A858DE45F56D9BC9 archive

201206260812 vmrh5

explained decrypted manual

Operator test: 10 GUIDs, seed 136. 3DES, key MD5(name).

Metadata

Post ID
vmrh5
Title
201206260812 → 2012-06-26 08:12 on A858's clock
Posted (UTC)
2012-06-26 15:10:38
Timezone
UTC−7 · title 08:12 against posted 15:10 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
656 hex characters · 328 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
10
Filler GUID seed
new Random(136).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

478002E488F887C4 5A53DC0724EEA234 8BC925E14A8DDD23 DC543CE8F51DE06B 39064240569EA445 732E130C1397E56B 7CF0B68D7E22F071 C0D8C592CA8D33CB E3774F574C7B02B6 44F54AC1FB7BC780 90B7629ACC622D87 39327C0D601D8CBC FC8809D4AE5605FC 9A03F4B5C3608B8C 1DFF6DB2D16EF469 D32DDF44BD8023E7 13ED2340444B39B9 1B7301A71DCBC31B A94515A9F4A27EBF 6B13E45333DCFD1A 8705FF4069C8B608 F3A1702D013BBC7F 4CADF902F8D07909 2689E1F29133EFBD DA2CE8ADE85297EC DA76C7A3C3713727 E3A86EC7E308E4E1 9CAADA0CCDBA17D5 6F6535B4D24D22EE FE558F5F9E73C95D FFBA91371EC5D0CA 394DB4878E1060A5 FF88EC80BC3436CF 8F80821DB3F422E4 28930DDC1D59C49C 8AD02A7DC1404D21 5272B6953F12412A 7548FF9061CAB90E 7981786B981FF676 37132021C6FC3C59 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 2ccf1860-228a-6116-b6e2-59759fb2562b
  2 6a550617-3244-62f3-bf90-9b953356ac45
  3 3e8fce17-bfd6-7cb2-90b8-ddf3b6bcb6be
  4 45fe01a7-2d6c-5708-a2a8-4bb3f61e37a5
  5 bae5ff60-feac-5bf7-bcbb-626916fd8a71
  6 3e27e1d9-3737-3626-b83c-24997f243f0b
  7 3af570c2-b9f2-7aba-9636-3ddcef65aeec
  8 8d5d6bf7-cdc8-69c9-bc63-a26e9778bbab
  9 f18b27a9-ac39-7db6-b906-97a8d515899d
 10 cdff1a0d-7001-3f4f-9ee1-93cf76ff6f40

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6675537673. Exactly this sequence comes out of new Random(136).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 10 GUIDs, seed 136
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 136 from the GUID masks (3DES(name) ECB, 10 GUIDs, seed 136)

Related

Findings: Mask digit · Count RNG & runs