A858DE45F56D9BC9 archive

201206260052 vmc1n

explained decrypted manual

Operator test: 10 GUIDs, seed 360. 3DES, key MD5(name).

Metadata

Post ID
vmc1n
Title
201206260052 → 2012-06-26 00:52 on A858's clock
Posted (UTC)
2012-06-26 07:50:37
Timezone
UTC−7 · title 00:52 against posted 07:50 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
656 hex characters · 328 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
10
Filler GUID seed
new Random(360).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

9EBDF1D019BB3CFF F548D3AC623221CF FA3D75C77D0DEEEA 058B7DA50AFF4DF5 E41598770BA2469C DC98FB4FEBF37691 C828489C9B52E01A B2A22B22331FCC83 7757F0FDF28CF384 5567450BE75CCA65 BE9F922E0FB59BE6 121B9B3C48C3067E F9593C5C8047C51A D3359F0ECCE4BCBA 6FF6113C93E7A41F D3539757FD3E6BF4 C1BD1424F4FFB2A8 C2021D84AEB2DD71 924BEB9E6C200171 A0CA8A6890373B38 636BCCD55FAA171C 22C3604993494ADA 9F310120B4E6CB68 4ABAA921FCD77B30 B8761DF48B41ED06 C90364EE009F993B 28FF71F2D36A0B6D 40ED70F9F0786A6B 56D55797A483FFB1 6B2EFED7708A053B BAB1A28B64F61DAA 92EBD56D010D3F56 75AC3EC5D92CAF56 6D1562BC2E3379DE 44B59B62596AFCDC E333C033A1D660DF 84AD5A5C4D24F202 3F293FAB035CE091 FBCD497080BF7427 6D6D5F2C48B41A7E 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 93d87187-d20e-7c30-a1b1-d8b408d141e9
  2 68a73cba-1e33-40b3-9998-68a21f455c97
  3 e63e4e99-f506-3a5e-a46a-c479d9b41028
  4 2be6058d-8c26-3583-af6c-e2344d5a7d21
  5 2c558c3f-ab92-6aa5-8358-91674049f382
  6 28f4016b-5caf-1949-8849-4aaf6386461f
  7 eb25cd97-f212-160a-9daf-b035d2827f5a
  8 688b2018-b497-086a-b020-baa8a458f591
  9 14821a79-5e79-43eb-8484-76a6e5616334
 10 28702840-874f-0e86-8d19-8fa8cf71f92a

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 7433611040. Exactly this sequence comes out of new Random(360).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 10 GUIDs, seed 360
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 360 from the GUID masks (3DES(name) ECB, 10 GUIDs, seed 360)

Related

Findings: Mask digit · Count RNG & runs