201301010015 15qth4

I have found a solution for 15qth4 (title 201301010015), originally found here. It was posted on 2012-12-31 22:15:07 UTC, which is 00:15 on New Year's Day in UTC+2, the time in its title. It is the post A858 made in the middle of its New Year run (the filler that night restarts with titles counting to midnight in other time zones), and as far as I know it has never been decrypted.

It is 440 bytes, grouped as 55 blocks of 8 bytes, which does not follow the usual 32N+8 length of the filler posts:

452282acd3e1f1f1 c9b15d3027eee4df f48e526e7c3b2467 d73a7eefd0afd4b9
9e8c2b2340aa611c 2241e347b7dfb656 42bfa56d749214d0 d150bb7b470e40b0
655e9ccc09a066fa e51c99d8ea17a103 ca7cd2ddf77e5f3c 8b33f2868ef4eaa5
c0f9b2357184e355 ec8da1fcd03444b9 7d41586b427fd8af 913123700d411c0b
ea4789bb196a36c3 34ce3d99ced49ccf b413eebb0de1601d d3900db19fd820e9
338c399fa9de6cf8 4066e83db80076aa 2c17a7cb48473e7e 549505dd60369559
101b7132663ec7e6 31674fb2b6dff1e1 d8dce6bae874d93a 236eb6047c9dd042
aa7decd746f254df 2424e6404d012f38 bd078273d7dbe6a2 9321b55ac65949e4
8278521770dd0366 ce633e4a386c6756 eac75fd8c80e6404 4c1598727649a544
6954634998c125a9 aff5b7ebcbfe998c f5d8f271117f3b30 4d3f32a7295a7288
598f8698e120cd9f ca5d3abbd46ed77f cc3e76567dedb887 377740de31e44168
283cfdb184aaa97c 0e776f2aa35c1629 f1eede293a7fe8ac ad8605a68df8b8ef
a949255e7d9fee13 b27ee29ad5b2c912 46a760bd90640ac6 9d23d9bf044dfbd7
1cf797abc19ef324 1ae6aadf45df0bed 6279973795436444

It decrypts with des-ede-cbc (2-key 3DES in CBC mode), using the key MD5("2013") = 8038da89e49ac5eabb489cfc6cea9fc1. Not the usual MD5(A858DE45F56D9BC9), but the year it was welcoming, the same kind of occasion key as cakeday for the birthday cake in 1we0v9. The plaintext is not plain ASCII but UTF-8 box-drawing characters (each one is 3 bytes, E2 95 xx), 5 lines separated by CRLF, with a 1-byte PKCS#7 pad. The IV was never published, so the first 8-byte block is lost, like the other CBC posts from this period (15cd8y, 1iwqql, 1mjpwt, 28o545, 3j99nf, 1we0v9). The rest decrypts cleanly to a banner:

╔═╗        ╔═╗     ╔╦╗      ╔═╦═╦═╦═╗
║╩╠═╦═╦═╦╦╗║║╠═╦╦╦╗║║╠═╦═╦╦╗╠═║║╠╗║═╣
║╦║╬║╬║╬║║║║║║╩╣║║║╠╗║╩╣╬║╔╝║═╣║║║║═╣
╚╩╩╩╣╔╣╔╬╗║╚╩╩═╩══╝╚═╩═╩╩╩╝ ╚═╩═╝╚╩═╝
    ╚╝╚╝╚═╝

I read it as "Happy New Year 2013": the three descenders on the last line sit under the p, p and y of "Happy", then come "New" and "Year", and the narrow four-cell block at the end is the year. (That is my reading of the art; I could not find the exact FIGlet font it was made with, so if someone recognises it, please say.) It fits A858's other holiday posts: the fireworks "Happy New Year 2001" in nt82j (Dec 2011), "Merry Christmas" in 15cd8y a week earlier, and the birthday cake in 1we0v9.

About the missing first block: the first recovered byte is 97, the last byte of a ╗ (E2 95 97), so the lost 8 bytes end in the first two bytes of that character. The most natural top-left corner is ╔═╗ (the same shape as the other letter tops on that line), which makes the lost block e29594 e29590 e295. In CBC mode the first plaintext block is D(C0) XOR IV; here D(C0) = 6fab841f6c504abf, which gives IV = 8d3e10fdf9c0a82a. (Again an assumption, but the banner does not depend on it.) Like the other CBC posts, the IV looks like a fresh random value per post.

Why nobody found this before: 2013 is an obvious guess for a New Year post, and I had actually tried it earlier, but my check was looking for printable ASCII text in the first few blocks. The box-drawing characters are multi-byte UTF-8 (every byte is 0x80 or higher), so the right key was thrown away, and the 1-byte pad also slips past checks that look for a full padding block. What finally caught it was a plain uniformity test: decrypt the whole post and measure how evenly the byte values are spread. Random data scores around 0, and this post scored 955 under MD5("2013").

Steps as one command (put the hex above in 15qth4.hex; with the zero IV used here the first 8 bytes of output are garbage, tail -c +9 drops them; use -iv 8d3e10fdf9c0a82a and no tail to get the first row with the assumed ╔═╗):

xxd -r -p 15qth4.hex | openssl enc -d -des-ede-cbc -K "$(printf '2013' | md5sum | cut -d ' ' -f 1)" -iv 0000000000000000 | tail -c +9

(The plaintext is 439 bytes: 8 lost + 431 recovered, plus 1 byte of PKCS#7 padding, which openssl strips itself. Your terminal needs to show UTF-8 for the art to come out right.)