A858DE45F56D9BC9 archive

201206260055 vmc55

explained decrypted manual

Operator test: 15 GUIDs, seed 64. 3DES, key MD5(name).

Metadata

Post ID
vmc55
Title
201206260055 → 2012-06-26 00:55 on A858's clock
Posted (UTC)
2012-06-26 07:53:46
Timezone
UTC−7 · title 00:55 against posted 07:53 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
976 hex characters · 488 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
15
Filler GUID seed
new Random(64).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

ACB7A105FAF7FB69 4732E91B62A687D8 5022C666FE1E22ED 80E79031C6196006 E5C338AEE3112FD9 B2B432E9CED911EA BA8D5E61126BD5A1 8D039FCC0B79C084 77DCBDB3AA339EAC EEC4FB2A8C7D4855 57C5C9737FFACAD1 8EBB199D7313A3A0 D14CAACE6A464CCA 7FF5265620C5EC1F 5CB51FD1C8D83D73 CB7EB80B66F75876 30FF126B75045826 9BDADA3BD55927C3 BCB5E36496E98998 BD184E75166E7A2C D0DB1F4A9EBDDF1A 92803DF198D03760 0A50BE11F6626DA5 8625A7C9AAD1338C C851F63B079BF684 498C109212C966D8 BCEE216079D86D41 F6025C11AF323F1B 514A6C9218CC7204 4C8C122FD0468E28 9518239CE309DF4A 696A9C0D3F94717F DC7BDF597DF3F471 36F7D6280E17B101 E488B87B6ADE7407 AB4FB5D3655EEB30 B807590126EF5BFC 31CA14C4E2D4B603 80F419543FAA9791 0AD9F6E94B6EA1DA CABB567DB7786A41 68D8D05CFC903FA1 8E2EED42EED04B2F E9425D6F602F5373 4D038DFDDC5F649D 2ADBF3D7EDA30DF2 D2AE12A77C500BDB 9260B8B2B3C258C9 0B24898F21CA6576 14C2DE494014DEDE B6AD8F974E665DE9 EEC8CAA83AF8292F 6295F5D63A35CE2B 5C6CE8FE9617099A 4FBD021EE6CD9511 386CD01AF3A9725E 0E1B810A85C0F481 CDEFEEA6A5B378E2 03E15AF259E41D1D F4F5167A9BD89214 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 b4167029-f47c-1cc1-b0ef-b008efc9ca84
  2 08216a31-d2ab-5f9e-81de-570446e88619
  3 64abf414-5948-4229-910a-3dd81db5c276
  4 08772548-0720-12a9-af01-85c356530397
  5 86e67a3a-6b51-0c43-a0bc-5afcf8ea189c
  6 c5994ded-828b-426f-8d76-d04878097d60
  7 f41681b8-3d5b-589c-803e-20743f280ff5
  8 3532a47b-d9a6-421a-938d-f812967d8448
  9 e66b25bf-9419-8a91-9f9a-c3be4af54595
 10 8be94690-12f4-7581-b8b0-e600bda14341
 11 1f8a9394-9c0d-3d40-a81f-80be0ebe78a5
 12 d235828b-75a0-390e-ba96-e5b29d97ef2e
 13 44340433-bb2c-5595-ab67-49a0d45eeccd
 14 88c278fc-4eaa-6eb0-b8b7-6e0034c984f6
 15 5f134430-d05e-7c93-ad8b-d92d602d993b

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 154104548733567. Exactly this sequence comes out of new Random(64).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 15 GUIDs, seed 64
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 64 from the GUID masks (3DES(name) ECB, 15 GUIDs, seed 64)

Related

Findings: Mask digit · Count RNG & runs