A858DE45F56D9BC9 archive

201209091939 zmijo

explained decrypted filler

seed 768

Metadata

Post ID
zmijo
Title
201209091939 → 2012-09-09 19:39 on A858's clock
Posted (UTC)
2012-09-09 23:39:03
Timezone
UTC−4 · title 19:39 against posted 23:39 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209091939) = f6838ebe81d2ff4a4845b1a754b8410e (name+title)
GUIDs
36
Filler GUID seed
new Random(768).Next(9) ✓ verified
Run
Run 31 (seed 15,917,281) (seed)
Draw
17 · predicted N = 36 ✓
Machine boot
2012-09-07 23:34–00:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
17 · 3
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

8218F8CE740A573E 35A35464E829E7F7 CA6AB23ED9E0FAAA A148BE847FC2FE8A 1F98B2496B712B59 77E2B59CF5039AB5 2F5B5458A8453CC7 02BF863B8A8C1F5A 541926BE15610CD6 9C8FF97047D93DCA 6B0A8E3C6A7F1254 48EF3C5A657ADFB4 11B47E30B0096C79 9613C7E53FF2F693 57D2F5A26578281C DBD90FD9E543643B 966A6027380A2374 9511065667436F4D 42160B52C4482323 0A8F26A4AB55BBFF F2813BC668D7909B B11BF2D24C305A0B C2849C08E95E7C7F 03D6D4B8FC2A3D00 DA223877340FBC27 7D0FD8297FBA8E2A BDBFEC09256A59FD D885C3F837E38E05 CABC7E4CB80E6B03 BA189E0FDA98D1B2 46718E27A8B36C93 CBCE6321262FED02 BAD318AFB3E22703 A46C15B67A880FE3 73CBFBBC696B599D 4D45091DB066E624 C11FBA9F890F2653 6FE4742227CA4F50 FCA76619D525F80E 5A0C6D3A959A9426 1C9F57A9A8099406 8153EAC1939DCDE4 A98C06EA2CAD0464 412ACDF6F504329C EB63BB91A2DAAC69 9CC6090B45A52932 C7C61BEB362ED49C 76532E2C56F62846 8D64D84F5767639C C7BDAB1F939F9BB5 ED67573A5088E012 8F3573C24BBB2934 727700D2A4532B44 03740395F2E29B98 41075D7C96C0C3BC F2D8766716D1B143 A538F6D0DC1DE7FC 140B4C0D3994901D AA8066391ABB66E9 CCB436DE8896F5A5 21C820BFED8A7D91 10B52C716F0B34C2 671695A84FB8976A 4250CFB630DCF44E B6E06AD808BE5FC1 5751CCAAD3EC0198 DD6FFDE62851281F 764AC147701FB131 02C131E5B9C4C33A A68035059967A4C8 FF2578B787E3B691 B4C4516947196AD4 401CD00322D4284A 8E2D297E9C269C36 08303232C3D89226 30D1A9F68E055925 DB8DFBD57F5E8082 F55F70950D2E852B 2D1C4E104E5029E5 72E431574F99210D BD89A7A0A8913E21 19C284C2E751E274 53850256AA262853 26332661DA812A38 A01FE7B25AD902C5 1B1C9AC9C8DB9244 F349A6505481504A 569E73284B43D10E CC2023CA6498DEEB 958FC21D8BC19437 EE6C4504668A970D 79D68AC40116B739 8DBF7AC3106F3C6E 0FD63BF18BA7C3A2 077946B373806A48 16A1EFE8AFA54F47 36E61DF71FF59A25 2D1DE480769868A4 D32C9057884BC3B5 A2E9C4BE837857BD D5C2181C41890745 0424710A14FD45BE EC6C8ADEE7F5FAC4 593FB4059D5209CD 6B55B7588A9D7561 338FB610DA218E1E 3322CF828EFC1306 F224914D88D0CCBA 13444F628F63F888 74FD1AEDB5CC61C7 5FFDB6FEE5C1B52D 2E2B4539138BF850 A6B984E4D4FA2962 78B63ABBC2F5295F 69C82F68C5538DD2 5E0B99323568064F 7BF559FD1FF4464B 3A93926E191341F4 90C96A117FE9AAB7 7BB5E450945C2CE9 C071BDA269E733DF 8DC4AFFB24CA59D4 5602FE148C31E82B D5FA7887DE7B1070 D5218FF420E9BC8C 7CF395DC4A072AE0 9A56857BB7EED2FA 10D960F660BC3E2D 5DA11B8C04846483 E0CECF5D1D19DFFE 1FB8721ED9FCD37C 52669C9DFCF1BEB6 54615CB0A6EC5C12 CD1B3A6FCB758FF4 9BCC7003B7AF0A08 F24F295BDE9A7F36 3D0C8AE5AF280376 87C01A10357ECB0D 10C16265F85EF8AF 42309166AA3261A8 81CB9BEF55087100 22B8F3284ACA5D31 17CFAFCA890B56BE 680A47F2935CAC28 844447043C6CFDD3
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209091939 (name+title). Key = MD5(password) = f6838ebe81d2ff4a4845b1a754b8410e, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 8bb8c28c-6b59-81f7-b151-68469cf15211
  2 16bc1a3b-b144-15c9-9ef5-2459c915d98c
  3 d29ce525-9e55-56ac-aa25-7551e17a908b
  4 85021d47-c27c-4705-8a4e-ff7fcd32034d
  5 e78c228a-67d8-84a4-97cc-0491a6ba8599
  6 261ae7e3-fd74-6fdd-8020-739f3b93596a
  7 530131c4-a209-03bd-82fc-ca5a5882c5b8
  8 e8ee6fa2-d062-61b2-a6e1-87d50efbe3e3
  9 588a2c97-2681-8a10-8b4b-a4da34324c2c
 10 f0cb58c1-93e5-46d5-b0bb-be1e9f736ce8
 11 250feda6-a865-01b6-b68e-9649febebce5
 12 57e61925-a7b1-0246-8dbe-5e9ff3157b8e
 13 00cab9f3-25d2-582c-a386-2aea73b2cc13
 14 cdf74726-aec0-0798-b024-371db88efd42
 15 07af276b-2cf7-501a-af95-2c5c24dbd854
 16 bc3b3de2-301d-5313-94f9-169a747c7d7c
 17 199b6ace-212a-6fd8-bae9-395a71845b21
 18 37b4625a-236f-1e69-b7aa-04f76136ab35
 19 c1c712aa-e90d-4313-81a3-d011b8cbc5e5
 20 fc023d25-df28-6703-a819-54cf8124cb2b
 21 fb9f5907-1486-78d6-a86d-364fc94cffb2
 22 5787a242-b9aa-2849-bd1c-69893f596954
 23 95161aae-3ef1-78ae-8f84-03a79a10003e
 24 1dbc3e70-e2c2-22f7-8dd3-bbd6ed0c9271
 25 47188ba0-0dab-8945-b4c0-8518bbdb2a4d
 26 a58144f8-d220-4de6-abdc-01b00b973432
 27 6c0f3616-4079-2343-82d7-74d9ce132319
 28 2be58439-f06f-400c-8fce-4c527e3c04a8
 29 f56b5c99-2183-6aa0-9c33-dbb5c1b06e71
 30 95b71ab7-c22c-5ff0-9205-d867f825b815
 31 7c6b4ed4-126b-6b9a-aa80-12d3158cf0f6
 32 2d12f1d2-bf0f-6c54-8fee-791a596cb135
 33 f5f471fe-de79-162c-90dc-f38feb90e02a
 34 089d8379-b231-2a77-b1ac-5541f1c289aa
 35 62b649c1-0893-728c-aa79-d481d5c75ac4
 36 463c6b29-5eed-0913-9e6a-2031f178ec96

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 815486068400505561467272842465661270. Exactly this sequence comes out of new Random(768).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 17 of Run 31 (seed 15,917,281): new Random(15917281), Next(8,64) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-07 23:34–00:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs