A858DE45F56D9BC9 archive

201206260044 vmbtn

explained decrypted manual

Operator test: 10 GUIDs, seed 894. 3DES, key MD5(name).

Metadata

Post ID
vmbtn
Title
201206260044 → 2012-06-26 00:44 on A858's clock
Posted (UTC)
2012-06-26 07:43:14
Timezone
UTC−7 · title 00:44 against posted 07:43 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
656 hex characters · 328 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
10
Filler GUID seed
new Random(894).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

FD341B7B33004E3A 650D80756D8F3F97 A15C33C8C73F1ECD 4684FE194FE86F27 977C9E392258E57F B4E1AF6B29EFA9B9 2BA32076F8C4D837 75F2A20C85996E9D 7D6740BA57321B4B E1821C976A90EF02 5E548ABBDE0B868A 88013E233F277BA7 D598462FF7F42F2F 213DEEA6C4027D62 DC09AA2756F96830 1CC14B6FE8C2900A E527555FEA423B11 169A92F609B2F786 E003AFC17EAF1526 37D2D8E5F90CA67B E7A2AF05E48FD9D5 500EDD413DE39301 FD8FB1D101570403 A340870D3EE5B1A2 B180AD75A8539918 D953514AC77A20F9 BA6F14349192E698 392A0AA9362E4D72 6DE654E1DF341FD9 70B34B92907D0A7B F2B28829CB12780B 4955763FB6A92877 E84A75C4E77D2FBD A8D643B601DF9AFA CC56A8B8BAAA0EEE 6F6AB96173B1FD81 EE46951A09AF04A7 4BFA8EA7D307C33C 39CEE003D8BE3D04 E0930C3F7084A26B 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 358cb295-5ea7-60e2-96a1-d23b14e67c3c
  2 ec8cb286-ddfc-17a7-b6b3-614df059dddc
  3 cb67f17d-c478-5f84-bc7c-8d05db4f3432
  4 030ff418-25b4-395f-9160-b1ea6053eb89
  5 ded17efc-19e6-7b0e-b285-68b7a26cf62d
  6 3724405b-f01c-71ee-a3b2-44c73138a515
  7 693ba9a1-0edc-4bbb-b55f-41292a4d8dbe
  8 b576910a-cf74-8906-affc-28dead275f57
  9 80ad5e43-f8be-5ed0-86c9-ac14e8eb3f56
 10 2df3ab4b-a124-8316-a9ac-4a707a4d6036

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6153774858. Exactly this sequence comes out of new Random(894).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 10 GUIDs, seed 894
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 894 from the GUID masks (3DES(name) ECB, 10 GUIDs, seed 894)

Related

Findings: Mask digit · Count RNG & runs