A858DE45F56D9BC9 archive

201209070030 zh5tf

explained decrypted filler

3DES(name+title) ECB, 26 GUIDs, seed 501

Metadata

Post ID
zh5tf
Title
201209070030 → 2012-09-07 00:30 on A858's clock
Posted (UTC)
2012-09-06 23:30:07
Timezone
UTC+1 · title 00:30 against posted 23:30 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,680 hex characters · 840 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209070030) = 53c85c71e0d7c5808a8f01473cfd85a3 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
26
Filler GUID seed
new Random(501).Next(9) ✓ verified
Run
Run 30 (seed 1,932,335,625) (seed)
Draw
4 · predicted N = 26 ✓
Machine boot
2012-08-15 09:44–10:44 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

CAC27E3CD144DFC0 2689B3169213569C 22F90CD0DAF14E64 8EBFFD33CDF3FA14 ACDE2357C73499C3 F59655989122847C 39C00CAE8A0B6635 F9F967A11AE3616E 7A0FC10C11A5370D 75D58EE4877DC9BE E0A31230FD67370A 9B215F056910C82F 272305A000BE01A5 A1F6EFC970EB206D 5D1EBAFA6A7986AF 78BBF07DA8D3EE7A 7D75D389CD95E5AC 5F4B7AD0289EEB7F E131762B2F1A3F3C 735B9B21D7354859 96BC720271B7667B E859849ED9211B7E 746106E041904E8E 98B8E25AA94BB497 A09A08F3296C95AF 5120C2A8206DDAC8 ED20938DA0AC26CB E3E0392D9FB475F9 100C5EC50DBE86BA B5036BC2F7DAFDDA 60A849C2FFEDD6A7 79C07252C10A7543 3A82D8EE1FD33D3E 5B5D6C54BE243A36 4C3060917E4E7C53 8109DB4CBDF6053C 365C54E435A48BE9 6A29EB9545E7B689 4382B3E447526FE5 2C70E5C1F29ED430 7D00B7E25DFEC909 315CFDDD3ACAC54A AAAADDF7EC4C951B 65825D806832BE6B 8D47F57F69B0ED78 43D0FC3AA775E490 4B9E3CDDECB18605 E732CB4B806E5E98 CE6836629F3AD2B0 4E0E8D6033A201DD 53B06E25DF36118C 69541FEAF437FA07 F3FBFC5E2BBB27D2 276F7E49D452A647 4414CB7E0BDC399D 4D4154DF95124992 DD1D4D056BED38AD 98AEBAC511173F53 6EA0F42E0F4C4889 E7EBFB3523407F9C E08C480AE99622CC C9156FC980ACCDB1 00064C949D1E1FF2 D9C5E2444C5B250C E7150A1F2BC22301 CFCDEB98A4ED20F1 D5BAF73E4FCA1201 18F1E8935B2867AA 5316452155F25C6F 6EFC5E56AF3DFF3A 74471984B6967BDA 3FB78ACE78C60708 3BA94BDC046600DD 1C546AD0AB997ABB ABA3D20897A88E96 ACD72B00B8B02A18 0722729827F957DC 90F7C314DCC93BDB D09B65AE9A015967 68A9634EBF5AF9DA 59D08C7F39CA6303 7204F101233370B1 B93661FC4CD244D3 1BEBDF0F0B4432D6 10A9EB71B2172404 C0BF3D14971B0C5D 815C2DDB06189209 B1B0DBF294538D9D D4C0EB0B1DF4A273 BAF989296654A8F5 7688BE122154E171 49461A4D7610FDB5 8F10CFA4AC2B8740 4B2912E4B091E674 1DF11A9EDBFDB1CE 28D05016C0FBA5F7 E4B25DFB03A475B3 F86F49C92C48F9B0 C8CED1B8EBA35E44 5C5D644CA35438EC C6F42D5B647A2BAD 70CCE1515AF5BDC3 BACD01797C8B4A7E 2C57D8DD7BFE86E4 04D9B32E3E220319
  • Read the ciphertext. Strip whitespace: 1,680 hex characters = 840 bytes = 105 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209070030 (name+title). Key = MD5(password) = 53c85c71e0d7c5808a8f01473cfd85a3, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 26 GUIDs as hex (shown below).

Decrypted: GUID list

  1 61fb2d9c-5e81-4187-8046-6ea971fe0983
  2 c88d28b2-d78e-711c-a1ad-05eaea86de41
  3 8078673a-7fb0-8293-9ac7-85d72d302a23
  4 99736457-8254-4f4e-8cf7-14a511c0db4b
  5 7d3d5428-6d22-3026-ba69-05e7db7ded5c
  6 3e371813-685e-3523-99b9-555d1a4b709f
  7 07e73f55-0a79-310e-8f7b-1e226648e5ec
  8 77886a7a-52e6-7368-8f45-0c75ec78468f
  9 5ecaba25-264e-822b-9c48-d1e1b7bcc631
 10 5383f2a2-0761-0700-b372-5df7e73442d4
 11 2c195ac4-311c-3527-a742-9bc59fecd1b4
 12 8593bbf0-01f1-5615-a700-679a7dd7e303
 13 2d0cc8ca-7472-03ac-ba7c-e43a2ca14a79
 14 16486093-d105-1c8f-9dbe-6b6e974aaa69
 15 3a7912a8-f008-676e-8c21-69303b56f7dd
 16 241c5da1-21a5-8c6d-9cb7-80fb4d8d8e81
 17 7d84401c-45c3-47cc-bcf3-ad062d815984
 18 26cd1b14-f295-5ff3-8ab9-1673240992c1
 19 74d5c6fc-d298-2d06-bd90-565728459e48
 20 71aa18d2-ec9e-27ff-b019-0c927043dac9
 21 6c48ffb2-4d0b-31c4-abce-2aba1245ff3a
 22 6c26fcb9-f3db-6c37-bb36-639bba091026
 23 81358a09-59ed-5029-a298-5da6935dd84e
 24 902fc11b-eccb-0bff-8711-3efb748f1b49
 25 522f7c7a-9f59-7155-8c2d-ffe59160d1f8
 26 5b3d495d-60c3-6fe8-88d4-0a82b2b2dde9

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 47843337803501684522365076. Exactly this sequence comes out of new Random(501).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 4 of Run 30 (seed 1,932,335,625): new Random(1932335625), Next(8,64) per post. The RNG predicts N = 26; the post has N = 26 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 09:44–10:44).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results