A858DE45F56D9BC9 archive

201206260055 vmc5h

explained decrypted manual

Operator test: 8 GUIDs, seed 226. 3DES, key MD5(name).

Metadata

Post ID
vmc5h
Title
201206260055 → 2012-06-26 00:55 on A858's clock
Posted (UTC)
2012-06-26 07:53:57
Timezone
UTC−7 · title 00:55 against posted 07:53 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
528 hex characters · 264 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
8
Filler GUID seed
new Random(226).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

75BC0D6AD38F4381 FD44FAAACAEB4C43 62E0FB8A3769E0BE E92CCAF343CFBB01 B674DCC6E985D25A BE131523F50557D8 4376D117CED246B6 FC743DC85D67036D B3828A9F0C821151 71BDD8FCFAE1B1A1 DADB17C760CF0EDF 4809CB80FA76E94C CC714216E647B4CF 272847B5E6F0F96B 9C1126223BEB0D18 D32878E0D33C060C 7AC8BB9AF079DAE2 77D20D1A5F5CA6B0 14FD7F20A17AE745 F6B5088D01481F17 799C62B14AB0A0A7 C63FBC11C07567C9 D2839291656DF3C3 576B9F5DCA5043F8 7D4B32F037253331 BA7641F747F5B441 754A901A7379B50F AD41CDEE3C43CE0E 028C7CD1A5C41818 868A6EF26C0CF259 8095F79D38C0DC31 32C66CE83BE3F7F7 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 5e99fd9d-882d-7667-8d3a-2bf94031d09d
  2 4b93aaa1-a84e-1cb7-8bbd-7beeccef4123
  3 bf35ca86-80d5-63b0-948e-595a366470b2
  4 45a5ae0d-4404-7113-9626-4231fcb09861
  5 0f8def84-7bcd-2f0a-92c2-3a5e195bc036
  6 9f98bec2-cb28-029f-a191-99286eb74c72
  7 bb4800fb-1314-1e2a-86dc-450ba7a78cea
  8 e5dd5b9c-0f08-7236-9aef-fe3a44fef14d

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 71672017. Exactly this sequence comes out of new Random(226).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 8 GUIDs, seed 226
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 226 from the GUID masks (3DES(name) ECB, 8 GUIDs, seed 226)

Related

Findings: Mask digit · Count RNG & runs