A858DE45F56D9BC9 archive

201206260815 vmrnl

explained decrypted manual

Operator test: 8 GUIDs, seed 392. 3DES, key MD5(name).

Metadata

Post ID
vmrnl
Title
201206260815 → 2012-06-26 08:15 on A858's clock
Posted (UTC)
2012-06-26 15:13:49
Timezone
UTC−7 · title 08:15 against posted 15:13 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
528 hex characters · 264 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
8
Filler GUID seed
new Random(392).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
2 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: namerun: test

From the post to its content

As posted (encrypted)

3D010C43D91E7D31 C72B4F868EEC7D9D 5199A6AF09981B8E 64C0F4DE26DF45E9 0C87B344E8BBD2A0 A30BBB978E5ED066 486FA894140DA73D B5DBEDA00C03B2BD 484478C2CB354999 84BB8E766276B8F4 263A6522803935DD 1AF2878613A60E65 B3CAE67C9074CB8F D973820F08B72EA6 5DE67142B0CDB067 D3293CF7050D183B 063CBE1D90BD68B5 7AF4791A86461FFC D0155C9E2181EB88 635F998B04F750DF C4EAC0F08BBD5070 3594A2D4490A2A33 145B188560243E47 D03D4861F04FD0A1 D9CBF8D6AC9BEB1C F72C9FF1C06A576A 3FA8E4A3F7AD32A2 6EAA7457527E6BA2 D722E4E1F53F6F7F 04DFB6D7DACBF66E 193D55338D456BD0 AE36859F751BC6C2 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 528 hex characters = 264 bytes = 33 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 8 GUIDs as hex (shown below).

Decrypted: GUID list

  1 31bf0876-1444-4841-90c4-b5bcdd61ea54
  2 b1e0acd3-dff2-78c5-8452-497e384505ec
  3 5cb36c0b-e7fb-65cb-aa2f-184b9a006526
  4 d40e3ed8-cf6a-21a0-958f-c832014db087
  5 21375462-1138-1917-99cd-9f3365fb56ba
  6 f279933c-5b9e-1641-a660-df3ebeba63c3
  7 f08a50fb-bb4e-46a1-80e1-bd54e50bb3c9
  8 9653263a-6668-0de7-abd8-23a75e5f65d3

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 47621140. Exactly this sequence comes out of new Random(392).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
3DES(name) ECB, 8 GUIDs, seed 392
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 392 from the GUID masks (3DES(name) ECB, 8 GUIDs, seed 392)

Related

Findings: Mask digit · Count RNG & runs