A858DE45F56D9BC9 archive

201211101158 12yvg0

solved decrypted manual

The bot's restart time, 201212031123 (23 days later), with the MD5 from the jgxlk GIF. 3DES, key MD5(name).

Metadata

Post ID
12yvg0
Title
201211101158 → 2012-11-10 11:58 on A858's clock
Posted (UTC)
2012-11-10 16:58:13
Timezone
UTC−5 · title 11:58 against posted 16:58 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
S solved 3DES → text
Content
Operational notes
Size
96 hex characters · 48 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here
The decrypted time 201212031123 is when the bot restarted, 23 days later (11:23 Pacific, the first post after the silence). (new results)
Sources
community-archive, arctic-shift · body from community-archive
Links
Reddit · Arctic Shift · JSON
Score · comments
11 · 0
Tags
automated (decryptable)2012Solved special postmanualkey: nameoperational notesfound by this project

From the post to its content

As posted (encrypted)

1A0D30234677DA4A 59DD15F30A9E9004 83D640CA53BA577F 165CE2BE3DA55125 0BD66DF009A6AE05 6DAF24475A69C612 
  • Decrypt. Key: MD5(name) ECB. 3DES-EDE2, then strip the PKCS7 padding.

Decrypted

201212031123
34A14A42E98FF96095AF56604E290CAE

Explanation

Write-up

I have been going through the timing of the posts, and I believe I found what 12yvg0 (title 201211101158) refers to. It was originally found here:

1A0D30234677DA4A 59DD15F30A9E9004 83D640CA53BA577F 165CE2BE3DA55125 0BD66DF009A6AE05 6DAF24475A69C612

This one has been decrypted before (see the wiki page). It is des-ede-ecb with the usual key MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae, and it gives:

201212031123
34A14A42E98FF96095AF56604E290CAE

The second line is the MD5 of the name, the same value that was hidden in the 201108121018 GIF and shown in the sidebar back in July 2011. The wiki notes that there is no post titled 201212031123, so the first line has been unexplained so far.

It is not a post title, it is a time: 2012-12-03 11:23, US Pacific time. Here is what happened around it:

  • 2012-11-10 16:58 UTC: 12yvg0 is posted by hand (different length from the regular posts, as /u/fragglet noticed at the time).
  • The bot posts twice more (19:00 and 23:00 UTC) and then goes silent, and the sub goes private the next morning.
  • 2012-12-03 19:23:00 UTC = 11:23:00 PST: the first post after 23 days of silence, 147qlw (/u/fragglet commented "Welcome back." half an hour later).

So the message announced, three weeks in advance and to the minute, when the bot would start posting again, in the operator's own time zone. Note that the post titles themselves were not in Pacific time at that point (147qlw is titled 201212031422), so the time in the message was typed in a different clock from the one the bot used for titles.

More support that this is a restart and not just a coincidence: the regular posts from then on (every 33 minutes) come from a freshly started program. The number of GUIDs in each post is drawn from a .NET System.Random that is created once when the program starts, and 147qlw is the very first draw of a new instance. I checked all four decrypted messages that contain dates or times (201210080311, 201210121742, 201211101158 and 201307231045) against every post and every restart of the bot, in every time zone offset. This is the only one that matches anything, and the chance of a random restart landing within a few minutes of it in Pacific time is roughly 1 in 5,000.

All the steps as one command

echo '1A0D30234677DA4A 59DD15F30A9E9004 83D640CA53BA577F 165CE2BE3DA55125 0BD66DF009A6AE05 6DAF24475A69C612' \
  | xxd -r -p \
  | openssl enc -d -des-ede-ecb -K "$(printf 'A858DE45F56D9BC9' | md5sum | cut -d ' ' -f 1)"; echo

and the time of 147qlw:

curl -s 'https://arctic-shift.photon-reddit.com/api/posts/ids?ids=147qlw&fields=created_utc,title' ; echo
date -u -d @1354562580; TZ=America/Los_Angeles date -d @1354562580

Solution summary

Method
3DES-ECB, key MD5(name)
Result
'201212031123' plus the GIF's hidden MD5
Explanation
Explained: 201212031123 is the bot's restart time in Pacific time, 23 days later
Re-checked
3DES MD5(name) -> forward reference