A858DE45F56D9BC9 archive

201209070330 zhh97

explained decrypted filler

3DES(name+title) ECB, 36 GUIDs, seed 558

Metadata

Post ID
zhh97
Title
201209070330 → 2012-09-07 03:30 on A858's clock
Posted (UTC)
2012-09-07 02:30:12
Timezone
UTC+1 · title 03:30 against posted 02:30 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209070330) = 182c6d82bf4701b555a08a5af9a2e342 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
36
Filler GUID seed
new Random(558).Next(9) ✓ verified
Run
Run 30 (seed 1,932,335,625) (seed)
Draw
7 · predicted N = 36 ✓
Machine boot
2012-08-15 09:44–10:44 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

25D416DD4F4481CD 325629F76BC38069 E81D55536A573667 1A745747958C5D1A 967E3BE009DD27B8 7C8EAC14CEE26B3F FA75CF24750E82B1 77B61C4869CDDA8D 36850C1DDB6032B9 8A8957F853503C5A CA4C0A8C360DFAC9 A8BCEB025C0528DB 3F8CB340939ECAC6 CCC92E1F16D5DCC5 543E65B306346653 E45F0E2677E33588 5FCCCA397C6C400F ABA0BA046C9C61EC 5BCE59436F994310 F1317B2A8EE6908B AFFC2370311087DE 3B33F33FEB835ABE 8A49A368CC522455 7804765FB97CFCCC CA15B0A126C3B064 60E4B3FEC0E24122 EC08B691F5BB89D9 33E9AC7AE8FBD8EE A6D06DD5D596CD4A A6F352104B009B42 52892D5C06D54FA7 F8A4BECA1F6C35C6 D861C6BBD15D8B0A 1300060FB7BA3591 10102EA32835C3F9 68A68336BB4FD97B 2658424DED6E6C8B D7EFF33850FA9896 A27EEDD9759A8183 42EC1F362341A2F9 1567124B286EF0D1 2098FE27934FB823 75224D10F5F7988A 39F50A7926CDA3B6 75808E40B7D19055 F8B9F50A11F145C4 D5C7AFA7C9034FEF 1BACB44ADD32E102 4704130A20B736CD 502A1753342A55ED 7F1D6F7F193817BB 13A621DDC81AD179 363843EDF6B472B4 DA86C480F2A447C2 0AE02DD7B56323BA 036BEB0CF265C339 6A09B915B57919A7 6E1EBACC7F093134 5FAB958FDF770250 B5468362B4EF5ED4 6E5151B6D5C98D6C FD76745E3B737532 6C9262FF9CABE075 423712209DDFE4E2 611D8714FF9242FC 0159CD9DA602218D 3A7B5E77AD8467D0 C7343CE2550DBEF3 AC79DAA7FD2B0853 58F5E6137C8CFA4C 56303DBBDC03D22B 5CF544F8EAB561D2 8E101B3C83D0FBEB AA73B52DF9165507 FF888CF348F411A2 8AE4BE539E1B4463 1CE74DBE0DAF09F0 19820B3180174C59 D31405BA6D39E5F3 FB09769ADC52E4F2 BBECFCDB99335A3D FCE2C760D82F9CD8 7C46F3A583ED4D69 6BEFFBE23A70CCF8 D64F78C4669D287D D064EEFB8602AC7A 0F2CF8A702D532A2 E9A6F5EC87F92500 EFD5CF03A3A23A2C F01B16F2A6E9225A 3B09B1377B361860 31B82A14645837C1 1B2DA77136FA4071 5E00B2E46CCE5FC9 F56E232C70AB27A9 35AC9473EC0CA77B F8090A5C016B2657 30D01DEEE25ABED8 539B4F7C3A7BF60D B4C2E7FDA5AD1128 33C7939228E8FE2B 919C5EBF46C34AF8 CB6EBCCC94FAFB3E 7E3206F1832BCDAC 8A3FFAEB13CECDA0 F927FEDCF8FF48D2 47695207C4BFEFB7 F9B5E97EE47A8F83 6824996B3DA0E4FA FC6026941A7BA1E9 13BF6ACC3175BDD4 778ADAC4B8197421 717B1850A036DDAD 4FB53086AAFC83F6 8A582CD23D592384 1574BFA7B6186E25 03DFBCC90BD5BF00 F12A489C8A06D84C 42B404CA5CF4CD0A A15F800056A5881E 80FB2D6D27E3F74C 0F999BC081F54CB8 4EDD72F5ABD9A9A1 48AE87B97F38492B E95E1A93A736672B 175C0FD6ADD773DB 36D6B3C4AF5DAB31 CBE865E1F34A4521 97B1D0C2146DD3E2 DBAE5DC5D2FF3A08 A30712697DB32E5A 0D3E263D1E140BA3 D272AD5D21D694DA 7D529E79357A5C89 F452C7340DB2BDE1 6A6121B0025D8FA4 38F71FF57FE4AEA0 CA44D1A6D375FD49 C3BB660C9A577D88 8D6EADA1304E106A 0A03123FE42E2DB1 DF6266FD7DBC7F2D 837B644DE17C4C41 1B45D07EFA579749 1DA76EF8727FC026
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209070330 (name+title). Key = MD5(password) = 182c6d82bf4701b555a08a5af9a2e342, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a2896037-9916-212b-9209-56742ede75b3
  2 802274b1-b7f4-40f6-91fb-b3a9491df192
  3 cb486bba-81c4-7199-a2ca-63a1c63b19d3
  4 d15ba431-4d78-534e-a10f-b4fc85957acb
  5 13bc0d29-9841-1596-ab2b-5e9cf9e7e324
  6 65b11091-5680-148a-9136-9e10fb78d816
  7 8aeff326-afd8-8c33-994e-8fa12c5d8181
  8 e1fa86f3-94a8-36c7-986f-3e1ab0cd4b96
  9 efe7cf17-9aca-0462-bc6f-5fe8009b6495
 10 8fd7f1fe-b4c4-0587-bcb4-8207656c65ba
 11 ecfe3ecd-b630-3ef1-9b65-2da74114510d
 12 8ea577fb-7abd-0f13-82a0-9d74657dae01
 13 a1452581-fb1e-2855-ae04-97890125d8ff
 14 12f098b7-9c24-61a7-88ee-bd4bf02514ab
 15 c8298477-a290-5e80-ae04-b921fad7fdfe
 16 705f02fd-33a8-409c-916a-3f3f0b0acb90
 17 2f4a0df0-170b-3627-a341-499ea45c586a
 18 b8c98d5c-6eaa-81aa-8bf1-0a9f75e7f6bb
 19 b713ab63-3706-7014-9488-c34267569016
 20 a40ac4a7-0212-396d-bf70-1cfa5a845d5b
 21 d8c9be0c-5f30-8cbf-b73f-f1f090c4f7d3
 22 54ba75a2-0eff-6dfc-9438-474561adffa8
 23 eba068b3-9d2f-25e7-9aca-177e5f7c0fdc
 24 534a10b8-d1b5-8a8f-a529-054dc759de0a
 25 57846e7c-63f4-3f39-ac46-802e9aeaf79b
 26 992742cd-eeda-365c-a981-25eefe555f4b
 27 6b86ed6f-de99-6b9e-8f26-ccaa8119d140
 28 9dd5a05d-d9b6-3965-9024-09ed103c1766
 29 199c89b7-de57-6b33-a9c9-879286c0470b
 30 54c98afe-2813-46ce-8337-67f175e46883
 31 809f043d-5cff-1fc1-89d3-cef23ecde2df
 32 ea2a3122-e86f-3cbe-b4fb-23b4bc7ea7f9
 33 0c39022d-a9c6-65d7-be1e-a9d7c3118f14
 34 fdd6350e-f3b5-83de-bfb5-83771f751fa4
 35 c224a4c6-ec38-4bc2-8841-b01bb841b094
 36 bf33e1a8-38da-8bab-a4cb-0378050ef80e

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 247511830030265438738628336364136848. Exactly this sequence comes out of new Random(558).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 7 of Run 30 (seed 1,932,335,625): new Random(1932335625), Next(8,64) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 09:44–10:44).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results