A858DE45F56D9BC9 archive

201209110433 zo1ie

explained decrypted filler

seed 223

Metadata

Post ID
zo1ie
Title
201209110433 → 2012-09-11 04:33 on A858's clock
Posted (UTC)
2012-09-10 19:33:07
Timezone
UTC+9 · title 04:33 against posted 19:33 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,512 hex characters · 1,256 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201209110433) = 7c1234a111555cb0f5ba91dd53808e78 (name+title)
GUIDs
39
Filler GUID seed
new Random(223).Next(9) ✓ verified
Run
Run 31 (seed 15,917,281) (seed)
Draw
23 · predicted N = 39 ✓
Machine boot
2012-09-07 23:34–00:34 (seed = uptime at app start)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
13 · 6
Tags
automated (decryptable)2012Encrypted masked GUID listkey: name+titlerun: seed

From the post to its content

As posted (encrypted)

0F0ED71B6EA33C12 225C689A995C3539 0481197D049E6AF7 3DCE7D77477E056C C17E6816D6C86AF6 1BE52FA8322C1469 D049411870DC3538 C409E3A5855E21B6 52E3CC4A41F9468B 3F798646753BCC51 D6684E970E19C28C 67C412A432F942D8 2D2DAE0B11FE8F03 4D9597BAB7E31930 8E51F1C2B2153CE6 824897788D870F89 660E22744AB417CD 0CF8C5CDB37BFC6A CDBB7DD47CEFF76B B7B3B0FEBFF5E6FC 0ACCF9DCC811019F AD4122AC4FD8A8E9 60D3C37D73A79A9A 61FA6574836BE8B4 A8B69CCE09F8CE00 2D1849C67F1383AE 33A87B1723D75501 3851E786B599D30B 71AA7F52996A52CF 13413AEEBABA2A65 B0A5D5D2685F87C1 F165CB4545604A26 A31B3E0522B4ACE6 85E615D7BC12D6D8 E7EB81FE50CBBA07 062FF123334CF7FF 8C7CD8312FADFA63 B6B9209BAC699714 E8D462933CB8E05D AA7FDBD823F1A01E 59855D0B9FE6D520 B8A6FBDEA0833B1C 13F0E6811EC33CD5 0EAE136E1BA345DE 19BF6E17423B0720 3000BCA017364225 23BC581E2C124C9E 527F2DF46C92F34E 7C335210AB6DF9A3 3D53D40F5F4C6994 C713657133DAFAF9 B22594F743925C1D ACA3CDE194193D69 3BD1A96F8D170A7A 17D88F3B9D4B00B6 9108E7AA80D9A808 2E527CBA89CDD40B 97E94D6BA5C36D44 42680581F76EF501 428C07D0A5285297 50F5B2B3D597E128 110511E0C4A8E5CB 32336D7BFAF4241B 9D9C3CEEA8E0CF3A CC72D51FF57531FA A1CF6AC66413BA88 BE148C7CB0C70CB9 3229E99841927D9E 99AB80A78E4036EE 24238A37990A794B AFC1806F744B095E 15F464CF960B98B3 CED24DB98E4EEA04 4E5EDC5D937B9B2E ED94FCE8A68056E0 7CABA029571FEB40 CB4DEC5AF0E469A4 BB7F4A64CCD9173B 716FD56E3D4DB5E7 A4AB2744EA8ED3E2 3FD624616A4B1844 5025DF05395785F7 E365784FB4AAB64F 4D2964D607084130 FF7A005FDD686508 19F32174FFBE3438 FC3DF44B5F30D8D5 8348576FCBAFD11C 5B3D228E806ACC7B 040406688259C115 96D7AB6E5A068C59 E232E540B9559182 115D4591460973F7 A0508453A4C5CD23 D8EFA0E20331C978 7336EC2C5DCD76CD 78076B8A5A2910F9 E616D6FF44291B70 469628CBC9067DA0 1E7339DADD0C69AB E2A937BFA95F9EDE 87BD443084A5C8D9 A22DAACE58D55526 89A4021AE9CE7C81 9FA56F2C03FF90FA AA0DFE5A943ECA00 97AEB9FFDDBA67BC 7B899B2D5395E821 DED9B77C34D96B50 AB766FBDC03380A7 86246BB220143055 2E3859064134E1C5 69F17B8E8B3C1A98 A83D98084D137EBB 50E298342BD9FC43 2AE20FD3EA08E6EE 90428F8A9A7D27CC 84D9AC26F4CAB96C 9C4FA7382A980A1F 820F24648934795C 1FF62CFE2EC290A7 E121FAA5E76E6416 70AFA593F133323D 2DEC72225AAB135A B909287FD99C82E3 36587399EC3BB18B B23B195087878AC2 667221F62B586FBA CD9FBBB7387373D9 58702A21D370B7E8 534FB5EBA1E3D340 02F7B6A1DAF774DC BEA5281E63CE5900 6F7603186885F909 808BC833D77FFAA3 B188572C9840E95A F82F02C7F818AA20 92462CFAFF36A7BB FCE285843E2AE224 07FA35BEDC0FEB33 40321BFB7B5808C2 363267A7DD6A03C7 763969567BABBCF1 6F69F0DB6493BEC8 A6E7F4C70730447A 9EB04AD1567ABE7D 6CBABDCD6895AAD0 01C05DA059F07345 8F27B878B5B30E74 AA2B0DD1B29D09DD 72177EC5A66BEEE4 7C14E2589FE54399 BFE644636574CCC2 8971D16CC2C0CEFE 9AB47F51E9F029FD 576540EF2D6CD859 0AFD86BC42854AA1
  • Read the ciphertext. Strip whitespace: 2,512 hex characters = 1,256 bytes = 157 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201209110433 (name+title). Key = MD5(password) = 7c1234a111555cb0f5ba91dd53808e78, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 39 GUIDs as hex (shown below).

Decrypted: GUID list

  1 3ba5feae-e86c-2988-822f-9767636ba590
  2 dd363e86-b0c7-2fc0-a1dc-c5eab9690828
  3 9b2d9a77-43e4-550a-8ee2-4c1637580fbe
  4 e9834444-1e00-134f-a309-415847572b2c
  5 ca2d07fa-0841-7673-b182-451fb30705f0
  6 dca054d2-f988-326e-966e-e9e826b43b06
  7 314e58e0-c3cf-7ba9-9694-ec318a10103d
  8 b2667655-72e4-28b0-b678-1aed9b34d1f4
  9 8b5bccfb-0695-5618-a6be-18e577c05a06
 10 63ba0d2e-374a-41a5-ae30-82fbc8ce6873
 11 1f59df76-04c3-545b-aacb-e34601896319
 12 9d5e69cf-531e-59f7-8393-7add34ed534d
 13 b0f3c119-2810-8a24-98d0-861a319fc797
 14 e18a268f-0226-4f21-857d-a661e0a196f7
 15 dcfcc567-57f2-01cc-9231-0c50576bad3f
 16 f5c3331f-b299-2f71-b287-067c7e93d780
 17 a84f021f-8da3-5d09-a545-92b649c1d92c
 18 7c1a9dc7-7d47-2044-9c56-12c7eab6c4e7
 19 ed66380f-2ba6-6b8d-beed-ba93105ba229
 20 fdfc68e9-a4e2-50d5-9d16-5fce29c9254b
 21 8eaaf06c-4298-4622-98e4-b9b1962aac4d
 22 2b8c2f22-9f58-560c-af91-91f37b3171d8
 23 3da8e1d1-53ab-6903-8c4f-bc1a589d8fbf
 24 1fed6fda-1a14-80db-bb42-0c4923d9af17
 25 a73e37ea-1206-4f8a-afba-9968a0152dcf
 26 2dba5653-4f45-89a1-a5dc-91c417804f8e
 27 c37c4744-2e23-5073-a8dd-a34c28f30172
 28 c142043f-fc56-7b06-a81c-90d393d3120d
 29 47e3b93c-8807-1015-b792-72923e9c528f
 30 1ece4b2a-751e-67fb-9a37-499aa6bada06
 31 c2e4622f-9e2d-4173-b1ee-8c1b230e663e
 32 570d40d8-85dc-1160-ac05-436835296a26
 33 7cacce99-4b80-87ac-abee-def828af8e3d
 34 e67e4b76-ba39-5f1d-b800-8b8ea2b27aff
 35 2b5ffe7a-02cf-47d1-8a88-1d723a68e639
 36 38b32db7-85d4-30fe-801e-0808cc4e41fc
 37 5d028a01-d5ee-6629-89fe-245628602745
 38 1cecb435-3ad1-3086-881f-cd513e43e385
 39 73ff3664-25d0-4ec1-b22d-6fd73070348b

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 225173725455840252654568485716418543634. Exactly this sequence comes out of new Random(223).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. This post is draw 23 of Run 31 (seed 15,917,281): new Random(15917281), Next(8,64) per post. The RNG predicts N = 39; the post has N = 39 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-09-07 23:34–00:34).
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Related

Findings: Mask digit · Count RNG & runs