A858DE45F56D9BC9 archive

201209070630 zhriz

explained decrypted filler

3DES(name+title) ECB, 33 GUIDs, seed 217

Metadata

Post ID
zhriz
Title
201209070630 → 2012-09-07 06:30 on A858's clock
Posted (UTC)
2012-09-07 05:30:18
Timezone
UTC+1 · title 06:30 against posted 05:30 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,128 hex characters · 1,064 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209070630) = 6c33b0bcdf2c814c2c13a31398bdd4b3 (name+title)
New here
Missing from the community archive; decrypted here for the first time. (new results)
GUIDs
33
Filler GUID seed
new Random(217).Next(9) ✓ verified
Run
Run 30 (seed 1,932,335,625) (seed)
Draw
10 · predicted N = 33 ✓
Machine boot
2012-08-15 09:44–10:44 (seed = uptime at app start)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

2E20AF3401CE525B 72648685A271E872 420005B127F73ADE 4383E854DE0BF832 7CFC43304B3EBDE8 2F48C85F16DE7D54 6C86B23D65705994 945C453922F5FD2F F2339FBC6813871D C61BEAA90F60F70D 08E5BA2F6628C900 B55F95092AEBD7A2 8AE183A681356B73 867378FC959469A4 7BF14812149A779B 9526283BED0DC879 20F4A3623D970E2C CF6B688492F3FF02 52724F15F21808A8 A8BB249F831A71F3 6250E2404F54BEF7 DACDC02F870C9180 DA555CFAD39CC8BB 13DE339091145291 BAA212B0DFC6B95C F65F771F428C6207 22758BC8277E8FD9 23D0AC593CBA3C53 96F2778846453676 D74A7AE27DFEBB61 B5185FB910DEB522 AA7EE48860B69B15 9860F26D1DA882C7 074CDD1D8A54F745 52D2E9AEC346220E 954C5A7415B60D2D 04A82526BF933025 C036A1674E5D8B9B 55E1319A781B3E2A CCAE90034FA21F92 5F6C355A5660DD64 0AF4B5730ADB749D 5E399D2322EA8E3A 48F77AF84CC425AE 28591B8AF086BBAD 73285C271289845E C33EA51B6C10CE53 CC0F708F0B9758C8 A08E75193B2BAF2B 7D302D2B2D7085BA 846470F4657FBC1F B1EB56AE7850B8A6 FBBC508041403DCF DDF7D1490769E575 A5ECAF342E31A7CA BFC8EDB56C4DB280 2537C2C42F4CC34E AAEABE95CB3E0392 7D0BA5AFE2FF1782 CF4BC73B79D89C90 C520DC386B8C822B 0CB951C77547AE0B E846014FED034F10 ADABF93AD6619430 3D236D740B31F06F 811C060EE79D6544 81FCD8AFA95C90D5 E935624C1AD07FFB F54B621C88471E1C B98EFA0DE51A89DF C02577E06C74AB6F 8304C356E2A648F6 8EEC8DAE64D0E666 86ADAFA670A98696 847D24678A921E3C B52FC5BD8117E336 F22E1A6BAAE951E7 76E5802A653F6E3A E4F101EA4E3E63CF 6CD5EA678A597166 F155B1E7376F8110 08EB00AC992B6EE9 BFA352B8B71D9906 12F984316DB2A4A0 50482115E090BE1B 02C8F321D77701F4 CAB21DC049C494B4 2D5ED358FA45B0A8 1F07501514DCC5DE 6439E47EF9DB61CF D29FB6A8EBF53953 C6D1A41F1C0F5C04 E740A2755D5B61B0 7AFBD0C0E3546D56 7B514E84EA8F1CC4 808CC2036FDC4CD9 4CC6E30C85A44CDF EC5BF67D1BE16178 21C0BA77BB9CF2CA 1B1AB3D8323A862D 61C34787963E3489 2B99D8B89928F4A6 1664B64A9C7BFC1F 0270CB6A4F0D5A1D F16A62D20707A1D6 6A68F2FCD7CD1705 410C279D20E8DA39 5BBF4B70D6FB19DE A12282C53C3D7260 9103FD819D1FB31A 5FB33D6DEEA5E6CF DF3C4FEF4F54F581 CF2139E6E323C3FF B3A2B24F5086594E AA7F96975A6BA148 2E6FA7D609879417 576EA73C0F37594A 11F722D2E834F4EA 5942BA2BE56C3F8A 81FDB4BA52E4DBDC E3CA94205B8BC91E B32EBB0A62F84846 CD48A9BDBDFB47DB CA1A70E91B39D3A8 5C8299879CCD1ECB 5AF3E315B70ED81E 79D8C48E51513056 E44E9F616FE88497 C13FB3F3D7E41C62 752142D748A3E838 02474ECFDE8BEB4B E1A8763744A55813 70B868F569D4219C
  • Read the ciphertext. Strip whitespace: 2,128 hex characters = 1,064 bytes = 133 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209070630 (name+title). Key = MD5(password) = 6c33b0bcdf2c814c2c13a31398bdd4b3, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 33 GUIDs as hex (shown below).

Decrypted: GUID list

  1 6a27565b-c05d-0d5a-95b6-6d53fd0394f2
  2 316c1ec6-0008-4092-b8a5-c8d9ed026111
  3 5f7b523b-dee7-443b-823d-b0edcf4a5bc7
  4 d60ad1d1-dba7-7a0a-bf60-db35a8567a58
  5 a2c2f1d3-623a-1528-a28c-c18fe5e9a717
  6 8f245b4c-9ae9-1ef0-8230-8d7c4df1ff1e
  7 5af3cdcf-ab86-1641-877c-311ab3d58113
  8 b594b071-da16-234b-a1db-27f13f31c3ad
  9 9e0aaed0-e091-7323-8d93-30c1e81e3505
 10 d46123c0-5ded-26ef-a889-3062b62b813e
 11 75cbc7b7-fee2-1fd8-83f3-791e40ae6ada
 12 023589bc-73c9-7fcf-a867-52edfee31d63
 13 9aa313c8-6647-7ee9-8fd3-9ec6b5d0b1ad
 14 68926f7e-3296-32eb-a411-10dab9c251e6
 15 6a718f90-9712-7a8d-873f-49b2c8664b6e
 16 84d05559-2d1d-4a31-9700-c17a4a4fac6b
 17 3948106a-643f-031a-812e-fb560faf4aa9
 18 943df512-9685-4e5d-8593-ff5638e245ed
 19 54b0a94f-e86c-450d-bb06-fbf692938c0a
 20 7d81730d-b7b2-35dd-a895-24994d5119dc
 21 e59ec316-2b20-5743-84f6-37b625ba571b
 22 a5ed134d-ca19-076c-a25b-e47ec7ee772f
 23 a84096ff-2bdc-53a5-8aec-0945a35e05f3
 24 6c3aa51f-c0ba-7cfd-97e0-06b3211114b4
 25 50acb99d-03bb-8a70-bfbc-a49358877204
 26 85aaaabb-5173-0a91-a7d4-b5cbdae912a1
 27 bd3bcd28-e271-4332-a73b-d4a2e2f03a25
 28 ab264033-97a0-1e1d-96f0-fc2ad019440e
 29 b7fdd65a-72f0-425b-9e3b-24861b58938e
 30 685d6924-d7db-77eb-b1e0-b9a04835deb4
 31 ac3ef2c6-25b1-2fd7-95dc-25ee4199a57f
 32 af8dafcd-16a2-5f23-bf8a-e63427b014ab
 33 1daa4137-0313-511b-9829-6e8558206c97

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 044711127217737404435057804147255. Exactly this sequence comes out of new Random(217).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 10 of Run 30 (seed 1,932,335,625): new Random(1932335625), Next(8,64) per post. The RNG predicts N = 33; the post has N = 33 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-08-15 09:44–10:44).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs · New results