The 2011 GIF posts

Five posts from 8 to 17 August 2011 are GIF images. Four differ from a baseline GIF in one short run of bytes, and that run carries a message.

Between 8 and 17 August 2011, A858 posted five hex-encoded GIF images. Each post decodes from whitespace-separated hexadecimal to a GIF89a file, and all five files are the same size, 3,901 bytes. The first, jcm5f, holds no message and serves as the baseline. Each of the other four differs from it in one short, contiguous run of bytes.

Finding: the run of bytes that differs from the baseline is a hidden message. Four messages, read in two ways:

Two ways of reading the bytes

Plain bytes. In je00i the link is in the changed bytes as ASCII characters. In jgxlk the changed bytes are the MD5 digest itself, shown above as hex.

Nibble pairs. In jf2zh and jlcv0 the text is packed across the changed bytes, so that each character is the low half of one byte and the high half of the next:

character[i] = ((byte[i] & 15) << 4) | (byte[i + 1] >> 4)

The run gives one character fewer than it has bytes. So the 13 bytes of jf2zh give the 12 characters of 18033-3:2005, and the 21 bytes of jlcv0 give the 20 characters of http://redd.it/jkuyr. The jkuyr that the link names is an encrypted post from ten hours earlier (see the last step below).

The standard in jf2zh

18033-3:2005 is the designation of a standard, not a serial number. It names ISO/IEC 18033-3:2005, the part of the ISO encryption standard that specifies block ciphers. Among them is TDEA, the Triple DES algorithm. The notation DES-EDE names the same construction: DES applied three times, encrypt, decrypt, encrypt.

Every decrypted post on this site is Triple DES in that form: all 3,522 of them. Most use ECB mode, and a few use CBC.

Clues for the other posts

Two of the messages appear to have supplied what the later decryptions needed: the cipher, and the key.

• The cipher. The standard named in jf2zh identifies it as Triple DES, DES-EDE.
• The key. The 16 bytes in jgxlk are the MD5 of the account name, A858DE45F56D9BC9. That digest is the key of 550 posts, among them 15cd8y. It is also in the decrypted text of 12yvg0. Nearly all the other decrypted posts use an MD5 of the name with something added: the post's title, or the name again. When the GIF was posted, it gave the key to the posts keyed this way that were still unread, and it showed the form a key takes: an MD5 digest.

The last step: jkuyr

Read in order, the series teaches one puzzle step by step: data hidden in an image (je00i links an article about passwords hidden in photos), the cipher (jf2zh), the form of the key (jgxlk), and finally the post to use it on (jlcv0). Everything was public within nine days.

The pointer came 3 h 45 min after the solver's comment, which fits an operator who was reading the threads, though it does not prove it. Only one form of the grid gives the sidebar value: the nine GUIDs as one lower-case string of 288 characters, with every space and line break removed. Used directly as the 3DES key, that value opens jkuyr, and the result is eight more masked GUIDs (seed 469): ordinary filler. The solve was the reward. Asked later about the GIF series and two other puzzle posts of 2011, the operator said they "were done to create interest in the reddit, and as fun puzzles." jkuyr was first decrypted in April 2016, almost five years after the last clue.

What is checked

• The comparison. Every changed run is one unbroken stretch of bytes. Each GIF is the same length as the baseline, and the site's data import compares each one with jcm5f. The offsets and bytes on the post pages come from that comparison, not from a copy of the text.
• The sources. je00i, jf2zh and jlcv0 are checked against the community archive copies. jgxlk is missing from that archive, so its GIF comes from the Arctic Shift Reddit archive, and its digest is checked against that copy.