A858DE45F56D9BC9 archive

201209031832 zaxrf

explained decrypted filler

seed 903

Metadata

Post ID
zaxrf
Title
201209031832 → 2012-09-03 18:32 on A858's clock
Posted (UTC)
2012-09-03 22:32:05
Timezone
UTC−4 · title 18:32 against posted 22:32 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,448 hex characters · 1,224 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209031832) = 570ec5a773b3400e34a856fa9e8dae7c (name+title)
GUIDs
38
Filler GUID seed
new Random(903).Next(9) ✓ verified
Run
Run 27 (seed 1,337,299,625) (seed)
Draw
36 · predicted N = 38 ✓
Machine boot
2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

A32E27179AD06AC4 E4EE8863D4B284CD 2A4C8FF2EFBF6FAE 2382F51211078322 E46CF725F330E070 E2A924B017C50EC0 3F0112EE1BF9358C 97A08E9042D4AF5B 808767E8A6F6F6E6 BBBA6D0E39BA524F EECE60BEB8B712A1 79CD226B5124C667 4EC1EEE7C552FA5E D4D1EA3125DAB73B 3A0D5F09F892068E 414376F70D6ABD64 94838A97A93B5085 3060BC92E8F54FF7 77EBACF2815C078F 95E466BE623C0D59 5B273CC01D5E6F57 3C4A376C9C1A3003 8573BB2C18C90B3F 6B51234FD826F700 ECB02C84C733BE07 918546A98E20CFA3 0DF7AE4818692AB0 C5C016FE8C26E081 2C5EC883864E4EC1 952BE6ECF08F73BE 8D337286A341DB27 F4340DE98425885F 92E0E8547F7E3A67 DDCDCB815876439C F3EE542AB3D6C339 B94AC49B715BD073 33D2132D6CC519F2 C4450F209CEC6FF0 756594EA70534365 7D6A792FBDC2E874 1C294A842E7F3B1D 1A5835108C43CF52 B34A0C90BE7C9C37 B135FDF954F447AA C3C1D548A6EEE0A1 103F2754A895ECBD B32275EE2BAEF0DA D11C5FBD44175E1D DEB5732736E94C57 EA8DA24461DD13B3 20D8FC9CE0EDAC32 2A8AFC8011060EE9 BCF9F938732EE993 E5204F1D85612186 A84D6BD1FECD98CB D1789CFF37E42586 A8B5B8DB5314855F E6A27D17F0936311 1502B3F78CF15C16 C72F4F87B22D7167 439326A381CD3635 21990E87D6357EAB E12BEA3933B25D6F 7976A96885DB7C6A D69A60EA9FF04845 B71EC61C1E5C9F64 05911D3A31932745 EEF9492E6B736071 28B06974AB23F38A D2825E4DFC7D3E95 91B691AAFDDE8995 0991B1DC1A3645DD 6515F424D18446E8 CAA65F1F5C7FC04B 7876105460ACFF9B FBD13DA93EA6B1E2 AFF2CD5C4A5F2EBD A418CE4A94FB41F7 0EE746E2B08527DA C154A6E3589E3AED 7AB52CE8A1028A61 FEB529CC7026CFBC 486D2157559B3167 6B37E123874FD637 2D0DF5A0D5DC5466 0A84C7C05758208F B1FA2A65A68B3579 B1F9D85127792C16 051BF7FDB5046B57 B83CDB56767CB3BB 8ECB8D66F1EA1FB5 4BB363D43B23CB06 603EB5C684EDDBA3 5A150FA7C025EC8E FBF6C87D866E0CD8 CE18B3CE41A95E05 2F243C806FD7357E C780498EB6F4C2D6 6208B00C103E4134 061E6203BCD88504 49B6E041FB5D01C6 6446B43F925F365E EE76E6E317691678 4B307989FC5B4B64 42A8CD9B7500F39F 82D0533886A92886 B60FF26A41628642 23FC6A59A9E55D91 45C38531AECE978F FBB1EADD8F99B2F4 705F9E1C215E2DC2 635F733EEB4535AA 07F3317FA2763FA8 9496B004BEF390D7 C00212ADA7C72A1D 2FE2FA1F9BB1A0F8 5A308F16BDFB19E7 575D67ED8145B6C8 D1E78B1BE1F85879 FEBF0E04BACE3DBA 1CE52D1B0068771D 73F97D8E7F2B086B C18D1344CEB4BC06 62AAEC418D65588E 8358DF97575A59E5 EFB70503344CDC5E 5DC14F37C6099908 BFA722059ABD0415 F8B6D21F4A8E6539 0233E72697D9CA0F 21C2F6E38FA79217 C237DA0BBA84067D 8E2E6D981A0EEC28 CA2D72C9BBA31A61 32F95C60606AD3BD 697FE5A388B25146 7D75BF95D0B2CFF1 14B4B77BA6727628 49FFC093C98D77E8 2696849A0D2AA524 B9B344DF9EF9FAE7 599F6CAEDFB0C1E0 3AE4A9D710064F79 CB95B7B087F554C0 9E3176E38E06E2D9 93791AEB307DAFB4 4DF0FA90EB7BB990 C4E8F30F3CE68318 7C0102E23FB4FC4C 477BB8FFA93B28E5 171A281CAF271AE3 D6F939D92EA7373C 4BF713E28A8FF02B
  • Read the ciphertext. Strip whitespace: 2,448 hex characters = 1,224 bytes = 153 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209031832 (name+title). Key = MD5(password) = 570ec5a773b3400e34a856fa9e8dae7c, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 38 GUIDs as hex (shown below).

Decrypted: GUID list

  1 1391f41b-e574-4ef8-a6f1-5755d5d477bc
  2 cca71424-d435-6750-802b-681354e4607a
  3 c7099719-a973-855b-a563-56d3ecbb38f6
  4 d8f2b578-82ad-2951-aa5f-85d1d2abe9c2
  5 8c9437dd-f7ee-89d7-bfa8-3f52a1b4b1b2
  6 7e068b50-027e-6f14-82c6-d9274f844764
  7 036f3af0-1767-4abc-8b63-e7f02defbc83
  8 550ff42a-2ada-47a1-b1a2-33989f81828b
  9 7d716fc3-4688-6516-8c76-4f78eab33574
 10 808cb3d0-b55d-29b4-b300-40c52cd2297c
 11 f17ed07c-37fa-5060-9b64-4b7f69200bea
 12 1620576d-9ef5-4cf1-8004-1f9f28305b93
 13 c252e287-d77c-31a5-8772-a6bb4d35fd85
 14 a6dd93d6-9c4c-26be-b261-33d6aa356304
 15 59ae7dfd-bb8d-0846-b828-405e661b45d1
 16 e0ff3781-38b1-8534-b510-15c6dc0a454b
 17 19058bdb-41b0-4917-9125-67d28646a527
 18 7cac076f-6214-784a-9e5f-6191209de585
 19 4a2fb12b-04ba-1de3-9a59-03d8ea338f7e
 20 dd4b5377-6a26-88e9-ac46-e500a152a283
 21 3848c3b1-7c95-73f7-a783-a60b9e0babbf
 22 7e344643-fa69-35bd-af2b-37e52ee13448
 23 b6d80a2b-53bd-53b0-aa52-8fa3d5a8a400
 24 821db326-3008-4dce-963f-4b054b07f96f
 25 62d8ab44-681a-18b8-b931-3de710d35b5b
 26 872d8c03-84f5-2427-a244-f00207c86443
 27 9b383ec0-30ca-2afe-b156-24c13fde6a5a
 28 6c11df33-6ba2-1738-b45f-cd8110aa89c6
 29 238ce9d2-33c7-8921-af3a-1c44c691677b
 30 e0006410-702e-2166-af48-2ae47eb17280
 31 3987b3d7-453f-481f-aca3-a006d28165d2
 32 0c58ce70-5377-2e48-97ba-7086f03d6f8e
 33 0a5c5812-e898-3b82-af00-2414a5625dce
 34 9b1c5169-a128-5359-8039-31882323d310
 35 67fd0557-04e2-843e-84b9-0829565653a7
 36 74450d60-832d-846c-b162-81d3cad237e2
 37 da4f3c40-6d9a-0ba1-97d4-01f105802520
 38 49ee794f-df56-6e79-8c52-cd62d0319d01

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 46828644625432084718735412218242358806. Exactly this sequence comes out of new Random(903).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 36 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 38; the post has N = 38 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs