A858DE45F56D9BC9 archive

201206260109 vmcjt

explained decrypted manual

Operator test: 11 GUIDs, seed 845. 3DES, key MD5(name).

Metadata

Post ID
vmcjt
Title
201206260109 → 2012-06-26 01:09 on A858's clock
Posted (UTC)
2012-06-26 08:07:29
Timezone
UTC−7 · title 01:09 against posted 08:07 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
720 hex characters · 360 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
11
Filler GUID seed
new Random(845).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

0991A1F4C7CDAF09 104AD8B689A2267A 539AF30D9045E3E6 FA732CA59573E47F DBC595AD9CA0980C 7E22265EC78B40B6 B13DA94DC6360D33 E54EA7A450371459 4CB40D2358DC1AAF 438C187970B58FE9 8D40BD209A9E9B65 25587D6176EBC4A6 880F284F9037481C CBA68C86A8D4F4E8 E79FB7100ABF817A 331E2F0888CF3A88 3AFD416664D2FFB8 36A14FA48A111A39 208A8674F5D3ACB1 C5B50FF335C5BA79 90D241EE616B9D89 3B9A2DC108ACC7A3 AAFC3D39A225D5EF F09569306C6BD42C 4FC2B655A6CFEF50 978AA22D23BC46AB 1B78B818AFA83295 8B80F3901C165651 A72251E9AD0E093B 34B71DF2BD975EFC 8FEE508910AC2D0D 753FE850B141A71C 20DFFB42FA6933F7 35B38A076D24704E 28E54DC5964B1D06 44627F5A014B8ACE 18A76B6F08D2D31D C47DDC962B49FE4D BF96B06AA14C8F46 3E275F61F87BEFC3 C554900F1B459D8C 24CE507C083E4F1C 0847B8A2840A1917 D98D76EC1732BF64 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 29c6409f-22a9-1c3e-88e3-8947754b281e
  2 7db05182-b492-6a38-9b8f-f2e59fb23984
  3 343a85e0-e368-3c1b-9b0d-4e5c1a753d27
  4 4b407f6b-ebbc-8915-85a0-a86f1ebffbe8
  5 3e73926a-5b63-6899-8ac5-0bc42731bfc3
  6 d9f1674a-e2c8-00d1-96e4-bd46c95cefe9
  7 5f2cce1c-0764-4b08-abdc-f9b20f1d2b84
  8 aabc0b33-5315-362c-a363-d65cab1a8077
  9 882099bb-6f80-41cc-9805-57fd2e08aefc
 10 6fa906ca-5222-7c2c-af71-db1db27e5afd
 11 ed922c33-339f-77eb-b307-ed87746f8c79

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 16386043477. Exactly this sequence comes out of new Random(845).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 11 GUIDs, seed 845
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 845 from the GUID masks (3DES(name) ECB, 11 GUIDs, seed 845)

Related

Findings: Mask digit · Count RNG & runs