A858DE45F56D9BC9 archive

201209052300 zfhzh

explained decrypted filler

3DES(name+title) ECB, 28 GUIDs, seed 860

Metadata

Post ID
zfhzh
Title
201209052300 → 2012-09-05 23:00 on A858's clock
Posted (UTC)
2012-09-06 03:00:19
Timezone
UTC−4 · title 23:00 against posted 03:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,808 hex characters · 904 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209052300) = da7536b4a9a83d2dd8af57c2062af953 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
28
Filler GUID seed
new Random(860).Next(9) ✓ verified
Run
Run 29 (seed 1,844,859,734) (seed)
Draw
7 · predicted N = 28 ✓
Machine boot
2012-08-15 10:32–11:32 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
0 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

8C7401A86D9D4723 5F40CFF64AD1E151 3388D0FB7F8E9C22 FCBCA34BFC0F6A37 BC3C5C40780C8E97 0E093342168AF16F 993A92AC52800EA5 4B658A170D106172 48D327307C06B8A4 6147B347FFCA11F8 B7BFBBD0C08CB5E2 5E00306CBBDBE086 24765FF45D110B22 27369A5A2870F421 4635E50F202E6D77 EB69C1500B0EA881 BF1E344BFDFAF843 6915D5DF21DC7276 25D52AF22CC0E806 95CDED8670886F2D 209455F20CE66E29 ADE1E5E12222F87E D21F0356D44EB0D3 6E5CCA30FF2FC21C 3840952640F0A620 FB1C4C8E646E9C2E 4B285D5F8F2F2421 7DA86DEFC4100C6E 106CF12AC7EB3449 65A39BE17102C595 866ABD4101A27107 49957F7ECEA2EBBF E2F119C339C56646 6877A0EAFB9147EF 1B5EAEE6DC6530CE 371A3EA1AD9E6F04 D181536E1396366E 70ACBAE33DDC6930 7BE9B762319FE937 D846F101324934C1 B4C411161B5441FB E52D4E30EA4AA42A 1685EC82C35C48FC 05D0AF9ADDF88361 4D283331AFF6F99C CADC7B09EEEB7D94 0F34117CB0729BE5 8BCF24E7AFF3B781 8903DB05354B67FD AB524591C16D6DD8 FDAD5CA0C03D7781 B454963875647FDA 534DF9151D0208F9 8F57F0CA525E88EB 0D1ADFCA79147BC1 0943A6E4EC52C04C B2C4BB406E92684C 6C50AB7F44EB0329 F48D25FEE73FDB74 FD6BF10769A980BD 86CB6336CC9E7AE3 F0E87D48D53D43E2 EB8B0EA5F74FEAC7 2ADDE1A972437962 FD758E1EAF39AD84 EFDEEB64B163C900 DC5D442862C01078 5C8BEB9258110F51 8162533FC1D5A49C 27B48802ECB07A6E EEE94EA325D118D0 858AC8E3B3B68364 07C9E6A9250A8400 4ACF0D0541E1509A 4519CC521E583DD2 0A457339AE7344DF DDA23705449C045F F56B6145F234F5F0 963D18A7CB943832 BBF3403D0E25A304 2A852F2C4BB9BAE9 2F025876C953267C 3B5955EA08B168AF B9999B3C30E90411 A2CDDE4F10A4988A 1E7501D9B75A81F8 335C9F87084CC018 5212F1A3E6DA42AD 15E0FCA15D1D760A 76064C4119D6BB1F 55A866040B371ADA 09253DE6582BEB05 B6D7A11054F41DA4 C2DF5CEE1CFDD904 5ADE0399C31CEDD8 05E43B9D6813E5D2 0F41F8561737F26F 8859EE80817B0F1C BF6B41BE84327FAC 2E5CE078A9B6CAE6 4662784E98D6288E BA9F13B97C052E70 74FBBC13A6507F1C D058C274D9CE7303 EAA470C646277591 6BB4E4EEDB0241F5 264DB1C1EBF42A78 E9ED188A5199C49A 439AC7370C071B7B 3C4DFC3006513266 268DA5373BF38613 D8375954B625C90A 18B0060114D9BDB1
  • Read the ciphertext. Strip whitespace: 1,808 hex characters = 904 bytes = 113 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209052300 (name+title). Key = MD5(password) = da7536b4a9a83d2dd8af57c2062af953, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 28 GUIDs as hex (shown below).

Decrypted: GUID list

  1 95806af8-4917-02c6-b465-221a5114e9c6
  2 17147b86-d71e-1e47-a822-bf73a727e7f6
  3 9d6e90cb-b551-88f7-8c1a-0677b1775f5d
  4 45b7baf8-c563-1a60-a81a-7cf4991fd0d4
  5 127ab54d-e7d2-4901-9a2a-038368529449
  6 d21f63b4-7bb6-0f1f-ad39-32c2a534484a
  7 bf9d7a3c-470e-2837-b507-3b0d2b569c4b
  8 476c7e67-a0c5-8e8a-967f-2a35052cd0a5
  9 dd4564be-375a-3e20-aa19-7ecd1166c4b1
 10 6a1b9076-e25f-3630-bdce-14e9c2532fde
 11 2cc1a638-c762-7ee9-ac54-1428aba4a20c
 12 303eecfd-af14-7aa5-87f6-fb6a4cffd467
 13 037cbddb-8a35-7536-a24f-a17de95ffdaa
 14 d8d6553d-33e0-820c-a3fe-27defb0dd74b
 15 6437238e-e924-84d2-895a-ab200c5eb062
 16 adb3f860-b3e3-1079-adc8-07a2d7a7941f
 17 0389e5c9-926a-3c7e-87b6-dbba5dd08dc3
 18 b3b6e63f-5d83-1e91-a105-0ac1194e903f
 19 825e6f82-9618-8bcf-be5b-deee1f050e7c
 20 31fecd80-6c3e-23a4-8394-913139ba5b81
 21 6459c6be-8714-05bb-8934-d026bfc684c6
 22 61288018-b3fc-7721-99d4-7839927b6a53
 23 f4474245-0872-3f99-a6f1-84aa1ce654f4
 24 3982f2aa-41f0-455a-bd65-c50e81cbefde
 25 85bbb08a-b202-8962-a9bf-2bf79eebb043
 26 df983fe0-be9f-5b6a-af73-2172399bb21b
 27 377727d2-459d-275f-975c-1435e34ea00a
 28 bc7541ab-b89d-4bca-a1fb-c99c9f7ec853

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 0181402833777881318207348524. Exactly this sequence comes out of new Random(860).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 7 of Run 29 (seed 1,844,859,734): new Random(1844859734), Next(8,64) per post. The RNG predicts N = 28; the post has N = 28 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 10:32–11:32).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results