A858DE45F56D9BC9 archive

201209041430 zcj5x

explained decrypted filler

3DES(name+title) ECB, 25 GUIDs, seed 909

Metadata

Post ID
zcj5x
Title
201209041430 → 2012-09-04 14:30 on A858's clock
Posted (UTC)
2012-09-04 18:30:05
Timezone
UTC−4 · title 14:30 against posted 18:30 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,616 hex characters · 808 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209041430) = 377ae2de60268332977648e9d713f5a3 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
25
Filler GUID seed
new Random(909).Next(9) ✓ verified
Run
zcj5x (single)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
21 · 6
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: single

From the post to its content

As posted (encrypted)

CA6C2E6F23DF3E73 958242BD48ADA8F1 3286B3EBBB7E7A0E 2980481F1D26E93A 816A4C9B7716F984 FEA0DB3D24D3ADE2 AF724E008D18DCC4 1CF9431550ECD824 41FBA50758A74DC5 3530D100146617E3 83520CD5926A7A6B 9A0335684ADEAE30 9C3BDE89F4659E3F 6FDCFD5A1224BFA0 ADDA5C7A1C991D52 80A1064F4D6A52FE 9E5466A55ED00329 7CB6CB8BA0CF0991 5A849629AF35E816 67E35D0074CDC698 EB32FBBD2E8C381A 1E17C13C280182DD CFDF58E4501B9382 45ACB37BDA9FD360 DACD61174A45FBE3 CBED14B1F9CB2003 8E3C1E52B3240F42 000284E0450BCA4E 86C1C710243C2B15 72162C922FBC3C04 5FC4AF17FE0203C7 76C8EC819C638D6E F68BE8601B226D34 78155AD6B6813612 0B62C87BA7CA5E35 731CF95E99C5450A C13B36791AA90104 47E6E8A2BF97EAEB E4429A4264E8CDAE 070360D43ED5ED19 81277C72A0C23E6D B657E3C3C9CB98D8 CD98A27AB2C9D653 DEF0552F5AFE2F71 3A4E48D4A9827CD0 C973AD8FEBECB594 55579B0768544B15 B82D3EB477482ED2 AD550DB42C1FC794 99B25FEF013C81DD A8B53733408B55B4 5E0DED5A625785A5 23A1C905C298CA4A 473343CBF6214149 14E525086E65F1F0 B68BC335A7A23512 CB4CF00F905808C9 671F5C51BCC5E442 2610FA5D551CEC12 144A3BB94F95E4A9 11B7EA8D042CE2AE 94DF06C0E9B25B81 D3CB682608D3A591 7EC88AD77D0108B6 DB07D81561DF755F B5AF7715FB601FAD 408C2F899C295A4D 44EF92A0B17E998F 71504C5E31FA0424 A88F5C80576EDE7A 46B8702F0426E878 121CCD169423CF22 4D612E3CE85CE3D8 04FD48E42710EC7E 112053A9B7F628DB 68C2920F420B294F 79D1D086BE879676 E165DC243082C9D0 D545DCFE9798CCE9 3E5956EC90E15D27 CEA4C417224C51F7 6F60CEB8258C172A E8EB0173EC4D09A2 192265C135752B3F 24D17E61376FBAAE 4FB6B12843BAF335 5D6998DB8955CC10 A69918DBE14A8332 F333F36610D96E4C 0145F5255B7D7B6C 599B36246F58514C 49006A74D2374667 9347D498C74BA878 A93D5F9B4320D056 EC90204FBCE774E1 C5E58AC96FE8925D 470EE66477FCBEA4 3A8CDE90C26F84D3 484685470B99A9C8 81AC255B8A3E0A55 5F7D2A2448AA0B69
  • Read the ciphertext. Strip whitespace: 1,616 hex characters = 808 bytes = 101 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209041430 (name+title). Key = MD5(password) = 377ae2de60268332977648e9d713f5a3, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 25 GUIDs as hex (shown below).

Decrypted: GUID list

  1 e71f47b6-337b-5720-bff6-bc52aba843d3
  2 ee1d6724-a19a-4b80-9626-c2e0c6b6958b
  3 84b5f92f-30b7-1989-95de-2ccd524a9d3c
  4 a5278534-0989-50a1-9cdc-9f7661aee830
  5 e4d441c9-6473-5b07-b1c2-b6851ef44d81
  6 98b74138-ff2f-813d-b271-f1be2d0bf64e
  7 600f89fd-4b1c-1781-ae67-c4a503aa08ac
  8 442f9ae2-3f06-41d1-93e5-7d30b473ec39
  9 d1dd7df3-2ac7-3cce-8849-38a7d3436986
 10 71733437-4a98-4d4b-8ad8-f9032e201701
 11 f79cb641-31e8-80be-a26a-fccbdc26f8c2
 12 325e87d9-4854-15a7-a76d-d982a091ead9
 13 054f97c1-ffea-470d-9536-08f539338a86
 14 88a734a7-17af-3045-8a20-15de90b78d68
 15 6df09975-8df9-243d-9926-ab9fd5482dc9
 16 bb4f6544-473b-6db5-ba8a-e4c981037f0d
 17 8a962239-5e1f-89ce-ba6a-c86e9064df1f
 18 a6dab9a5-11aa-5176-b635-f1864c4b2f10
 19 b051437a-621b-2ac0-9a5c-f024b3362f4e
 20 589b23b0-1213-2084-945c-1d15d92182e7
 21 0846bfec-05bd-541c-aa6c-554a2d7345da
 22 8bdd80dc-12bb-7cb4-be0d-41215a37f285
 23 e101c5d5-03a9-57c9-9983-d7102c8d967c
 24 d305574b-4088-579c-9a7c-ba0bee0a61e1
 25 a5ac8627-b225-79c9-903c-b4c1390997f7

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5415581434814326852257557. Exactly this sequence comes out of new Random(909).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in zcj5x: single post 7 h before run 28 (zdac5) starts
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results