A858DE45F56D9BC9 archive

201206260035 vmbiw

explained decrypted manual

Operator test: 15 GUIDs, seed 681. 3DES, key MD5(name).

Metadata

Post ID
vmbiw
Title
201206260035 → 2012-06-26 00:35 on A858's clock
Posted (UTC)
2012-06-26 07:33:39
Timezone
UTC−7 · title 00:35 against posted 07:33 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
976 hex characters · 488 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
15
Filler GUID seed
new Random(681).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

144755942C14F5D1 4CA0721499B26EF6 1478A89818F685EE F4F30460EF9CC990 9B276102D7B594B1 BF21286A716333EB C1584CEF9A0E6383 DA886CEA4F06DCA2 E1F06CE26CFDDF4F E9BBC9187F79BFB6 2F0BBA7069221113 749C22B579067F5D C1C78DBDC6F0C2E8 94E5BD8554B4EB0E ED4D36082E54E6F4 53C6313565F3060F DC43C67923152E1E D07A3F93D909084D 4BC503786A00798F FBA44DC749D5E534 2F65BFFE51BFBD37 26C02CE56A8EDBBA 6B9F5F5642279822 3C474AF9F19CC0E3 7403D960CF2CA3DD 68AF5E35889FC1F5 D2CCFBC1100B2538 65DA8952B6CFB047 9769F838A13D049F 325A3D61B724271E 555192841B693E64 4D7B5A5EC119ECFE F99CABC90326C293 5F0CF7F21DDE8315 2C266C2DC788F71A 060760F69B225439 C16BB3127B88D312 47CF64238503E1F6 4BA6E8A47396A1A2 8387FDECB5567156 F14F65125B4A3CAB 1EC85B5983B00649 327295478DB82146 7B4E85F024D1D3E2 8723DF64F2D6C1E6 93622AEDB2FAD0FC 60FC7F51C46C1C7A 9220A0C99F98574C 1EBAF294E326DBBE 650C8CE842576855 8B37CABDC876A1C4 B3C6574F3035C7C4 7777B5FE1F8293D0 EF89B9F98901EA86 925B70C429AF508C 8CF74C223C60F861 E6955636950420C6 E001A4FDC378AA81 48BDC93BEC1D7890 71D6B613D40C95BA 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 52762169-bcb0-4a3d-9cfe-238e5965807d
  2 a6e27a8d-b00a-5e7d-9265-0a09fa71d614
  3 dae8d217-0a26-7815-93fd-46ae969b9656
  4 4b2879ff-2868-8055-8ee4-aa86b3c3db69
  5 0912c77f-0d78-6bf1-902f-e92e98aae3d2
  6 088b4429-fee8-6e9e-b19f-2cae33ef51cb
  7 ee9fcd96-197a-041c-b76c-f72b547ac864
  8 a26dcac1-5194-0899-9d9f-0153df8d0862
  9 f5a7fc07-a765-21eb-bca8-40b3f76b8f94
 10 0a59d58e-5b09-3838-b1cf-11b9435582b8
 11 98de8b04-c43c-029c-a983-8d06958d577b
 12 4022a0af-95e1-135f-b412-9ceffa2986e9
 13 1c57d356-9715-72cb-abae-9e1ab394fecd
 14 508bc21c-d2e5-6195-bd62-d17adfceb279
 15 0a3e0c4b-8b78-5fa8-a00c-ab99be17438e

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 457866002301765. Exactly this sequence comes out of new Random(681).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 15 GUIDs, seed 681
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 681 from the GUID masks (3DES(name) ECB, 15 GUIDs, seed 681)

Related

Findings: Mask digit · Count RNG & runs