A858DE45F56D9BC9 archive

201206260217 vmeen

explained decrypted manual

Operator test: 14 GUIDs, seed 525. 3DES, key MD5(name).

Metadata

Post ID
vmeen
Title
201206260217 → 2012-06-26 02:17 on A858's clock
Posted (UTC)
2012-06-26 09:15:27
Timezone
UTC−7 · title 02:17 against posted 09:15 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
912 hex characters · 456 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
14
Filler GUID seed
new Random(525).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

C5AE73FF18E0762A A64838CCD5FE0065 5F4065246C3E6AD5 9BE66B69E783BCCD F880CBC8C350F885 773DB504EDA8AEDF 6ECAE8C8068C715A 427BB86539A4B9D7 832AAC09AD7F04D2 2C9F151D53EF8E07 FCB9D9B0B5193055 135001A17170BC30 F85984ABBC83AF13 8971EC5DFD74F7E5 6CF2B2C1740D094F 6F64B31967A52198 CD6D32DAB04A8B16 6D559FADBC03CAB7 4A5649BEBAF832D4 649ABACC91E664E8 D53255D2E109A243 A4009BC70523D732 C89BC9A50C8BA2F2 0A77DEC3157F63FE 76002BD07857EFC8 11CDB3F7E7255981 63AFC87EE7711C16 F6B956E47FFD248D CF3887F43A7F092E 3B2816AE47ACE6F2 35E2BDFF1EAB95CF 37A9948E08BC0DEE 56F7F03766BCA8A3 D3C3A1D2F617C861 C4A8CA2396F57E10 AB1030C1F1DB5EBA D26464814FE0E63C DD679025D6731D64 524125423091A7B3 0E675F0147095C2B F59FC9AE8D2E7323 E4572DBC9D2A390E AF451ADFE5F475E2 6543BA32B0E5A839 B911F34E1036FE0B CD30D1CAB1EAB3D2 3F2E2FA3B5A07385 3271D46ED110880B 53620ADC5DA1DF8D 944BCB98C41538C8 1B8EF44EF7E8E999 D88DF73C7F3E5C1E A5EE11F26C0503E7 518BCF66D40E5731 D5DC597ACBE4B785 2AC3BC412A11E7BA 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 912 hex characters = 456 bytes = 57 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 14 GUIDs as hex (shown below).

Decrypted: GUID list

  1 86af6762-7183-8061-ab69-235bf9c305da
  2 a33b3376-dabc-71e0-b963-3784ae2b5ffe
  3 9795ef21-aff3-6ac1-a493-a0754f3d5c4b
  4 257946ec-939c-59e5-abe4-c60cfaa3c03e
  5 ae64640b-0e50-2dbd-9c69-0a297c2d6697
  6 ca93d087-60f8-3dac-bf83-633b8db33b6e
  7 6554f9f2-e3bb-1116-9701-9c777d747814
  8 b24627d3-c9c3-781a-98b7-283310d35879
  9 50d33bff-9a4c-8553-a7dc-40690bace943
 10 d0d97673-ff4b-70c8-b4c9-6d9ba34fd6e8
 11 e6f617b2-b3b4-00dd-89d4-616fd2541107
 12 d14e4e0d-3f67-38fc-8d72-733c9ca71bcf
 13 b66ff8c8-037c-4082-90d5-549e704fa595
 14 68257b4e-e409-5b5b-a480-cc188c8c408f

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 87652317870345. Exactly this sequence comes out of new Random(525).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 14 GUIDs, seed 525
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 525 from the GUID masks (3DES(name) ECB, 14 GUIDs, seed 525)

Related

Findings: Mask digit · Count RNG & runs