A858DE45F56D9BC9 archive

201206260128 vmd3p

explained decrypted manual

Operator test: 10 GUIDs, seed 40. 3DES, key MD5(name).

Metadata

Post ID
vmd3p
Title
201206260128 → 2012-06-26 01:28 on A858's clock
Posted (UTC)
2012-06-26 08:26:39
Timezone
UTC−7 · title 01:28 against posted 08:26 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
656 hex characters · 328 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
10
Filler GUID seed
new Random(40).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

24420051AE161E58 7982C6ED4CE78BF3 EB5997E3E69874CA CFDDF333EB6FE0E5 282C4D27BE72C3C1 4F2FA8163141D941 29DB8DDC535471CC 6B0932965927D2BA 6463C6167E3BCC6F 8F498D4EFF149552 E4F5498CE9585F29 12BC82DA20D3DAEA B4DBDAA065BB0361 3B7C5DEF49BF91AF C215B6B7C6EDE63C 17B8C9846171B04E CAFD35BA8DB87AB3 EE5B35B622DD52D6 690B19D8AA2E028B 3E8DC3B9442284F4 6156DF1B3E0F5976 4948289E14960904 EA4615E4B357923A A750AE3D6D68504F 0DE24CDA4CC2350B 0975670D7ED4192A 2BC217DEA3C429E7 FD9D9303088293AE 1420EDF0107F5969 E8E74C27921661F0 774FEBADDBFA4C13 F772F0BE028D4E20 D6CB576ACBBD5EE1 4CF338135DC7B561 394677205E3FCA60 872BF835FB4D65C6 8869CF03A9EBD7A1 3D387BE304A3EC10 65DC07B1ECE3F74A F91097949DCE9C16 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 ce484d7b-16ed-581f-afb8-f845a3e523d1
  2 a81ee1dc-9057-4d20-9c30-bdb6530bc30d
  3 2942c715-dde4-6940-be7d-2033a915c9f9
  4 d4f29fe7-0c43-0280-841a-2bb35610ef27
  5 2f1c2387-d46c-2a99-a089-3d149704a1dd
  6 a37263f7-e5b5-4233-b3fb-2745c9f39764
  7 6da46378-4780-7a35-8bad-ce69642e2b92
  8 baa27a0e-e56c-41e5-a4fa-685684dbb8df
  9 9e7dd41b-3bba-8964-8516-366aa31062ec
 10 212f821f-f600-0d97-bc61-3bad3c565415

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 5460247480. Exactly this sequence comes out of new Random(40).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 10 GUIDs, seed 40
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 40 from the GUID masks (3DES(name) ECB, 10 GUIDs, seed 40)

Related

Findings: Mask digit · Count RNG & runs