A858DE45F56D9BC9 archive

201112041939 n0dbk

explained decrypted manual

Pre-automation masked GUID list: 12 GUIDs, seed 702. 3DES, key MD5(name).

Metadata

Post ID
n0dbk
Title
201112041939 → 2011-12-04 19:39 on A858's clock
Posted (UTC)
2011-12-05 00:36:01
Timezone
UTC−5 · title 19:39 against posted 00:36 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
832 hex characters · 416 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
12
Filler GUID seed
new Random(702).Next(9) ✓ verified
Run
Before the scheduler (pre-automation)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
22 · 5
Tags
pre-automation2011Encrypted masked GUID listmanualarctic-onlykey: namerun: pre-automation

From the post to its content

As posted (encrypted)

0830C1844583434D B253E7DB0F12E2DA 6A1B60F1F175F678 D4DC315D22ACDF54 FF1C2E462AA2957C 17BC9363601130E5 B97404AE06DCC391 49AFB2E76584D605 F305A84016A69AE9 2D3D033864112E5C 71BA342E866628C2 68A5DA2F134750B0 DCB490AF43426776 53922D1B8944F501 08563D6B87FE5A5E 8B3A42DD6244F590 1F4D8BF7D7517540 4E8B90F0FF23764C C37EDDD46DBA9EE2 DADAF0931D2D2445 60CE6E1682229E6E 70B2D30F34EE867B 2DE3A234051727CE C87C6780A46CA44A 258CC3047BA775FF C610B4D14F23C267 B609F312CB88650A A38CA1E85A81C34A EFA6063DFC034EF2 E8BC2AB3D3CA95F4 8F3034337F235AD1 35685EAB88D042F2 DABC5CE1E73591CC 1E71D7AF1A08650E 8BF61AE7C6970CC0 62D96B03CD000909 377C8E868548C78A 3BD788ED8BCA468A 1207D04A8AA91CA1 72B6B75238917EB6 6596AAE0A316C3DA B0B421A840849756 AAD1A6FC5DCAA7C4 25D5C37FF9F41C1F CCAB6D07E66BDCB1 B6A3947EC57B2C65 724F0E22324FF0DC 76F46E92428601DD 67FB0F273A6AD506 CA67907129245646 1BF2A88AEE8C704F 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 832 hex characters = 416 bytes = 52 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 12 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d1e394c0-7577-4132-9549-7c5f12086b29
  2 512f4a90-3af9-75ec-a899-5f44aabad40f
  3 7412c11f-ada6-46e3-ac25-080d8627d47c
  4 5620118c-1e5f-3c85-bbbd-8a76de945b1c
  5 e5ac2f4c-21e5-10a1-b91d-eaf8443cc291
  6 3068a7fb-9780-04af-aab8-3dcb48d7226d
  7 742c3cbf-7418-326a-afb7-75ec33d7a3b4
  8 a9f8248c-9652-53d5-9df4-7a34530ab501
  9 83f6fe3c-dd7b-7fa1-a9c3-b08c178dd8f6
 10 49c3a603-113d-140f-a1ee-fcdf238a247a
 11 df3c6b26-662f-4152-a9b4-ccf97e9cec2f
 12 6d5a045c-1920-4128-8c8d-ab51ec17fd53

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 474310357144. Exactly this sequence comes out of new Random(702).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Before the scheduler: before the scheduled app (Jun 26 2012): sparse single tool runs / hand lists (o5o4o, jbucr, jkuyr), 2011 genuine-v4 lists; no long-lived count stream to fit
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 12 GUIDs, seed 702
Explanation
Pre-cutover filler under MD5(name) ECB; before the scheduled app (Jun 26 2012): sparse single tool runs / hand lists (o5o4o, jbucr, jkuyr), 2011 genuine-v4 lists; no long-lived count stream to fit; list seed 702 from the GUID masks (3DES(name) ECB, 12 GUIDs, seed 702)

Related

Findings: Mask digit · Count RNG & runs