A858DE45F56D9BC9 archive

201208142120 y7kpi

explained decrypted manual

Operator test: 40 GUIDs, seed 300. 3DES, key MD5(name+title).

Metadata

Post ID
y7kpi
Title
201208142120 → 2012-08-14 21:20 on A858's clock
Posted (UTC)
2012-08-14 16:50:02
Timezone
UTC+4:30 · title 21:20 against posted 16:50 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,576 hex characters · 1,288 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208142120) = 20ed3355cbca1d9c5ad181d48951f8e6 (name+title)
GUIDs
40
Filler GUID seed
new Random(300).Next(9) ✓ verified
Run
aug13-15-triples (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
5 · 1
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: name+titlerun: test

From the post to its content

As posted (encrypted)

EB8A2038767ABC92 5DCC145A995B74AE 65214984F3E8F1E0 BE4C9A4A5138770F 4C1C1A109FFAD109 2D3E881B1D981D8E 7F9950DCA85C7985 F6BB1D22FD3E59BB EE1A5E811F996A3F 546DC092BCE05121 1A6B5749B51D4DDB CF35CEEBEDFB6B57 90CF656BB9A15D01 35341DBC2F6102F3 A855E92304A05478 B3A9AAA4FDD68F7E 373BDB45B8B8C363 1049311FBC25AE63 13E0A5908E49FE49 2C442FF5C1B5E1BD 35765B843A885486 008DCD5883EB5994 55978A57664DDF0D 613D1BBCC1372A53 0537221CD6240E1E 31427B2943275075 99698A99365FE4EC 54EECE49A450959C 50E220D8162FD187 0E2A8E4E53B2D2E6 59AA598ABC8DB488 FF05CBBDE632C5D9 FC405B06B3E79B19 79D5E250C6C54CE5 6BA21B684FBB780B 22AD1E2910DE7275 0F83A5B22207E3F6 4DA5C1F81533C627 F77FF2F6B604ACE6 0E67B9EC6D872041 D3A1D11F68A83E87 FC22D2961ED0CA23 416832EC99E25996 C43BEBB09ACC5058 1BC1CACE0C8BC5B7 A99685150611B63C 5ADD620D569DEC41 8273056DFF4A02EC 9EBE2558DAAE4B49 0C75B8A35D57FC17 89F79057861D0586 F5E3ACA4E1392426 A1DE25FA67759870 AE26707C71D24682 0BC2C436E0808DBA 374CE1C2FEBBEADA EFAE8F9D5B3B6BAE 8BDC276A02F5BE79 AF7A64D19D77872D 40AE453FE8C5D590 F0A522ACB4F8F9AA 937D70551E969672 4FDB963CF406067F 0078EECBE0D8FC83 E329C6C7650D053F F90EF22B19E638DA 7014A14A4A9A80DC D3368C582AE75894 110BE2B2974DD296 45B6F69C0BFB76B1 E6F2A2C34ABF68C8 C16F6F036209CE0D B89914436C0C152F 155966CAD4569BD4 786D8F4E87AD97B0 1EBCAD607FD31CCF 325E2BBF6DBCE0E4 CEF56EE1D537116C 0ABCB0551B758991 4230A39D816B624C 43154764B6145A57 32BBC9BFAF68964A EFE439F7ADBB15FC 4384129CC5C73DDA 6E86250BD389D9C7 05E0CAA611D71B9C CDC4E91B03FA8C24 94D651B9EF60A2AD 7E860818941AF8BC 2923210FE034F2AC 4A1E569D6373324D 2DBED82F7F468157 DE1FA41D1E16F7D4 E4B1B8008E13EEEE 9250D7F754A929FA E765A8055B42460C 0ACD95A4B74BF1B6 292ED0C14CFFB432 9ABD982D2E11BFD6 8E791C8F2B100044 CCE57506BEDBF443 931807EB96823F74 62EB5D67F7A23EAB DB5F71D1047BEF5B BAD6B3A1CCB19CE4 D21150DA886A11A2 82458DAADBE9E9E9 C0B425FC7B46D6BF 1B42AF15FA6D7A0E 5F0510B7BEB6329C 95E00915EF585F61 682EDFA3D4AFB74F 25A64055EEDA6B56 2C5B868268C80CC5 67FDE2488E73881B F2B1BA4798D7AC34 0BA1B89CD461A59A 8034F712107638AF 4162904B5D7C5EB3 9FB38595539E7FEA 452EE019CEB594BC 7A43B0CC053482FF 8BE3544D5ABCD6B3 12F83922E22E6FC1 ADA22890C3481F96 0DF4163B740324FB B7AA96EDA5CD53BC 678AAAAAA4DE0809 A623DE6638DD57F8 54D969CC673F2C39 87398410DC037F38 06434C9D471A02FD 7069846DF7B43534 8FA8964809A5C1DA C5CEA34B5DCB8B0F 5079880CDF9E21DE BBDDD3076A9358C8 82E2F3397F9D0209 907A5D110BD75D95 70C27F5EDC6AFBED CC1B9446957862AD 4076AA1AAC73D91A 980E5A8B92DBC45B DA9E11CB5AB8C26D 57737F6ABBDEF8D5 127AC79A773DE740 77A3802C629F4B46 F3A2353188C176D5 628EF4AEAA7472FD 430E8026C5A0C0B0 BAF54C63E1FF19B9 39F3065D0C502FE9 2A3BA963AA05274A 1C6304DF48D0DB37 250D624DE2DE6281 0DAF003D7C35DAA4 6BAD490B117412F5 E7BC06EEBF562FF5 057ABDC8E317791B 6FFB625B70ED95A2 A4FB021CDE6433B0
  • Read the ciphertext. Strip whitespace: 2,576 hex characters = 1,288 bytes = 161 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208142120 (name+title). Key = MD5(password) = 20ed3355cbca1d9c5ad181d48951f8e6, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 40 GUIDs as hex (shown below).

Decrypted: GUID list

  1 679ca214-22a8-4ecd-81af-fac90a52b364
  2 fdd4ea94-116a-7060-8dfc-c44a4a9b387a
  3 b44ba5fd-f739-4b6b-a56f-291d2142b1d6
  4 8faa832a-9f49-52b1-ada1-f4dc08bc9d83
  5 907f2d42-a78b-5ee8-b720-ba694752daa2
  6 f3082af6-f3fe-64ea-8871-d8547eef4a12
  7 5e392236-b3bc-2bed-84d9-9467329ec59c
  8 b6b114ca-7cc8-8876-833d-5fb279b0862a
  9 49560bd6-1bd4-079b-917d-994cbacd0d8b
 10 627a07f9-5543-8af9-aa8a-775c2381da80
 11 62a035d7-f356-28ed-b133-2eb9111d8b78
 12 d40554bf-ac02-6001-8e6c-f45ba1870c5a
 13 7e0bab20-0e94-77d5-a627-de6bb488d5c9
 14 cd67d61d-ac1a-4edc-93d2-3383a5f24385
 15 4fe0b2d3-8bee-8beb-906b-523553a34896
 16 89987d8b-707b-3e53-87c0-ed9aa12beed3
 17 c725d2bd-0992-896f-92c6-fe624d3aab64
 18 518314d3-12f5-82ed-ad66-262a148243d0
 19 b917173c-7ab6-761a-8329-11a334444d73
 20 10a1b9d1-a7fa-432e-972a-3ea784f21dc3
 21 bbe68ebd-3005-6a15-b2f4-e08d0084a616
 22 43b6b01f-4326-4ace-b98f-c22ef67445b0
 23 b0e76c71-c25e-6dfe-b66b-48948754952a
 24 e6c1c799-b367-7455-9db4-cfdd90cfee90
 25 c0ceadaa-bcf5-0ff5-ae9c-58e78ad5a7be
 26 c9b8223e-c07e-4f8b-a03d-7071cf896d8f
 27 cdce3524-12e6-7547-8c5a-10171d07e64d
 28 572ae472-1e74-5cc6-8a73-1e01d63902a0
 29 e696967a-9209-3571-bc20-f280978bb87e
 30 1ad6846b-c1bb-6904-b9f4-04d043178f24
 31 e4e41f03-6959-8dc8-854b-a52aea1fdda4
 32 76ab18f8-5b06-4c30-897a-6b6b4ce200a4
 33 902660bd-aa89-82d0-ab4c-339a9b7b943d
 34 dd8df0fc-534e-40fd-9183-6026ab92d24f
 35 b69f9217-902c-3083-8f5f-d56d527fffc4
 36 1e385dfe-ef56-6117-b1d6-980bfd5c6704
 37 ebe0a07e-ce49-4def-ac35-b1a7b96594b3
 38 c650e1ff-a4ad-77e3-ab4b-724769afa6b2
 39 6db45447-a62a-6c15-87c3-f8106f01181b
 40 86ec94af-f9e4-2a52-86ff-2b1daea9153e

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 4745562808267483887464670475368484364762. Exactly this sequence comes out of new Random(300).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in aug13-15-triples: three 3-post bursts 1 min apart with title zones +9 / +4.5 / -4 around the 2012-08-13/14 machine/clock change (clock lead +150 s -> -1 s between them): operator setting tests
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name+title) ECB
Result
3DES(name+title) ECB, 40 GUIDs, seed 300
Explanation
Pre-cutover filler under MD5(name+title) ECB: three 3-post bursts 1 min apart with title zones +9 / +4.5 / -4 around the 2012-08-13/14 machine/clock change (clock lead +150 s -> -1 s between them): operator setting tests; list seed 300 from the GUID masks (3DES(name+title) ECB, 40 GUIDs, seed 300)

Related

Findings: Mask digit · Count RNG & runs