A858DE45F56D9BC9 archive

201209091936 zmid0

explained decrypted filler

seed 957

Metadata

Post ID
zmid0
Title
201209091936 → 2012-09-09 19:36 on A858's clock
Posted (UTC)
2012-09-09 23:36:02
Timezone
UTC−4 · title 19:36 against posted 23:36 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,552 hex characters · 776 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209091936) = 96f938b9111a1b9f7045df7d7472beda (name+title)
GUIDs
24
Filler GUID seed
new Random(957).Next(9) ✓ verified
Run
Run 31 (seed 15,917,281) (seed)
Draw
16 · predicted N = 24 ✓
Machine boot
2012-09-07 23:34–00:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
14 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

657664FB7035C33F 2C1C2454F47C2EF8 4F6E89865A61DE0A 7083FABCB766278D F391A8428750BAB3 A839819020F44689 A3448509E4690CC0 942AE5F5BD7ABBF9 698F58CC04C45326 14F98D3D823B68AC ED22EE66B038203B 00F95467E19F5726 F0A14EDDD0336227 C0B40A0374679D31 0B085CF85C37D63B A6A5A9536C8B656A 18DFBC58C7E408ED 74FBE89C5C2E87F1 AA1A296200A7106C 2D847F0F9CCAD963 698355F81865473D C71035F47998BD49 66251B9FEED6D9C6 5D52CD90AACB5725 0CBE439A71902406 467DD14B059A4AF0 6E037DCC4494447C 943EEA74632340DD 5AF0AC61D81240CA 503DEB443B2257C2 032B998B380B8F3B 31029057F31E787B CA9303CB2A5999A0 16F339198F9ACFFE 34E7D76536C04BAB 06DE9F6FDE8721BC 36350ACA3358BB29 3E74D455324D92F2 5CCC965BEBA56625 284818A412A07336 13EF935BBC3567AD 384DB77194BF9378 8196F0D605BBF7CC C2266C6C4E62ABE3 AEF40043FEBC532F BBB56D582D8DDCB9 346C9F3121267916 DE00E935044CFA87 7BDE9C7C524454C5 4A939BBFF64730F1 A62A1A693EDC5240 B8732C411B8091C0 8C23BD94553A1E97 363F7CAEE5C42B43 F6BF7118D3C265C1 98C3575BDBE1AB8D BEB54428B9B90C92 C26C983A16090846 77C19F1DA52E994A 88816078D532DD8A C9EA50A30690527A 210D411682E6CA16 8401CAD8653A60DF E08D505314305665 0AC79E4AF9D3DA4E 529C6EAAA6BA2EBD 27FF655F4B6D47E6 D884EA41D0AD32A5 F94689E12FF82ED3 1B841630763CDD40 56AAFC80B4097193 3D33F5C44A198D1A B54911E05411E8E9 4337392F26761804 28E39F24FFFB1DE6 BD22639900DEF84C 8615840FF622E66B 7A8A465831CEA4DA 36C0A61D0752E9F6 3C9B7800DE51D0CA 1BB9787B9730BA56 7867124A83C693E2 E73DEE98FED96027 9D824CCCE7F96867 6EE26693582118C9 163B515C7C0FDC6E 34CD28ECB63DE069 88EB1A2283A8559C 25E8E78D0E8D8306 F56427E51E766CE7 0AAA32DE69E73D43 5DD3AAF1A21678ED B4CF84BDDA45FED3 6BEEBB890B474C75 14CF2AEC455F3054 3C0AA72F993961B3 9CFA98CC8AE82C6A
  • Read the ciphertext. Strip whitespace: 1,552 hex characters = 776 bytes = 97 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209091936 (name+title). Key = MD5(password) = 96f938b9111a1b9f7045df7d7472beda, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 24 GUIDs as hex (shown below).

Decrypted: GUID list

  1 dd4ef10a-6108-6fa8-9397-06b0941fbfaf
  2 4714ee54-5acc-5d02-93c1-43859e8b137b
  3 1d8dfc56-621f-64e1-b77d-8d6c771251e4
  4 600ad297-3688-78e1-a107-dc28dd7925c2
  5 705bc803-b435-2c3d-a32a-8c344ffa6d06
  6 43bd7dac-4eba-78d7-b85d-5e5b02722bb4
  7 a8a5e418-02e0-6477-8cb9-c5aefad372c8
  8 9ca5440a-db6c-49c4-854a-f0b9fa162442
  9 90e1dd76-bd1c-3df2-883a-368fccc79963
 10 8dff8b19-86ae-1f80-a528-e723308882a5
 11 37c3b834-b6bb-3d2f-a582-dadb3d862833
 12 3bf5db61-df79-50e1-b930-4b2ef8d4ed87
 13 58363819-b8e1-4f87-8f6c-a0c6e3e5af41
 14 46e0ed63-d01e-387a-9208-d683d2d88e95
 15 a384f41f-c812-7cca-8c9d-96e4fa9885c0
 16 8e301744-d362-6f5e-afab-429244f0752a
 17 2c521b48-e56c-19c7-b654-5b2faa42de08
 18 24bd5c78-0a9d-35a7-8512-d2f9c542d196
 19 18212451-a8eb-5f12-bae0-0e1e2993328a
 20 4269229b-185a-7ced-97e3-3efb166ef570
 21 4c67d36b-0ded-8b55-82ac-754e20e54b76
 22 33bdcc3e-0501-511f-b742-f5ba9ae0da9e
 23 38b45fa9-39c8-6f41-ac4f-4db4b8e82d38
 24 e4e10170-8bff-3625-a082-d4bc1516f2c0

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 656727643135437613578563. Exactly this sequence comes out of new Random(957).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 16 of Run 31 (seed 15,917,281): new Random(15917281), Next(8,64) per post. The RNG predicts N = 24; the post has N = 24 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-07 23:34–00:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs