A858DE45F56D9BC9 archive

201206260106 vmch8

explained decrypted manual

Operator test: 23 GUIDs, seed 958. 3DES, key MD5(name).

Metadata

Post ID
vmch8
Title
201206260106 → 2012-06-26 01:06 on A858's clock
Posted (UTC)
2012-06-26 08:05:04
Timezone
UTC−7 · title 01:06 against posted 08:05 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
1,488 hex characters · 744 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
23
Filler GUID seed
new Random(958).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

D84FF2C215D9ED65 19D2B8FC5C6C350A 9F2E1124EAAF352A 3940BF558E0D6611 878EF9F42D566923 2BDD0905D8D91A94 1171D5DE34B75262 DD94E26018597789 1C957DBD95A18149 1B0F7D87DC83F177 28AC6FE2CF401A9F 77C705EB77B49427 C608F54BA51D5A36 F4B6C37F0C6E077E B0FAC88716906675 D44EADB2D4889930 9507997D9EC632CC 6C6D09E20F219CF8 99CD380AF44252E8 1BBE29F8C0B47D0A 540E140A5B95C56A 4A4953692F60FE38 9296D2973DCB7ACD 12005115D496591B FD8F3633AC186A3A 22906E42EF4FBA78 7FFBB19B84A38EE2 933C3DA1EAE39718 F01320F463A81476 79DAEECD255BF7AA 66D42AE7BCA187A9 493C9459EC5C74B5 BCF2800F06B233B7 0F20D446C2693760 A09F68B0CC247AA4 099D396BFC2E6B6B A4E8E9C26D483450 64530493266AFCBA 3DD0078FDF3F0376 718EA3553C75FFC9 989388EED2C2C0CC CCCD10F0629B948E 12330ED422C39FAF ADFEE373BE206B42 72D9F06482E096F5 68D993C5B80EC71E 19533BA7A24C012C F8D1B3D20E45A7F2 0345D5285FEBF5F7 6C0437FC53038E81 33D8C02319DA4187 AAA9B0C7D1129664 C6D5DA0F6DEC4488 37CD35E1921D3795 4B5063B7C1A61092 BCF2EA3C63480309 4CE5896DAAA0926D 43571A02F5B95891 28146C784841D3B9 350AC8B7646EB160 0A85D30E3C94B455 E3D5B53D7D0B866C 370605F52D1B7D0A 95292DEF0D0D3B77 5F87EE7CAB7E35B0 6055BDC1F3703D14 1722FD92C53430D7 34561D168E997B8C 3BB3C5743D48A9A5 F0C0F2F769A2C1A7 7B29B592727B01E2 21FAB6D585315E06 8915D018C74B4C66 F33CB6E511C7EA7E E33FB84B0C66B1E1 1A05FE7898D7F97F A70A5D7BDC70E933 A18CBB4D5F332483 6AE4A50CBBBCF770 E7165DEA1F5F0D8A B1E70192CDD6343B D555AFAD127F610B E94B98CC9E1B3704 FC0021499D6856FE 370CD7F09293869B 559F421A422C9851 34B5D401484F48E9 FC9A684FBEE729AE A8DFF2A36C0FFBE4 7384A66C3BF267A3 73210B80CAD5276C 4DEFF62273A9EDA6 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 1,488 hex characters = 744 bytes = 93 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 23 GUIDs as hex (shown below).

Decrypted: GUID list

  1 52d91c6b-9e98-1ebe-b99e-880d9bd52c7e
  2 38ea1acd-4234-8095-b793-a7a13cb6f022
  3 11dbfaf1-7694-36c3-9356-0de70763d228
  4 ee6bea8c-036d-0dd5-a364-c9f282f9232d
  5 3c963e8d-30c7-6c30-919b-fc655242d554
  6 cb78fb46-a345-6cea-aca5-ed7f5ff985d7
  7 c6113b99-81e5-1d4b-aae3-f350693b99a1
  8 cdeadcef-a366-0095-97df-230d900cd74b
  9 9a3f59b2-9676-4243-8718-59cd36585886
 10 c724c8bf-bec0-42bf-ac86-d3e4d8f9e310
 11 9eaf96ed-42f4-00a8-bd4b-d758b8f7b475
 12 943ae125-5203-3408-8013-3e40a8cc302b
 13 085f5082-90aa-1985-9c9c-569a9259aba0
 14 9670d683-36ac-710a-85cd-28b5a377d94d
 15 7e0a7495-ee88-48ee-9cfb-c1082ab7f757
 16 5db54425-611f-2e46-b009-917a00615dab
 17 e3f5401a-8fd7-57d1-8aad-3ccc16767515
 18 7de8935d-57ae-8be4-a4cb-01d33af7672c
 19 4cfd848e-44ca-5a4f-9f40-4ce0fd0a8cdd
 20 bd3a0c6b-a760-2e2e-ab04-93b892411788
 21 bae5edf6-f59b-0cbc-a9f3-464e11529f32
 22 03e6705e-116f-79e2-9399-ba70dbb5c5ea
 23 255c5c1c-c92c-845f-ac5e-614e82e61544

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 18306610440317425852078. Exactly this sequence comes out of new Random(958).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 23 GUIDs, seed 958
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 958 from the GUID masks (3DES(name) ECB, 23 GUIDs, seed 958)

Related

Findings: Mask digit · Count RNG & runs