A858DE45F56D9BC9 archive

201206261040 vn0e0

explained decrypted manual

Operator test: 10 GUIDs, seed 109. 3DES, key MD5(name).

Metadata

Post ID
vn0e0
Title
201206261040 → 2012-06-26 10:40 on A858's clock
Posted (UTC)
2012-06-26 17:38:20
Timezone
UTC−7 · title 10:40 against posted 17:38 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
656 hex characters · 328 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
GUIDs
10
Filler GUID seed
new Random(109).Next(9) ✓ verified
Run
Operator tests, 2012-06-26 (test)
Draw
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
19 · 6
Tags
automated (decryptable)2012Encrypted masked GUID listmanualkey: namerun: test

From the post to its content

As posted (encrypted)

A4244730C53B5944 8D75F8279F28B222 9DC1B0C83D986A35 55E39AE972DC2E84 5CD4B9E5181FC56F 3BF2B6E16034EBB1 A4D36374004770AE 64E8C47D87D64220 C8211002D89A334E D8198A9575522A11 2081C72A48EBF99C 98BD8BCF5AF46F48 93103F4C98115BF8 D82761F376323CE9 7587AB13951B255A 5C285F569FE03411 759D127468984BAD 37671141246462D9 D0ED6F9D466F56CC 14F0EFA01D9D2CF2 EF774FA51B324134 27158376AA258032 A18FA063C1E479B3 D7ACD210CBB7D3B3 D287D82D4872C420 3D9E21DA31A1101B 4415066C6C6D5CFC 2A41E6542F67AF6C 0CA05988153F001D 9F3CFE9532B8EA3C 27D4D46C12BF839F DD42063F779E9391 FFAB5E4AF31A1D0B FED988448EC5FEF2 F91F519493B5BB8D EDE3F3D2AFE0BC3A 934682F151944F2A B02D99890F803A2B DD127A43F977A5D0 57C4B5D116B3ECC6 5DACFFBA8FF64DBD
  • Read the ciphertext. Strip whitespace: 656 hex characters = 328 bytes = 41 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9 (name). Key = MD5(password) = 34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 10 GUIDs as hex (shown below).

Decrypted: GUID list

  1 367ea03a-b777-6e8e-a958-a9cc93022f1d
  2 34c9e74d-b573-78a4-aae8-428e203c7831
  3 c4f7d280-fb2d-8dd8-992f-defa5d3f6057
  4 85b0f7b0-7771-759f-a3dc-a11d12d9e87f
  5 6386ec72-f4ba-3a50-a763-3f93884ffd48
  6 41c5757e-0821-7952-9cbd-f39b9d2bcdbb
  7 2c91be6a-b954-6652-bae6-dc37dabb8d44
  8 c1d4007d-e1f1-16ee-abfe-927079d78175
  9 f90e1d23-9e94-4c59-988f-814db6850a04
 10 2e2e1736-1173-41d2-9062-aecf2112659a

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 6787376144. Exactly this sequence comes out of new Random(109).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in Operator tests, 2012-06-26: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts)
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name) ECB
Result
seed 109
Explanation
Pre-cutover filler under MD5(name) ECB: operator test session in true Pacific time (morning burst, pairs seconds apart; 15:10/15:13 and 17:37/17:38 pairs just before the 15:25 and 17:45 app starts); list seed 109 from the GUID masks (seed 109)

Related

Findings: Mask digit · Count RNG & runs