A858DE45F56D9BC9 archive

201206260052 vmc1b

explained decrypted manual

Operator test: 15 GUIDs, seed 265. 3DES, key MD5(name).

Metadata

Post ID
vmc1b
Title
201206260052 → 2012-06-26 00:52 on A858's clock
Posted (UTC)
2012-06-26 07:50:26
Timezone
UTC−7 · title 00:52 against posted 07:50 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
976 hex characters · 488 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
15
Filler GUID seed
new Random(265).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

5B570D8FF363A406 C9A58085F683246D 7253D4265D0028A7 1ED07A5BC9AECB16 E69B40BB7461F987 F6AAFE66AED24F06 2F558759456D8232 408F79DAB4B90ABE 692F57F09F673D55 AD69608B36D2EF3F A45D549E545D541A FCA1AADB629C1DA6 26A3EE30E5AC0516 DCF22F3920D016B2 365FE6358CAD43E4 FC487B7711CBA923 ED96AEBDAEF54847 826D3642441F4184 04200F510B292C3B 70FBEC85B64E2274 AE72C62D2DDBB2E2 1CADFEFD42070B12 C12207BA5F8BE5D4 C44DDFBFD9C53E3C E391570B4CB6EE2A 9C0E6D24ADA7D27B 95CA70883046C4AF 6EFF5E412052327E A50CC262CEDA4BAE 8654C91C130FB72D 8E7AF4DAA832053E 12BD6CE42C959F13 4CE8A3E5F267EF7D 6325EE624944B1C9 90BC42086101E9B1 167F0EBA5B3956AA 3DFA15984BC6821F 33F843ECE373CC18 E206CFC81F62F0B4 848363768A4C3C6C 7C394D863EAFCBCF CAD5D8346932C87F 912E819EB2CD5B29 E468EA250333928D 711E808673806E0C D273E9EA104981AD 9E797ECB60F5CC02 2A1D20DA5EF3A454 AF31AEE65968D92E C34FEADB5076D829 32EFE6882D58022D 8F445B830B1F1CBD 6A9533DF349FF58E 93663D8D866D03FF 35DFDF0FB84CC9D3 7C7F757FF1C445A3 0A14A646F429EF91 51B4FA3B6E0564BB C1F182CDBD451821 DA478E181A7788EA 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 7a551a7a-2a31-10a0-9f02-5ef88385e7d2
  2 362a2966-f729-5bb8-a254-a94d5e75a726
  3 038332e7-fad1-82fd-b5ea-1176ad661c0b
  4 95b73d9f-cad0-1c70-ba54-f38c51a7e7a2
  5 b25c48d0-91d4-7b0a-8c31-14fc6dc664eb
  6 631f2e16-f776-1e06-a85c-c451e8b7dec5
  7 0ef0f811-44da-53fb-8a3b-19f9f0c4d832
  8 2be20f37-a7ab-307d-baf9-892662da12c0
  9 6efa7b8c-e899-6b9a-8a8e-f308b6cc24ed
 10 dc060ff1-081e-8d09-b896-0648284df9e2
 11 795e1f08-d64d-47d5-bbfc-dbd28f8933a3
 12 73f599f1-5e91-3374-8266-74ef78e84aea
 13 82fe23ab-2adc-7af4-91e8-3dcd271f0858
 14 86311b4d-d927-356c-b8c4-1548491ddf92
 15 edb1ffd6-eb5c-4e06-ad18-725f795aba1d

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 158171536843734. Exactly this sequence comes out of new Random(265).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 15 GUIDs, seed 265
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 265 from the GUID masks (3DES(name) ECB, 15 GUIDs, seed 265)

Related

Findings: Mask digit · Count RNG & runs