A858DE45F56D9BC9 archive

201206260046 vmbvc

explained decrypted manual

Operator test: 10 GUIDs, seed 482. 3DES, key MD5(name).

Metadata

Post ID
vmbvc
Title
201206260046 → 2012-06-26 00:46 on A858's clock
Posted (UTC)
2012-06-26 07:45:01
Timezone
UTC−7 · title 00:46 against posted 07:45 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
656 hex characters · 328 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
10
Filler GUID seed
new Random(482).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

D6A5C0A88BD029F1 9E880572C46D694E FBDA869EFBBF36A4 2270D0B3F17343DC 36F49E53F2C006FA B114BF72964A012F 39870D92F9DF7F14 2186178DBFBA0477 6B8A35734E8A97F6 54B9A68C7D857AAC E4280D90F889F860 465C7E02FE7E9DF5 84DA1188A05612FC 5F1B7E03964FF411 361CCAF089E5A3F5 C7F44F1CBA4A515C 504B915B1E904617 E2A6123857D75CDE 8F6FC2D9568A0823 7A11AA20574441DB 4035BF5F687C1C61 0072C252596B847F E95DCA1FA419F719 C8FACE8EFCFB598B 87F2AB73D6CCD547 4A9A4260A65D7A72 FD920453B1EDCAF6 AC21C507A7EF13FC E92784ECAE613C2E 8F7A661D0513B989 130FC0BBB6B8304E 15D3F43CD20A2FE6 480E61EBA7C62272 9456A8C84D7083BB E42A8447275EBEC3 D6A6FF52CF9B4F77 85985D71AF956D9D DA688C994ED59C10 F576E7BC3D3E6A3A 95BEC9FE202761E0 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a15421e5-8bfd-47b5-be9e-0937e70aaad9
  2 7c92272b-3a4e-2fa0-8567-846e58e7c00e
  3 50af59d8-c9f1-6c53-9188-6eba5e7f34f2
  4 14ae48ba-0b35-3cc6-8e94-a8b5fdc2a2e0
  5 f8fada25-73e4-77ec-b968-dea6e6b5f925
  6 f23c27a3-c1e4-6f4c-b6b8-e61ceebbfdab
  7 227ce683-0c58-737f-94ae-9c9dbdcb78bb
  8 a8102610-3881-2e2e-9944-4e171753bb9a
  9 3f582034-d201-51d9-96dc-8f77b41956b3
 10 a74a712b-73a6-0982-b415-e2539ebe3e82

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4263767250. Exactly this sequence comes out of new Random(482).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 10 GUIDs, seed 482
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 482 from the GUID masks (3DES(name) ECB, 10 GUIDs, seed 482)

Related

Findings: Mask digit · Count RNG & runs