A858DE45F56D9BC9 archive

201208150000 y8sv3

explained decrypted manual

Operator test: 32 GUIDs, seed 591. 3DES, key MD5(name+title).

Metadata

Post ID
y8sv3
Title
201208150000 → 2012-08-15 00:00 on A858's clock
Posted (UTC)
2012-08-15 04:00:04
Timezone
UTC−4 · title 00:00 against posted 04:00 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
F3 filler: 3DES(name/title) → GUID list, seed known
Size
2,064 hex characters · 1,032 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9201208150000) = 0985609d8703c15fb56075c88aef8e1f (name+title)
GUIDs
32
Filler GUID seed
new Random(591).Next(9) ✓ verified
Run
aug13-15-triples (test)
Draw
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
19 · 3
Tags
automated (decryptable)2012Encrypted masked GUID listmanualarctic-onlykey: name+titlerun: test

From the post to its content

As posted (encrypted)

31D6BA18640C701A 475455EDCE4EDDEA 8B3F0E1C79C25A0D B30E8929CE8D742A 8A0FB9739183B649 FF8AEA6D7C8CD4C5 2CCB8D9409AE15AA 56A36620717B72CE 34AC008B7050F036 DF8BC7EE6A1D9BB8 510A6FA1A6FCFE1E 4DB59ACC7BB851A3 E99FCB8F7C5ACB9A EDEA0E4DE19EB996 636A392AE769232F 7242EA9E32FB3F8E 7583852349C815FA 04FDB87096AC9F2E 4077D9B7B958A416 45AD9D2602DB5C84 19A0C5D9FA2456CC 9B0C53ABF094BB14 5A4E723AB9015402 7C47AEDF0D1D23E9 AED077FE95B542A0 4791DAA77E4C5D3F F8D6D8FED9391C62 462762DB0250CA76 5CF15906287247D8 70B4064CC0D1B06C 98BAAB7EA6A9812B 043C4DE939422791 A661EC225373AC5B 81DA8917113EC52B 76ADDB622F28C177 5663255EC3164DED 55149CE9785E697B 7B639CE98CE7A509 601A2E3FA06D3C50 3F991FB8F92CAC86 4E860FEB05899436 9164F5CB10F93B2E 2B2A3CC92F774B00 FAFAAB673BA2B50F 340FD2DABC7B676C BE6343DE53BC20C3 171FC2A652E5C655 A77559A39EFD425C 24480C7A70280662 2F3748383D6B59A1 AA4D9A3A8C2A8166 63EBB675CF1E249C A15C690655607719 D59CAA57C8D5385E 39CAA9C8F5BC1F3B D1C8552A5CF8DE04 13462C42ED684236 716DB3AE0356F68C F0503DEB58A899E0 B03FB9A38969A3AE 80F3457C55959902 7F178D5543B598AA 4CB2EAF104093BE3 88C884A2ABC7CA39 FE2583AC807A623D F27AB768A0B5F2CC AC369AFC2335D45A 15A81AD0BDE97218 7D736AFB16617114 1980B9EFCF5206C7 180723F59110CE1A 3A2C810C439E76B9 CC7B32A0B4C81611 CBFC8196DCE605A4 4ED493CF9C44BCF5 520D9FB51526572A 0FCC9C87D863F4E4 53767015B7DDFC54 8B2088AA4B05BC60 FA060B7EEAFC30F9 02A881484DF24EFF B07DC099140247EF E3514B4DE1719995 5AC01C808FFD8677 1211256E0AA6B0A1 4A56ED9B7430009B 4E5907D47626B439 E0DBF4CAE2B10BFD 71C93CD0F99BEDCA 55BAA8D5618BE462 B20767217CCED093 846C70B909DF9102 BA05C94226D9E8CC 06F0C4727B11DB67 76CAC120DBFBDB57 70704A1F197DD724 C9307F8431E26CF8 83ED8764E2BDBD63 E27E4085C8B9A90A 2963E10128238547 243C58E80B7C02DD B96F97C6981F02AD 6119A881A58720C2 22CD45700994F28D C9016A028CCC9A02 108035F3EA2CE475 4A34636D6FEC3FF7 68BBCF593A2356F9 AB5676B172790675 8851ABFEB1CA88FD 4C27226F3F1AE7BB 49B4A7A60CF4D93D 06099AEDC33CFFB3 30EDFA42690E1448 498986D7652362FC D3958A0438570078 CA9927F13CFFF67B 6CA45B5AF757BE25 B63D4E815B8F2474 92282DACE0BAD4D1 83BE1925F5A5267E FFF96446C12B6110 E571CEC3E97A8F8B 8584549C7D4B987F 96A227FF4AE0FCFE 52602EF80998C540 AF3075B952382D2B B587BBC4FA5388D0 E7DD5738E02686F9
  • Read the ciphertext. Strip whitespace: 2,064 hex characters = 1,032 bytes = 129 8-byte 3DES blocks.
  • Derive the key. Password = A858DE45F56D9BC9201208150000 (name+title). Key = MD5(password) = 0985609d8703c15fb56075c88aef8e1f, used as a two-key 3DES key.
  • Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 32 GUIDs as hex (shown below).

Decrypted: GUID list

  1 a784509e-31d0-4647-8383-ba55f317ac20
  2 619685ae-0023-2cb0-933f-d8f6bed0da26
  3 e661eb27-8075-7b57-b919-98d2b002f86e
  4 37f25d0b-8f1e-6256-a482-3312ab36c4d7
  5 515ca937-21a4-0328-8aa1-95cc8b251ce9
  6 06af3ebd-dec1-05c2-87f2-62f4c872a7b1
  7 68f56e00-d576-6168-b48b-79b368a8607c
  8 bde98196-0790-84f9-b0d3-89e2389fc111
  9 563d3e10-a816-0875-ad86-d42d7901d261
 10 4ae02fae-175e-1f63-9ad9-c2325d60346c
 11 d478ab9f-4da1-6c64-8dd1-9b4fffa73ede
 12 ee98576b-b174-7eaa-a3b7-d69180aa6734
 13 def0f1bf-b820-8b9b-9912-6279c23450d4
 14 a01d8384-369c-89b4-bf4c-f288435e07bb
 15 05f5a1fb-f5a8-5c56-8473-e32d1be56a7b
 16 704355bf-af4c-1fc5-bc7e-041ed6123f38
 17 eb64d5e0-03d8-2c93-8ec5-fb989973e2ba
 18 c017fdc4-59d0-3bff-9bbd-467225337261
 19 35168739-fe46-65a9-af1f-a2de1c21d2e7
 20 21c38558-5430-1c7f-8a70-e2e88545ced4
 21 c1a14336-f291-3a37-b856-7e9e2e60819b
 22 e6a07584-0aab-700a-a58e-6cb8c666f0bb
 23 85e2aec8-b0df-7aea-90ea-73eca1846465
 24 f6fc81a3-9cfa-443e-8e73-30ae55ab3fd9
 25 bdcaecb2-230f-5cbf-87cf-8ad5c2da955c
 26 4256adfb-fea3-5429-8a7b-022d31ce2763
 27 12389ebd-e0a8-083a-ad03-7565cbea896a
 28 ce618fe8-278a-7237-9acc-4f87e24ada09
 29 11703691-c6dd-7c4c-98b9-ab51290a4f89
 30 30a393c1-706a-0d38-b8d9-e20e81f6b820
 31 95b6427f-07d3-37e2-9514-a610e85d8632
 32 229c2b5c-9567-163c-bab0-9590c8fbeb42

Explanation

  1. Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 42760068016788512361377455077031. Exactly this sequence comes out of new Random(591).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
  2. Explain the count. Grouped in aug13-15-triples: three 3-post bursts 1 min apart with title zones +9 / +4.5 / -4 around the 2012-08-13/14 machine/clock change (clock lead +150 s -> -1 s between them): operator setting tests
  3. Conclusion. Filler. The content is fully explained by the two RNGs.

Solution summary

Method
MD5(name+title) ECB
Result
3DES(name+title) ECB, 32 GUIDs, seed 591
Explanation
Pre-cutover filler under MD5(name+title) ECB: three 3-post bursts 1 min apart with title zones +9 / +4.5 / -4 around the 2012-08-13/14 machine/clock change (clock lead +150 s -> -1 s between them): operator setting tests; list seed 591 from the GUID masks (3DES(name+title) ECB, 32 GUIDs, seed 591)

Related

Findings: Mask digit · Count RNG & runs