A858DE45F56D9BC9 archive

201209010817 z5sy7

explained decrypted filler

3DES(name+title) ECB, 37 GUIDs, seed 122

Metadata

Post ID
z5sy7
Title
201209010817 → 2012-09-01 08:17 on A858's clock
Posted (UTC)
2012-08-31 23:17:09
Timezone
UTC+9 · title 08:17 against posted 23:17 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,384 hex characters · 1,192 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209010817) = ca65b2324272d10f32f3de1156fb3360 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
37
Filler GUID seed
new Random(122).Next(9) ✓ verified
Run
Run 27 (seed 1,337,299,625) (seed)
Draw
28 · predicted N = 37 ✓
Machine boot
2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
14 · 2
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

DB00E2FAFAE239F6 3E528317ED758219 BDC47F9592B25F89 8936D46A61A20981 81BB270BF0E34568 9612B6FB702406BD 3FCC0CB62B684DE2 F5B7CCEEE63BA48A 60B260C8517A1BCE E9C5191AD474578F 0AC19B1826909D34 5E603392324E6F36 D387BD09B7A2605D ACD5A996D629FFF7 C7FB28549C6E29FC 9158CC39CE856974 3AC2355ABA46F2CF C8E223FB0FDFA970 003982DE9D8C2CA3 23286E9DF099607A 28A1A9DE6683E378 FB5702584C6622F1 57F9ED7AB0A8EF9C F346338CB935C484 D33C94244C47E03E BD786553DA68F1A2 6D90A17D52E5A1D3 D262AA73732AF5BF 8FFA827E56999E51 F34334E69622FCF3 91C5D6D5E9D31B21 9FD9043B9AF10F60 A913202FAF84DABF AEB4C9D1387F6537 DC4A594490D7E502 0FDDAFC49C45FEDD 61EB8265611DA9CB DAC9D095DA867F0A A23506BFDD2B2E3F A22FEA7BE4DFD4D6 53C264CD85FFD110 BB8FC1E177591531 5E9C24F1E6A020D4 239CDA58128FFB92 3007CBBD34229CC9 2D943E35A849489C 2E88B02EAC9DF695 275DB8995B9B5D49 44DCC17AF7EF576B 44D8618FB3C388B7 0EA9922B0CE6193A 85273F5D60F8C609 36613E6CAEA15E3C 5CC9F75C56C77ADB D0959CD5C74864A7 F9344C990E7D0C85 C8976242DBC1E80E 6E966A536C68BFFE 750DAC4EDF3F348D EF12C156BFD6DF1D CE5BF26EF71BCFCC 8218AC0C30575C61 33F178EC65355915 9B2A447BD9071F82 81B45234DC6E2A51 C43F1478F26F3F86 21A211B29C65668C 2D7EE622820BFF1C CB8562A7AE4A49CA 3359A42D133BA13D 1D6D0FEEC6E20B3E 883BA463DC9014F7 7AAF66638198F402 9951D73BEC22A9E8 4EE4293E111B40CE FB2AB53CF4A17632 0265D51ED8A5CE88 3788213EEDC310F9 48CBDA2280FC7645 D9ED7C4276C7EF57 F6CB7D967EC707C3 1A2A11A33BDA15DC 5013B83A41424E34 3F552D8A466D81D5 2B773CE4407EDC9C 3268D1065DBA3982 0963C15CEA66CBD3 05C616C5AD1B4C36 209591848511BD32 DE49A69687E9D278 D6B69A57B144DE21 9FBE1295B968F462 76D34EE43B94B5DC 42DE847EBCB8B114 7A3733F396DB7761 0B6EBBDB358BD22C CE665106939F55FB 4765A922158A2413 C166F3B0FF141173 5EFA098E05D7F5E2 412EE8061C1C9BD7 40E97736042237F7 5A2A18913E997E4C 6AC44B0DB9BFBBA1 F7AD5B4E5C484598 D4C86D3D189F9BBE 38CA11BB67F06349 B6711E2928FA6544 3BB50045871F5D4A CBCFBCB672B3AA64 756B443974117C75 D9A8C882518B20E9 B509229F0DD20C0E 0300B3AAFB9A329E F2C331FAF2D8ECDF E6C9E2EDACD81D78 855B2B2B5066C251 5BC51C77FF3A066C 870C237D3E9C6BAE D2055ADB4B2E70DE 4439B65395F7F164 ACB2EC9CB06974F7 20F84A27850C6100 65E6AC28FE04BB1C FC6E029FC581A5C8 BDB5381B691EF320 63E09C3B07651D1F 6403B4078502E613 5F82A8950F32A9EC F336EE69F808DFF4 4075AA2B0A7B370E 57F2C071FD6A51EB 3EB732D7D3D852DE D8A9A8003DEC0784 93DC74B30EA513E1 12C66E4E97A7EF80 E42E398AFA7315AA E71B68531E5E3635 9CB870452D8C0DFE 37D76431634E3BDA F81BA96DFFD76CFB BFAA5F967B35B71A 6D3F04B1F1C23031 A1386190D6E05B81 BAA7B03BFE6F10D9 EABEEC37E0A2B45D 1BAEB14DAD4C998C 7563D511310A0AE0 94B88EFBA8A614EC
  • Read the ciphertext. Strip whitespace: 2,384 hex characters = 1,192 bytes = 149 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209010817 (name+title). Key = MD5(password) = ca65b2324272d10f32f3de1156fb3360, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 37 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b1bbd6f8-1c41-4406-84ea-bdc26123b3df
  2 b7223a85-bdcf-5993-af9c-92fff275dccf
  3 29edfa73-f43e-0177-a4fb-6482dec66cf0
  4 e97797b8-3de1-554b-95bb-732b69bf44dc
  5 d729b78b-b364-2be1-89ac-0aa32b2b0738
  6 8944e521-f245-1667-b6e2-33ed11ac8da4
  7 29112d61-2a12-5be0-95a4-e324d29c5ee5
  8 e18dbba5-ea38-551e-8b02-0b9c04c4b4d9
  9 6aa8917e-a191-06f1-ace2-e66ae4b0526d
 10 d6b65b12-05ed-2bd7-97cb-2b6b08ab0907
 11 55fe510d-dcda-1ebc-8bee-6e8abf634ab1
 12 34fdde9a-7279-6ce2-9126-4fb8e6497e92
 13 6b1a3bd4-0cdb-41b0-a1b3-030cbcce7bfd
 14 5fd0ebca-a343-8f69-ace5-ecd10efa8532
 15 8770d252-b044-34b6-8d83-56d3890bfe5b
 16 af4edd2c-12d2-1115-bc39-f4a03aa72152
 17 177bdf65-42be-168c-8d07-365d353131b6
 18 7d67dd43-7efd-501f-b568-99a1997749f3
 19 fdfaf03f-2482-82ff-906d-e36ef99461e9
 20 0a2194d9-f196-4f86-8065-9f74cda87ae4
 21 7a3f60c2-e5b1-0bd9-817d-71ae2591e778
 22 26d5f67c-cd30-7c08-a6a4-fd50d5115e30
 23 9f63423e-c25f-5d1a-b0d7-8dae342f9143
 24 ac32f502-5376-563e-a633-2cba16d083ec
 25 4e64fbb1-85e8-5ff3-88fe-75064eea742c
 26 6769c287-66ed-8aae-8886-875f41f8a83e
 27 323a6c0d-0c19-7fa4-aab1-05f5926e869c
 28 865915ac-fced-2d3f-b457-8f9b0f2013f9
 29 51daf5da-9928-2014-9f2c-d6f5b61953c7
 30 110ad391-2139-3dda-8218-608548cb3694
 31 4970c65a-70c1-2ce4-93da-215aa8b0bad6
 32 6f917757-ae21-5799-b911-3609466cd47e
 33 f84f8555-319f-3378-b41c-fa27fa10c085
 34 cba953ea-ef98-0ec4-8b33-00ae457fb16d
 35 e1b25add-8872-28d4-b7ac-ac7a893041cf
 36 5b51af12-3213-0332-8899-df3974fcd231
 37 4fd17025-2619-0c7e-8213-14b72157be7b

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4505215502164831158407555872232530200. Exactly this sequence comes out of new Random(122).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 28 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 37; the post has N = 37 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results