A858DE45F56D9BC9 archive

201206260229 vmeqf

explained decrypted manual

Operator test: 8 GUIDs, seed 27. 3DES, key MD5(name).

Metadata

Post ID
vmeqf
Title
201206260229 → 2012-06-26 02:29 on A858's clock
Posted (UTC)
2012-06-26 09:28:08
Timezone
UTC−7 · title 02:29 against posted 09:28 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
528 hex characters · 264 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
8
Filler GUID seed
new Random(27).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

E87006D6A3D793B4 06E193FFDB3E0324 A776006244A8C168 8B2D711C7C5D1748 DE772ADD80C9D6D6 792AF8B9E2440058 26AB92FF89E2200B DEFF163E489F486F 2FCF4AF3C1D33AF3 1AA567D52AC64259 E060FCE09BBBB8E9 CA7202DF32CE5683 D9A4CE0B2767B2A8 1C916F05E4489B26 DF1E12A1C14CA076 E3F3CD05B590E210 EE273AABEBD3CE91 3F02FC414B7E64F7 A51E54D234948990 CFEB8B553EB5569F 0A580789217CFE2B 544FA87C69157B1D 27CCB7E50AB616A9 03D987BBB8D9E39F FDF5995B297D1A03 FA1D09B4F44B6BB4 2516857CBBEF88CF D403B98CCF41F354 16AA38027924C85B 64BC42BBAE5E0556 93AD939AAA4ADE9F 85CF2C74125B4B4D 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 57598b80-ae65-7ef0-a8a9-6f72b54c9ab6
  2 84effc0d-ce52-6cfd-a78e-f9635fcc025f
  3 5c2331c6-4735-5991-b5ed-c406b54fbb38
  4 bdc810bc-6ef1-24f1-a5cf-7051e4bc27c7
  5 86e42149-7783-38ff-974d-851725f3e459
  6 0e6e3acc-f021-167d-b274-674447c2f96f
  7 51f4d7bf-82ce-010f-ab1b-4b5c61c0c9c4
  8 c38f4385-8723-89eb-9b77-eede8b0a76ad

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 76523108. Exactly this sequence comes out of new Random(27).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 8 GUIDs, seed 27
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 27 from the GUID masks (3DES(name) ECB, 8 GUIDs, seed 27)

Related

Findings: Mask digit · Count RNG & runs