A858DE45F56D9BC9 archive

201209110424 zo0y3

explained decrypted filler

seed 183

Metadata

Post ID
zo0y3
Title
201209110424 → 2012-09-11 04:24 on A858's clock
Posted (UTC)
2012-09-10 19:24:02
Timezone
UTC+9 · title 04:24 against posted 19:24 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,320 hex characters · 1,160 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209110424) = 0cd4c717449fcd97c9ae7cc2fb2abf93 (name+title)
GUIDs
36
Filler GUID seed
new Random(183).Next(9) ✓ verified
Run
Run 31 (seed 15,917,281) (seed)
Draw
20 · predicted N = 36 ✓
Machine boot
2012-09-07 23:34–00:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
7 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

1DE23130A8483A85 292668537661D073 EC31190F24411254 E140DB8132D08412 D81935938D5C6D17 9A3F2CF83A984D59 DA06FC5A5711EF5A 5ADF93E8A540E494 5D16A4DD048EA890 CA4E49CD1CE13D64 22802B24AC44DEAA 6E73A9F1CB34680E 26E1825848FD034E DC7F06863F2836CB 5B1FC56FF79EE46F B96BCC0EA3251A8C 932559E975CCA191 07F57A2DE5313F9C E8D5507829B82C4E 64FA4F8022913034 0597642B825FB562 8F2122BE1848C124 9C7163D26EC6A296 8068C2A177BB7091 E6F7052621C8D113 9305D071436278B2 34E3FC99AE93BCF6 15F493ACA4498544 070E6129540F25D1 FA771BA4AFE494CD 737C13E9A7BA2027 167C65DA10C56A6D A60E8CB0031FC593 B1DCB271AE1AF111 9315519DBEAF5F7B EAD76C8C89A4A1CB 58CCB21E34508078 4BF10848D3395B9A E970ADFB4FD776BE 2E8F4C15D84CFCDB AC752B9EF4DBD5DA B97897E29EF56C97 E142B41C45A6953E 4B6F17C845778E2E F61C38F95D9AFBB1 F71B232AF509BDAE CFDDE836A8CE9A1D EE20DD03564C410B 5AC953C43BB51FE4 5A67C4FCFCD188A2 FA20D180EAD8C3A1 8311C86F587A6F70 AADC33A6E325B66A E9C92E8165581738 0CA81456DD45F67E C60BF6ADCEE957C4 6C8D80F55274272C 67DFFFED849E6982 0BD65DCA85E37250 FF2101B006870590 ABD3DE241AEAB53A DD101C8E117AA31A 43E36DF9D3665DBA 4A98CF842ABBC6EC 7897A783504AAD4D 484BA16088E649D8 EED44BA2C4E4E321 97AF072D9329E969 8404CBFB52AA735A 7667812C5753428C 849BEA6FC1145CF9 F86471DA3183BDBE DCF9F0AEEBDA2F45 4324F322FC57CE54 41439FEA8A119D7D 7CE410E77F606654 BA88E83B4469D853 BBFAACE0C772D6B9 ADFAD9D461FCC931 29669FF4925CF523 8D8DAB1D5A125B02 45FBFA90153B7D97 139C42A51C0D2122 4C92540AD21E0542 378046849A423E2D 4192E022277AE8C3 8009CF634488C9FB E565D5C34278897F 24943E27C20B7695 64C3CCD8D01D94A4 7D2DACE099679FA8 966696AADBC7C4C4 E40AE8E818D5E07A AF16433634C94435 781CA523372CB23A B1F151F7C5A922B1 977FB13926BBFB7B 66D628E45699F6B2 D56057BB92097319 28D53F280B37A05E 9D84B9CE809AF2E6 ADF0FF2F2485F5A1 7605F0399BF02612 BD918E2CFF177846 B2D68473A3F34E76 B61D31B57935CB89 CCE2025573B82A5F BF27BD2158C8644F A4B19F1C7392773A E68F65A40C831B4A FFAE2A115649D40B 22D09FFFEFE54AFD 1F28AE8F36651F6A D743C4306917BC9A 7C7FE09C76398057 1915421ED4C867C6 8C0EE7789F8E4B70 59D03D87E3E22742 32F2DA8C6961643B D2432DFAF8117C93 0488CB0E48538404 E534F8DA8A86B675 CCFF6CE25C0E63A8 ED5B5DC264706221 A818DD8A5BC69553 087E04B7EFC617B1 C3EE9B1FA39673DD A403F51AB0943944 1088EA3AE6094F27 8FD16C3DADAB9100 19CEDC176E522D0B 6E79D38667D7FEF9 59DEA48F05CEC6ED 20563D22E1AACA2F 8691089CF67506CB 89E116B81441FC17 707E27FD43AE0A1D F59F7689003A9CD7 82AC31C43E3580BC E0FF33DE189A50B3 E524903C1583F6F6 16590D689CF045AC DABF8529C7BA568D 108F34F41AA1F04D 48A6A796D3776E18
  • Read the ciphertext. Strip whitespace: 2,320 hex characters = 1,160 bytes = 145 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209110424 (name+title). Key = MD5(password) = 0cd4c717449fcd97c9ae7cc2fb2abf93, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 36 GUIDs as hex (shown below).

Decrypted: GUID list

  1 13cd22f7-32b8-2bef-aef3-cc7018e9e450
  2 23094b83-1d0a-47dc-9d08-5c815372be3d
  3 d03f6887-c797-6291-95da-17e0db881ec3
  4 a37b391c-df72-5ca6-91cb-4f116099ee72
  5 04e6dc6d-8ef3-768d-8afc-4cc152d820c3
  6 9aa7ea27-1a3d-4eb7-bbf5-f1d4a358c587
  7 941bc37e-8386-8547-88f9-781092265a2c
  8 99fa940f-ea23-29cd-a75c-cbc121ea4d49
  9 e7939beb-bd33-5699-bf09-201aceacf3ce
 10 82659f37-0611-6399-9569-0b3942f59250
 11 24a82013-20b8-10ce-afb0-ecadbc016793
 12 e10f8ed2-142a-3b54-aeb8-0429c494d3e1
 13 dcd2dd21-1be7-34fe-863b-047f229e16c4
 14 e8159b72-049b-6ed0-8556-71fb4f8c0478
 15 91a07d96-c86a-0284-93ff-ad738e73a15d
 16 04fd5ddb-3f14-212c-b32b-e00c8542cd1d
 17 6c1989cc-332e-7f48-a7f4-3e8c59a1de48
 18 e22e70e6-23d8-4f69-add8-a4395f06dc29
 19 4ee4794b-4e06-5d5e-952c-3a1a69e972af
 20 9b6f708a-87ee-1194-bc60-3ea7c479c0bd
 21 f8382dde-0323-19af-9b53-5e8611e923ad
 22 56ca9ba1-dd92-64ea-a8eb-24fab7bdf868
 23 fa677daf-1042-80f4-aaea-295dd292657e
 24 240ded4b-8ace-8a54-a6bd-7ff33c5eb44e
 25 2aeddbce-9bbf-5956-a7ff-5cb9c1c6dfb8
 26 07e9bfcc-6de9-287e-9ff0-6442ef8bac09
 27 cd158f0d-5eec-211a-9832-fa9035b923b2
 28 adf1c194-5b46-0444-97dc-59e0a64391f6
 29 8a4f0599-d933-0135-a48a-39cb24eb376a
 30 893979ce-49e0-4ddc-bcf7-9ee8d017caaf
 31 0c4bd0dc-9446-67b1-ba89-aff7b009151c
 32 43775591-fb6e-583c-b75a-6c1bca56662e
 33 78fb4ee6-22c3-757c-a4df-ff01129c2b43
 34 602ec86d-f158-5849-82ac-b8ea3759fdcf
 35 24784422-fb79-4291-82d5-c6f6841b28a3
 36 023bd7d8-4d1c-6524-910c-b4fc668c2727

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 246574825613360274511688522004657546. Exactly this sequence comes out of new Random(183).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 20 of Run 31 (seed 15,917,281): new Random(15917281), Next(8,64) per post. The RNG predicts N = 36; the post has N = 36 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-07 23:34–00:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs