A858DE45F56D9BC9 archive

201206260109 vmcjx

explained decrypted manual

Operator test: 15 GUIDs, seed 46. 3DES, key MD5(name).

Metadata

Post ID
vmcjx
Title
201206260109 → 2012-06-26 01:09 on A858's clock
Posted (UTC)
2012-06-26 08:07:36
Timezone
UTC−7 · title 01:09 against posted 08:07 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
976 hex characters · 488 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
15
Filler GUID seed
new Random(46).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
1 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

1593F7C269203EBE 4F6579C96596AA13 A8EEAED9A9E049C4 94AAC335F4EB0481 8DB8A5E762857306 FA91664E34B94A6B 84476265CA918098 83E8E30D9B5192D4 606650ED068C8208 919F0C0AE5B7D955 FA5A60826E1366A0 0DD6B0ED2D54D364 97A89066861F4141 E675BF016C001D6F 86EFBC0DA2BF0BBA 3E31B35D7AF53D3C D6E876B2DBEB6A41 4FBF0F32D0A27736 54F00154AF6C099E 9782058B88062F51 79C5A4DB5B69A3C7 D850010284FB7606 132E1149FD08BE0A 94894B01B556F514 1F12673A528F5322 D5CF498F89AE6BED 0238C9E6D888F4A5 5537575EDD085F80 7B8B032EAB02A77B 9D7D2F4F8F2D89AA 85F631292B65D132 15C0F35B8A98AABC 3BFC18762D131D94 CED13D2D97A37E0A 3EB96EBD1F370D5E D329093D7BA5A339 925D2FFBF2E7255E F18E095355D50ED7 25B7202DD5578C12 DDE62B1C76BC9822 C3D841A8D115D773 89508B789BC6C97E 9E3B734034324FF3 2A28056AAC2A8EE1 844448BF3C440349 72E89A4BC355210E 4138A24AC9E4DC1B 9CD6F55C9EF5D5EF 50F9B74CD7A42E8A 70A96058073BEE5D F00A2628A3C6353F 97C9FD9A26E7EDD3 8C21A16EDF05ED26 C109805800A0D721 5D660D7B6F5907FE 42DB625C6DA37D86 FA9730AC10402820 331D5E4F261C3284 90D2C04770A71F8B C4522E49F26A4B90 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 976 hex characters = 488 bytes = 61 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 15 GUIDs as hex (shown below).

Decrypted: GUID list

  1 735f957a-71af-6898-b59f-5b32e7071f65
  2 8684df6d-f90c-2ee1-8626-4cfca413d1d0
  3 4d600771-0b22-8626-9b8d-3369e8433c51
  4 6e6ef0fe-3e9f-3981-86fe-561376c3b60f
  5 521fa9d0-e5e5-82a1-93ae-6ed6b22aa1d5
  6 79ed7456-e428-65e9-b01d-19b8da9e5305
  7 706ba334-e743-4fe9-a030-9339054da046
  8 0667f4b9-836c-40b8-b864-bae2c62fb515
  9 e4d4e043-8fd0-62c8-8ff3-0697be9453af
 10 d018527c-f8ee-2db1-a011-49456fba0ae4
 11 bc90e53d-ba08-1c9c-8b62-aa8bb794c274
 12 b93789f1-eb27-32d9-8eb0-be87f9cd0cee
 13 f38e3703-cfa8-22f2-9d9c-6d72a2b7a72f
 14 5f68acb4-6f39-3b16-bcb6-c673b695bb67
 15 dccaec1d-995c-130d-adca-d5a614346380

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 628386446213231. Exactly this sequence comes out of new Random(46).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 15 GUIDs, seed 46
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 46 from the GUID masks (3DES(name) ECB, 15 GUIDs, seed 46)

Related

Findings: Mask digit · Count RNG & runs