A858DE45F56D9BC9 archive

201206260106 vmcgg

explained decrypted manual

Operator test: 11 GUIDs, seed 358. 3DES, key MD5(name).

Metadata

Post ID
vmcgg
Title
201206260106 → 2012-06-26 01:06 on A858's clock
Posted (UTC)
2012-06-26 08:04:19
Timezone
UTC−7 · title 01:06 against posted 08:04 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
720 hex characters · 360 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
11
Filler GUID seed
new Random(358).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

5DD53627C7D6E466 350DD5D372642CA8 84C2D24612836F1C 4B79DC9725F70A43 1D57BB68C733FFEB 816018042CBC48A9 E20053B2D56DDB8B 489AF4D6BA5D0F26 23935809854830F1 6136A6EC138E76AA D4958042B1BB4D2A A0909A7A4E8EEDD8 EDB3EA06CA9E09D0 FAC11A79A8FF0C0C 4DE7C3D5FE240CE8 B48D066BE3E6EED2 CC7C6728E7E0C7DA 455BA5AB15CB3E50 9EEF5B94A2CE200D 7E93400BEB8E7204 F42A41904417D830 D00FAC15276E4E8D D95F613772674B78 35F70CF72A15B304 80D94F56BAD7B064 4B65EA53E2892968 475276D6F65B0F5D 2D24C4080757C9C4 1FFCC83A6D5D382E 31E1B948CB016AB8 7E7352CB50684B7B 81654571DA2E700C D1056F3481A74B53 A0C5D5231A75BC9C 711E620950B46E14 5EF0E23443C8E265 69775FD3DF5427D9 5B85670446B71977 B31F5764B31AE908 3F4E0E64AB599E45 8349FBEE123A4DAB 2A3B51800EA51334 E64C0C3BEF20262D 6715FDB9C6AA06EB 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 d1936cc4-a84e-6591-b393-4f34ff351730
  2 429dc9e2-6b43-7dc2-b8bc-da7c66915a3b
  3 24a316e4-4a26-03fb-aab6-2802d59b9fcd
  4 d714ff3f-7374-8385-a0df-ffb8bc6a6bd6
  5 ea15b4a1-0afb-76b4-bdcd-1bcf89ea2451
  6 7ad67aab-0476-3014-a0c8-39ad215eed7f
  7 2e346682-c838-23b2-85a8-0557aa9c9138
  8 535add95-553a-0010-90eb-d2712a547bff
  9 3f47efcf-79ab-29b9-9742-ca5cbbdd1077
 10 eec94c11-e335-22bf-8096-55d5a64ec2a9
 11 dd57ad7e-0b87-034d-a0b9-1d255d9fa86e

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 67087320220. Exactly this sequence comes out of new Random(358).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 11 GUIDs, seed 358
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 358 from the GUID masks (3DES(name) ECB, 11 GUIDs, seed 358)

Related

Findings: Mask digit · Count RNG & runs