A858DE45F56D9BC9 archive

201209031817 zawr8

explained decrypted filler

seed 18

Metadata

Post ID
zawr8
Title
201209031817 → 2012-09-03 18:17 on A858's clock
Posted (UTC)
2012-09-03 22:17:00
Timezone
UTC−4 · title 18:17 against posted 22:17 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,936 hex characters · 968 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209031817) = 7f2dc63b4c8dae37ba065c0398b4e18c (name+title)
GUIDs
30
Filler GUID seed
new Random(18).Next(9) ✓ verified
Run
Run 27 (seed 1,337,299,625) (seed)
Draw
33 · predicted N = 30 ✓
Machine boot
2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
9 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

A23391923E1F3727 BD6BCA8407521D52 F07C448FE46F6D84 CFDA4FC5A1EB5EE4 B53900CD53E470EB 43B3F201D7871368 C4F93FADBDF9113B 1EF810278606E1AD 82EDCE3DAD2F18FF 3CE768D2EBE612EE AE5E1F8000EE2926 9CBD04F9EA84F1E8 0A3A64E97C622553 DA1949E7CAD2EA8C 52F975E8B57D450D 0A12BDD40D26AC26 5DA4E19FB12AFFB6 914596678E287579 8EECAA6DCCF3F460 2610E647749AC9BF D0E9FD7FF076C5AB 84A95438A8B167DC 7BA4F9EB56D5C425 FA4D1EBB8604DB1B 367A6FDF427211D9 DEBB7988A48503A8 2FB707A9F48409DA D49DC490A849BA5A 281EC10DCCC672F7 3C93C8FBE83405EE 8DD562F6E0F4D3FF DCF7BD4D81EEB30E 47455D7D7F1FE095 F04BF6E4EA46A9F4 0DA0720A57737576 9ED1E0B077A164F9 8A88F52E8DE514C1 AEC2797047DB0C68 C1E26F54A3AA5CAE 65BF936A13A44EC7 76B13E867FBD66B2 F331F8564192D077 88DCA1714152D869 BE52699621C5FCA4 FEF98BF6435E9967 570AC3EA1DBFAB18 11EFE4F19A7B8645 AFE27D167099A090 F9F4312E2F63AB6A 9DED67CB223B5C6E 3488403646C3EA4A EEBC4092BB207698 A42A8E068FE41D2E 642E8CA7D6030B7F 27C0C56613D75E17 7FB33A8299EB4A66 98846E813EB22977 F96502ABB4D9B9A8 EC6561C49EDBCF03 55F2915ED78FAD19 D654044E332E40D4 E526045029A49FB0 27518F0227374841 5EF4BEF97B639F9E EF0727AEF327D9C0 42F50AFAE303D432 7C09D114E05FDBB1 2DA0FB63D1657FE7 789CCD17AAA1C87A FB2575944BEA9057 10E2075B9FE09806 500C11AB3630ADD7 8734464FEBA5CB08 225F02E9F4D1D415 D417E6E3857963D7 07A29D49931A08F2 2DA9B747D46BADDD 5A3C9D48EA17C85F AA70713BD72675FD CD6972D8D1F054CA 718F168557D30E9D 0F3456B1C3B0443F 573D13666C73652C 66B65F48A45B63F2 2AF4CA955007C0CC 509DD302131EFF58 49E0A59C603C761D 445B2C4F70CF7626 ECA5B4F9C6EC98B8 39DEE95D61CFADCB 4B0A7A1BC8BB6808 0A42A5E6339B4F34 14AF51B5CDC954C6 44F6148C75B0EFD8 614DA30FE4E9262A D2C5C82F36CE597C 2E0720D81CF23287 D43EBCC136528612 97E23837C004EF03 1EED7FA3A1A5A866 6B0302591E5C4195 DF395358C9540CE9 3C107E7928F83498 E122EAD22F13AD2F 0002BFE07B02291C 96A1330C96C5634E 281F25D6A0A139DF 732FF589A857100A 47AF858575132EDA 8CB1889575798DCE 37E641F5D078578B EC49F8980ABE7223 5E89ECCC3B49BE67 D718BAD626C7301B 2802EF4DD76ACBEF 20E6455185E2FA28 5E4992F47101EF83 E7234C7E6085C7B0 130C983350FFC941 BE5FFBA32EE79302 8B476502F0391276
  • Read the ciphertext. Strip whitespace: 1,936 hex characters = 968 bytes = 121 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209031817 (name+title). Key = MD5(password) = 7f2dc63b4c8dae37ba065c0398b4e18c, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 30 GUIDs as hex (shown below).

Decrypted: GUID list

  1 900980e8-1caa-1a69-b2ad-b4f0970aa8fe
  2 3e302892-09e9-0cca-8c28-a4a809c33794
  3 50d7a938-d037-3dc9-bc9a-968a7f0053a4
  4 c1619d94-f1b8-33d1-ad32-d33725bd1a95
  5 8403b26f-994d-2ba5-8f23-40be8159cd55
  6 7f2a9aea-5819-26a8-b38e-6a7577e50106
  7 138e91e3-09f3-8e99-a3ff-4cddaeedd18e
  8 03d450a3-728c-4943-9c24-a4bed56de960
  9 64f7de14-f306-18c9-9aa1-5555c27fa089
 10 fa9c14a1-8f2e-8056-bc9d-ac2e5d13a30d
 11 120dbaea-d64b-417e-83a2-650252918998
 12 464c56cb-d472-4f96-b079-832c5a6c2da7
 13 2d9fa73a-3b5a-02b8-bef6-92eb40d1852b
 14 2b9842e6-e3b5-7274-8a3e-48068356de25
 15 0dac4bde-aa06-57ab-898f-e6bfbd10e55a
 16 7017ea43-95fc-2a81-aca3-07191eb9e335
 17 504c0243-9a74-3f50-9f36-0e1ab6931213
 18 2ccfd4b0-7f0d-19b6-b4b4-4ca5e28fdc44
 19 3aa23965-996a-15ce-930e-260f9adfe802
 20 471a35bb-b7f8-2b03-afca-0b00439f2ac4
 21 cdbc4a0d-620b-101e-b68f-adca8ea593c8
 22 034acb2b-130e-2452-a481-fa6761071e8a
 23 66e3ed73-eb2e-0e1b-9336-795dab37ce90
 24 8e9a9e76-ceea-2c23-98d4-06ef4c6bde0d
 25 3e7a4101-5933-4a88-a1b2-753ab4cd2a29
 26 04e595bb-46e6-0c8f-8b95-4b0abb282f2a
 27 1e204b9a-2f20-38a3-9520-68e97abd510b
 28 908efc6d-6215-78da-b439-b3bfcbaeaa7b
 29 2f1aa094-4202-41cd-ae43-d9155d3b1e8a
 30 8c25d343-f0c6-500b-9f1d-9373aeca6caf

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 103322841844075231121202403745. Exactly this sequence comes out of new Random(18).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 33 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 30; the post has N = 30 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs