201112021751 my2v2

solved decrypted manual

Joan G. Stark's ASCII Christmas tree. 3DES, key MD5(name).

Metadata

Post ID: my2v2
Title: 201112021751 → 2011-12-02 17:51 on A858's clock
Posted (UTC): 2011-12-02 22:48:13
Timezone: UTC−5 · title 17:51 against posted 22:48 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: S solved 3DES → text
Content: Seasonal greetings and ASCII art
Size: 1,872 hex characters · 936 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here: Joan G. Stark's ASCII Christmas tree. (new results)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 24 · 17
Tags: pre-automation2011Solved special postmanualarctic-onlykey: nameseasonal greetings and ascii artfound by this project

From the post to its content

As posted (encrypted)

FF7D1A2584E6D53C 6DAFB8425EB5E30B FF7D1A2584E6D53C 3023BFCDC0699F19 FF7D1A2584E6D53C FF7D1A2584E6D53C D9E06E007E035630 9B0F0D35A67984FB FF7D1A2584E6D53C FF7D1A2584E6D53C DC1A35F83CFCF1E6 585F42DDB8D019C2 FF7D1A2584E6D53C FF7D1A2584E6D53C D1DABA0F4798AE4B 3AEE5D3483BEE49D 83372FB4093D8CAC E35C50EFB883EEC3 FF7D1A2584E6D53C 853739EA1E914CDA FF7D1A2584E6D53C FF7D1A2584E6D53C 70D0B8F7E1391A6E FF7D1A2584E6D53C FF7D1A2584E6D53C 113AFB843017C07A 9B0F0D35A67984FB FF7D1A2584E6D53C 15EB9A1DD21A13B6 79485253021C0936 A47413CC4A9D6B85 E35C50EFB883EEC3 FF7D1A2584E6D53C BCD491E38DB25C51 10833184E553B9B0 FF7D1A2584E6D53C FF7D1A2584E6D53C 65468A93F69F2C99 6EEC8C9073467401 FF7D1A2584E6D53C 7AD1BE692E46E984 FF7D1A2584E6D53C FF7D1A2584E6D53C 768FF5E36F86C699 FF363B92E104C802 79FC67A2F65E16EF FF7D1A2584E6D53C 668121CC9D8101F8 CAE40739237492BD 48460F5A2BF1C465 A47413CC4A9D6B85 FF7D1A2584E6D53C FF7D1A2584E6D53C 7B46C701B07EE990 4BA2DC376BD6A250 21FB2EEDDD98E078 FF7D1A2584E6D53C 2ADDD1FF77D6E425 DE1A963ACD690A21 2157E432FB034832 C970BCDC806F6C87 FF7D1A2584E6D53C 87DDDC1EF16064B7 8895875D1DDB1F13 C47220A75D001312 FF7D1A2584E6D53C 052CD38271E08D2F 394E18ED69926377 5EE9866AC200652A 5227A1915CC07484 FF7D1A2584E6D53C 8B2111FB4ADCAC1C D18EE9027D4B99F9 FFE6DED11ABD383C 4110B756D4688A43 83372FB4093D8CAC 6DAFB8425EB5E30B B3D17FAEF5EB8B85 8E6BAE944E408228 5746C3CC76B33F7B 83372FB4093D8CAC BE106FF5B466BA6E B81143E5ECE858D7 D39AF8408098BD71 EF1C5DDF803EF2C6 FF7D1A2584E6D53C 89CFD6A5E0099919 FF7D1A2584E6D53C E7A856B706D7B492 FBA3ED07AEF14FAF 5C3AE8B420EC499C 062F28C724DCB182 73305F0DBFDE26D2 6DAA75D1B9D4491F A3551777B74F9AC0 417586EE228B429A 87ACB50F28A5428E FF7D1A2584E6D53C 9048265D2AE46682 3FCE1476EFBBA495 CA30645507951D4F 6ED050BB7E111598 57D7C262D9BC63A5 FF7D1A2584E6D53C F0D2DFCADE6E0892 D3957BEE64E5A718 0D99FF8CE25D63EC FF7D1A2584E6D53C FF7D1A2584E6D53C 9D1A2966DD9AFCBB 9B0F0D35A67984FB FF7D1A2584E6D53C DD5CA3A28A2B07D4 BF049416EEFA33A8 FF7D1A2584E6D53C 3AA5197F2AB88F42 06CB9A334EC4F863

Decrypt. Key: MD5(name) ECB. 3DES-EDE2, then strip the PKCS7 padding.

Decrypted

           *             ,
                       _/^\_
                      <     >
     *                 /.-.\         *
              *        `/&\`                   *
                      ,@.*;@,
                     /_o.I %_\    *
        *           (`'--:o(_@;
                   /`;--.,__ `')             *
                  ;@`o % O,*`'`&\ 
            *    (`'--)_@ ;o %'()\      *
                 /`;--._`''--._O'@;
                /&*,()~o`;-.,_ `""`)
     *          /`,@ ;+& () o*`;-';\
               (`""--.,_0 +% @' &()\
               /-.,_    ``''--....-'`)  *
          *    /@%;o`:;'--,.__   __.'\
              ;*,&(); @ % &^;~`"`o;@();         *
              /(); o^~; & ().o@*&`;&%O\
        jgs   `"="==""==,,,.,="=="==="`
           __.----.(\-''#####---...___...-----._
         '`         \)_`"""""`
                 .--' ')
               o(  )_-\
                 `"""` `

Explanation

Write-up

I have been going through some lesser known posts that are not in the auto analysis archive, amongst these I managed to find a solution for my2v2 (title 201112021751) which was originally found here. The post is 117 blocks of 16 hex characters, here are the first few (line breaks added for readability):

FF7D1A2584E6D53C 6DAFB8425EB5E30B FF7D1A2584E6D53C 3023BFCDC0699F19
FF7D1A2584E6D53C FF7D1A2584E6D53C D9E06E007E035630 9B0F0D35A67984FB
FF7D1A2584E6D53C FF7D1A2584E6D53C DC1A35F83CFCF1E6 585F42DDB8D019C2
...

In the original thread /u/pfcuttle noticed that FF7D1A2584E6D53C occurs a lot. That is the giveaway that this is ECB mode encryption: every 8 bytes are encrypted on their own, so the same 8 bytes of text always give the same 16 hex characters. It decrypts using des-ede-ecb with the same password/key as the other posts from around this time, MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae, and FF7D1A2584E6D53C turns out to be 8 spaces. The full text is a Christmas tree:

           *             ,
                       _/^\_
                      <     >
     *                 /.-.\         *
              *        `/&\`                   *
                      ,@.*;@,
                     /_o.I %_\    *
        *           (`'--:o(_@;
                   /`;--.,__ `')             *
                  ;@`o % O,*`'`&\
            *    (`'--)_@ ;o %'()\      *
                 /`;--._`''--._O'@;
                /&*,()~o`;-.,_ `""`)
     *          /`,@ ;+& () o*`;-';\
               (`""--.,_0 +% @' &()\
               /-.,_    ``''--....-'`)  *
          *    /@%;o`:;'--,.__   __.'\
              ;*,&(); @ % &^;~`"`o;@();         *
              /(); o^~; & ().o@*&`;&%O\
        jgs   `"="==""==,,,.,="=="==="`
           __.----.(\-''#####---...___...-----._
         '`         \)_`"""""`
                 .--' ')
               o(  )_-\
                 `"""` `

The jgs signature is Joan G. Stark, a well known ASCII artist, and this is her Christmas tree from 1997 (it can be found on e.g. asciiart.eu), unchanged. So nothing hidden as far as I can tell, just a seasonal post like the New Year posts at the end of the month.

The post is too long to paste into a command here, so this fetches it from the Arctic Shift archive and decrypts it (needs curl and jq):

curl -s 'https://arctic-shift.photon-reddit.com/api/posts/ids?ids=my2v2&fields=selftext' \
  | jq -r '.data[0].selftext' \
  | xxd -r -p \
  | openssl enc -d -des-ede-ecb -K "$(printf 'A858DE45F56D9BC9' | md5sum | cut -d ' ' -f 1)"

Solution summary

Method: 3DES-ECB, key MD5(name)
Result: Joan G. Stark ASCII Christmas tree
Explanation: Unedited copy of the art
Re-checked: 3DES MD5(name) -> Christmas tree