A858DE45F56D9BC9 archive

201208140341 y5nvr

explained decrypted manual

Operator test: 11 GUIDs, seed 253. 3DES, key MD5(name+name).

Metadata

Post ID
y5nvr
Title
201208140341 → 2012-08-14 03:41 on A858's clock
Posted (UTC)
2012-08-13 18:38:40
Timezone
UTC+9 · title 03:41 against posted 18:38 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
720 hex characters · 360 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9A858DE45F56D9BC9) = 0dcc4bd9e114ebc42078977dc9125404 (name+name)
GUIDs
11
Filler GUID seed
new Random(253).Next(9) ✓ verified
Run
aug13-15-triples (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
7 · 0
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: name+namerun: test

From the post to its content

As posted (encrypted)

53E7ED5124867C98 1BAA4BA72A602032 2604D8A2DE080BD4 AD0CC018680B2899 05EB01794547E27B EC4B357F5588BADF 3035B78DF54C0D2C A71C89BDBE95665B 63BD85C030C55AB6 BE6A1C6867A941E8 CA3002043F33590A 37A9052B94923147 49085DADF512622A BDEDCB7D77AAE188 7A9FB007D17861C7 79F88B5E7AB59213 118F20A2C8E20886 2645C6A8A1A2A133 22DB955736CD4A1E 32AEF5F295906BF1 37F3C81300D2E7B9 C95333E266B5A9A3 CD577395EC9600EE 2F9F55637005BF86 1C3C18AD942836D5 C3B94CE499A54DB5 2E3F4808BC767352 2DA47356A051C0F6 3433FDB10B7EA613 6907DE407AFA0F8A 36FE46B31A049407 AF7BF704ACE8B14E B4A1A55EBE221DA4 3D93B4F0016AC4E7 437F0E90A09B7C7F A58BA58616626522 A59AAD3A58876C55 5D40DA11C8179A49 CDEA42D29B1764F0 82D2657DEFFEC559 FDB25207A2BFCD96 789F9E81CACFBD70 C584A954A24219AD 13CB64E15A5541B0 12ECFFDF2899BD4C
  • Read the ciphertext. Strip whitespace: 720 hex characters = 360 bytes = 45 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9A858DE45F56D9BC9 (name+name). Key = MD5(password) = 0dcc4bd9e114ebc42078977dc9125404, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 11 GUIDs as hex (shown below).

Decrypted: GUID list

  1 14f84421-0959-874d-8aab-0b98ae6d2734
  2 a4b87872-c113-0a03-80f2-0d62e0f2978d
  3 fb44ecca-d19a-51f7-9df5-57f63893ff42
  4 12d53bfd-14e0-54a9-9c09-12f3c8bdb6a2
  5 778c5c92-c722-30b9-b7aa-17afaf2def3e
  6 8dc2618f-9710-5739-a445-676255591029
  7 d45ca36d-e3a4-2b3f-a54e-ce7b6a19175b
  8 9e95b5a9-0793-3758-aae1-83f757d4ecd3
  9 9f8f0715-25db-29a2-856a-a7760808f2b7
 10 0a5b1291-22b0-5922-8b99-b41f075de066
 11 e4a175f0-a405-61af-84cd-00decdb65a8d

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 80553523256. Exactly this sequence comes out of new Random(253).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in aug13-15-triples: three 3-post bursts 1 min apart with title zones +9 / +4.5 / -4 around the 2012-08-13/14 machine/clock change (clock lead +150 s -> -1 s between them): operator setting tests
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name+name) ECB
Result
3DES(name+name) ECB, 11 GUIDs, seed 253
Explanation
Pre-cutover filler under MD5(name+name) ECB: three 3-post bursts 1 min apart with title zones +9 / +4.5 / -4 around the 2012-08-13/14 machine/clock change (clock lead +150 s -> -1 s between them): operator setting tests; list seed 253 from the GUID masks (3DES(name+name) ECB, 11 GUIDs, seed 253)

Related

Findings: Mask digit · Count RNG & runs