A858DE45F56D9BC9 archive

201206260125 vmd01

explained decrypted manual

Operator test: 9 GUIDs, seed 918. 3DES, key MD5(name).

Metadata

Post ID
vmd01
Title
201206260125 → 2012-06-26 01:25 on A858's clock
Posted (UTC)
2012-06-26 08:23:33
Timezone
UTC−7 · title 01:25 against posted 08:23 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
592 hex characters · 296 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
9
Filler GUID seed
new Random(918).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

91967384F3600224 155D5CB0C9EFB626 25EDFE38EAF59BC7 FEB9197A9FF73B13 4636E3A2A4EB2733 83D8BF9E7605C557 5809DDC3801BB29A 361AE2695558A41D BDE1DD92D1483010 B536824466979D07 B22EDD010BA21481 EA81B0A9E2813A9E 4D844DE4885E888D 1ADE3789771799ED BDCAE4FC956B2C81 8FFFA9DBF30AB494 411E976CFFFCACE2 C1F7E3A613C431EA EE1DA97714032527 7DFB0A10F1AA6269 F82CD7FD8E48D8B0 51291EDED005B9B4 CB36B6E48D451B18 D3720542944C1368 64BAFCEBE7E14913 61EF14315387CBA6 4BEAC41118ED9C17 93BE955F4BFC4756 65DF78C7F6EC681D C5D50474ACEA2792 491E5ED2814AD38C 3DD8536F93F393A2 A687D56AC0B142AE EBDE2755237325C8 E57B387A496D8C2D 43884EF8D74CDA07 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a67fb81d-6905-23b1-a93b-94e3ccf48c40
  2 d871c41d-2004-1bee-901e-b972d94ab30c
  3 545c8592-78f5-3710-bbc8-7dcb56bc1a34
  4 8309aaaa-e628-4b57-8449-bf958f2487e4
  5 fe0a7262-2901-67b6-b600-d7673b9f5a24
  6 098a0ed3-0136-7bb1-a1be-1016e6bd261b
  7 eac416ad-04f2-149d-a766-b6631093120d
  8 ed25f73c-a7d7-88a5-a76d-b2ffbdc0ac2a
  9 4677dc7d-d1fe-4ee2-845b-2025b12d03ce

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 213467184. Exactly this sequence comes out of new Random(918).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 9 GUIDs, seed 918
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 918 from the GUID masks (3DES(name) ECB, 9 GUIDs, seed 918)

Related

Findings: Mask digit · Count RNG & runs