A858DE45F56D9BC9 archive

201209041230 zbfyb

explained decrypted filler

seed 327

Metadata

Post ID
zbfyb
Title
201209041230 → 2012-09-04 12:30 on A858's clock
Posted (UTC)
2012-09-04 03:30:23
Timezone
UTC+9 · title 12:30 against posted 03:30 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,616 hex characters · 808 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209041230) = 1cf271a5e037f42c3a063af7740820b9 (name+title)
GUIDs
25
Filler GUID seed
new Random(327).Next(9) ✓ verified
Run
Run 27 (seed 1,337,299,625) (seed)
Draw
45 · predicted N = 25 ✓
Machine boot
2012-08-15 10:07–10:24 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
4 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

F2CF5E098CDB7836 4BF959446A66BBB9 B4BF9FC3856EC0E7 3F81C1019AF77948 B62FEEBCF13FA1E3 B2A25B49CB4D01C2 24F84D4DC716102B 90996BD637F6E50A D5D4AF65876EFA3A 38EB888E2301CF13 285B888C335DDDAA 33D8EED493031FD3 B18626325C48FB24 B5C7060848897F7B 3DB6FB51EB37F319 9E8F8BED42CBB39C 563B37B5B4527AA5 5D3B8E771E6EE29B B0381DDEDCB002E9 14CDC11A398E3CFD AA40CAE7C1CC78E8 EC4EA58559742D11 7A1AEAA06689200C 5AD7E01296984B86 433C26BF509FFD09 F21CB17F732E15E0 1ECD92C9B6AFA3C8 0908DD893E426B31 DD531790CAE85DC1 FB4C6F595E0407CE 2231713D153C308D AC0964B3F1014484 0BC58F686A56217C BA08CA539A81414F FA302B4BFCBFD34A 3084A162248BDB63 F5BE8C090D16241E 24921725848085F4 6C03454BCC05FE26 385CE5433CD41086 F2899F8CF27ACCA3 FC0757BDD406E1DA 02C24830C709DC3B F7A740A9ADA9E9E1 A5EE8A13A3613635 AFC7892745900457 7C97DE425BC44227 22C25F1539F76388 DEBC1C0DEC8B26AB 119300639AE11EF5 4DDA4BB9340F932D 7CB4E0B76B3D29D8 0F10266C35283D09 6F956A1AED3772F3 64FEB8C10B3EB9FD 95199AEB1DBA91FF 3B29197F8240BD90 072C7A31AA3E8833 809A2D70638BABF3 EFF1E6D3F9969112 9B68CE021A77E2D4 4F42EC7136405F76 F550B8543E128CDF 04CD36CAF8C05964 47091A5BA44838FF C351F07ED72A7D0B 98B4AB0F075D29D8 07B401A04EECB272 75D1A57D4D96AA9D 729CAF15D9DF7073 8B4F8A07251B8A91 CEABE23D0EA41A52 87A44054B777961A 9CE62BAD10B957EF 58E3235E8E514905 11A2EDA756976924 D5D1C27CF5E7E852 574D87BFB5920CD7 8470DB043CD3BC5A A1D2314FA2AB8095 160D87AD4CF509C3 BBE7C757DA43042A FAD29FEC9D22F2B6 7AF63D6F546FBC38 7428121B5C05C291 8018351D0F641233 9ED9B7ED4364766F 88C02792613A66FE F1E73E5BEA04126D 077096A35B040685 A2142BACEF15533E CB8AEFA0A8244CCA 630E12DBC9DE90E6 E4FF8CC74B87DC08 70D7571772FCD715 B91D891391B7B148 22CCE4EC606DAB1E 37CD71AD89096798 A55A3C991D53103C 2EE61A56D3BF5F84 B3557E5A9FA01DE8
  • Read the ciphertext. Strip whitespace: 1,616 hex characters = 808 bytes = 101 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209041230 (name+title). Key = MD5(password) = 1cf271a5e037f42c3a063af7740820b9, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 25 GUIDs as hex (shown below).

Decrypted: GUID list

  1 573af84e-3763-5e09-ae04-00b3c1c61710
  2 316de7fc-f019-6b39-bfb8-21eec86e0472
  3 f9f17d66-46d3-3265-a2ac-c81e39d661ac
  4 21fc79b3-7848-3bac-9a09-1de14930c7c3
  5 f682e1f5-7d2c-7acf-9fa0-f8b467be55b1
  6 04051774-4b71-2dc6-b914-30137ae69791
  7 3aef5e03-3d7c-36cc-a146-d56650bc902f
  8 28c401cd-a4e7-41d2-b3f2-1ac14bc0ea07
  9 7254623e-959f-324b-a80a-e6625542760c
 10 4e8e056c-b579-7a77-98e1-0900f5320a11
 11 4c896b03-0887-1c63-8811-aa792b20d20c
 12 edd32556-0ba2-6299-b6f6-a052cd81f2ed
 13 2179d5a9-aa17-32f0-b5fb-af38b1129d06
 14 b45e2a69-cef7-5d3c-b8e7-1767414ca597
 15 49dd29d3-ec6d-7c6f-85cb-40b747ab62c2
 16 faafd88f-75b5-2a03-a65b-80da5bb5bafb
 17 fb57ccd9-77be-22d1-981f-6867fd61e66f
 18 fc486d95-1051-69ae-974f-2320bd8971e3
 19 37cdee21-bf07-4864-ab0e-dcea84f9aa68
 20 1de0923f-dd65-8876-91f9-b7e904bc8756
 21 11f888b8-b5f8-2257-b72d-f3074377ead5
 22 3f816ed7-31f2-0bd6-bde5-5646718db2ce
 23 74b43844-8e14-2337-af5c-18b8a1ecaa3e
 24 23d7131b-f45f-2744-9fcc-7e7416d31e98
 25 89d35b3a-c648-65b0-872a-1840d3ad9197

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5633723437163572264820226. Exactly this sequence comes out of new Random(327).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 45 of Run 27 (seed 1,337,299,625): new Random(1337299625), Next(8,64) per post. The RNG predicts N = 25; the post has N = 25 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:07–10:24).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs