4 0e6c8f03-b76d-5582-a4f0-300204e6c117
  5 e52b8c43-fefd-206b-a9a7-df1c2e074977
  6 9d5b076e-8cfc-89fb-8cc2-53451f8f0a6a
  7 e81878f1-9c3b-782f-b2ac-d2930a5a8f35
  8 f1f91858-8cc9-0ca4-9338-1cf47fc87f6f
  9 063a7716-4515-0b99-9856-51fa7e511fc4
 10 62b52a46-a907-7a9b-9668-436836ebf427
 11 15ab7a00-62da-8f40-a03f-52a00764d512
 12 e820f950-655d-54e5-914f-fca462f78051
 13 cf3a8546-d05b-3bdb-8c31-a7573f241770
 14 95fb625e-e144-0e98-975b-9d761d320229
 15 e08f358b-ed3e-7985-86c2-8e7643f569c1
 16 f3384802-41fb-0219-91f8-f609304344a0
 17 d0a25c57-c8a3-73a1-8fdc-2796e5dbe491
 18 94723709-e12b-143a-860d-e122215546bc
 19 7e8ba157-06fd-1c63-9ec9-773b8f54159b
 20 1c9876b1-59ae-7177-af4d-5d13081f5954
 21 9c96b8cb-da6a-7fa1-a2a1-9f608f2541f9
 22 0b4bc461-0f94-53af-af3a-9b8edc4f9b35
 23 6ed32c5d-96a5-37af-a2b4-f289b87979c5
 24 c4565e41-87e3-0ad0-9909-dceedf17ec43
 25 b99c8316-b628-00a0-ba95-9bb9ffdf71af
 26 9c2a6e60-9360-534b-8312-2157f22a3374
 27 a0c3cbdc-d44c-1723-ad04-6a3c5f1c5266
 28 c92476d3-a167-5f0b-ab11-87092e1d65dc
 29 2d9961cc-4ca7-2d0f-8951-6680819e9183
 30 51f1e927-f143-14d5-b64b-6a61936101a6
 31 ebe0bbb5-af6f-0a57-a7ba-716f955b979b
 32 d99aafe4-9dfb-76cd-ba95-59ea75089c1d
 33 9f9bb6e4-8323-4242-9dab-e3fdca4f4011
 34 3a8398d2-360f-1a26-b7e8-d797397bed3b

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6505287007853070711775300515210741. Exactly this sequence comes out of new Random(647).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 21 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 34; the post has N = 34 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results