{
 "id": "p5dsk",
 "title": "201201311658",
 "title_time": "2012-01-31T16:58",
 "author": "[deleted]",
 "account": "A858DE45F56D9BC9",
 "subreddit": "A858DE45F56D9BC9",
 "created_utc": "2012-02-01T00:57:53Z",
 "permalink": "https://www.reddit.com/r/A858DE45F56D9BC9/comments/p5dsk/201201311658/",
 "arctic_shift": "https://arctic-shift.photon-reddit.com/api/posts/ids?ids=p5dsk",
 "sources": [
  "arctic-shift"
 ],
 "body": "869F477E833E639F 2218569AC0372C13 D5D75C84B198B2D1 4DB522730BAEBC7C 177441BB4A15EBAC 7F98A8973F89C6BB 985D488884AC011E C4FBF6C2BC8CC5D3 1234263B1AA0E74F A26FCA96CCBB5F6C 5C156ABBEC0496DF B7EBDCC24FEC5074 F42D7751C3AF3E8C 603E46FAB755215D 0D8E5AB43D23E57D 945FD021480FA29D 66217937D766ECD0 24EA1A31EE70A6B5 4BF3EF0D2ADED5D0 248D146FF33FD7F5 E0C2C382A2F3C36D 67A730F6B2BA9F55 8B52C192BFFA236D F4B6FFEFFA2A7022 74AE882E40030C46 655DB33DFF19BDA8 2FA4C4BA046784B1 584A251ED93BE4BE 803E719DE9583BCF BFA81A23EF2095F1 568529AFE0F61F53 56681ECE2B541990 64314443F22A4EB2 9515A0714524BEEC EDD9C8D073D55BCE 0C6C337157306440 CE2BECE3726FE175 22A1E32B771883C0 B01D7B1727488C79 28DD2C9DC79AD977 C72F9DE408981A7A 48F4A7942618E380 55F97A7BCD54B1BE E58BD2424AA3E416 D706CB91EEB9B7B5 DDD884077473E4A5 F3BD679FD671D564 AD91F3F206881C98 B222AE31E17BC344 B35012393A67FB94 B33D05AB2BACC526 0D69A30625F843FA 8DC0C2AB73B7E5A4 20A42FF3DB0F554F 277EB078A38ED5D3 5259F2809832061C 1E06B75C6BB75058 50F064B6C116243A A3E0533E2379FD37 A8E13F40A6FAF54C 35EDE59D43DB4679 1CBE0AABAA262D43 7BED160A3D3DE06B 799D0931649497AD A75E78C4E9DD188D 577A399C5884E4CF 9E0F2482719D490F 50F39320BC942995 8A6CB76ED5D508E4 46A6F7B938D6A965 162F2CE1F67434D9 2E6A1570231E50E1 63E6CC9910CD2102 194419963D028AD6 808162EF913BE124 1A8B7938D4186237 F08A41E977C0BDE2 68EEF0B0EF7F1F42 3C928B1DC7B14398 6B2AA393623218E4 9BD541929BDCF087 DC76976D392B0838 D432878276B6C6F8 9A33B2E6A338E180 45D8C94831AA2C48 5487C99E40E6C6C0 AD351CDAA32C2BA4 83B26F35D2E2DED1 9B0171A1C30015D2 D1F73C61700A3357 045CC31C63BF6B5D F58323A8542E3D83 929F336F3A1B29E0 1D35C5914932FB45 A6E946F0FDBAFD3E 36687E1532CD3C78 0899F0DDA9EF6981 04FE20B6B86C6E5E BA8A584A1FEB0358 B948F7CDB28831DD 82FC4FDA5E0438F2 F699301E2C630474 3D296AF4ED3C9401 C1E0E342647395EC B6272381F3E166B1 0B3A8442E87E368F 7A9FA9C07351932D 2E1021604624688C B3DCDFC16BCB9437 4FAF3FC311315466 2C96B4E87CD4098B D6A3D9E912FA5735 4938A35EB2E3D3AA 419378C3C41A399E 23563AB64795EB78 4940BD9ACB179874 FF0CB2E9FD99E0DE F5F254CFAC5E297D FA3636249E02F77C 7751A9E5665F253C AF90F66416C2E14E 9E7E82F654B45F1E 159E55A672334084 88B8EAB87887C9E1 48A9DE21E87E72ED 829A69EC14226A80 69E396D2CD495556 84BA437F18CB1992 A298636243C636C3 0B50BD99B64FEF70 075C8A4B57DE2EBA BDB50EAAC2FD9B5D A4BB42BA7C904941 DE8B24D07E0BD4E0 74C9F3863DCADDDD 32181DD5034478BA 0678F07CE1603AEA 91BC2DE31BEB0374 D1CF0F8AB6BE7383 5CA4F423796E7BB5 312BC06E73C4216F 7E8E27A537CAAA7C FFB0E063EB986DB0 2C94F5DE0010DBED 4685A492DB2BE478 ",
 "body_source": "arctic-shift",
 "body_other_version": null,
 "body_hex_chars": 2320,
 "bytes": 1160,
 "score": 40,
 "num_comments": 9,
 "category": {
  "code": "F3h",
  "label": "F3h filler: GUID list under a hand-post key, seed known"
 },
 "kind": "manual",
 "encryption": "decrypted",
 "status": "explained",
 "summary": "A masked GUID list: 32 GUIDs, seed 619. 3DES, key md5(md5 hex of 'BORG').",
 "content_type": null,
 "cipher": {
  "algorithm": "3DES-EDE2 (two-key Triple DES)",
  "mode": "ECB",
  "padding": "PKCS7",
  "key_derivation": "MD5(password)",
  "password_recipe": "MD5 of the uppercase hex MD5 of \"BORG\"",
  "password": "C5EDCDEA87C43A03EC474CEC47C127E5",
  "key_hex": "1dc53e459cb26479c68bec290dd9312d",
  "steps": [
   [
    "Build the password",
    "The MD5 of <code>BORG</code>, written as uppercase hex: <code>C5EDCDEA87C43A03EC474CEC47C127E5</code>."
   ],
   [
    "Derive the key",
    "Key = MD5(password) = <code>1dc53e459cb26479c68bec290dd9312d</code>."
   ],
   [
    "Decrypt",
    "3DES-EDE2 in ECB mode, then strip the PKCS7 padding (7 bytes)."
   ]
  ]
 },
 "plaintext": "f5fa62f14f8a0c1e 807077dab9ceaf27 \r\ncc65546a38c335 238fce63f1e6eb29 a5\r\n35773ade6e68 34d992603180057f 9ebb\r\n548b701690 c7602b865c188ff3 5f18a7\r\n4a7433ab a93c6bef8d1c5c73 e1f499c6\r\ne35661 41c3a74907afebf2 03bb3879e7\r\naa56 923c12a821fb8624 77182a51f34a\r\nc9 11d177f7f28953bd cd771e23110015\r\n a5a23438a7a35c43 ae61fa3421fb5f33 \r\n27c1c33b9aab44 7783fa954692a7d7 e0\r\n66fb4fadc4f8 2a1599a7fe95a209 0512\r\n6454ecf7c1 eb69e4be43f57283 28a450\r\nb6c3cf0c 88d318b39fc0cf7e 97871ae2\r\n5d9201 c27baf4dc8b4aaeb b99e17edf7\r\ne78d d61bcf612042b330 bd0e226ef973\r\n6a efe140a4a9559f96 8143d9dc6b5770\r\n 00d5ae6672d404f7 b322b50589e14b53 \r\n2651f723ed4d6b 7eaf08dc0966c4c2 97\r\nb9b8b38f8704 31b2a8ac54d4a2b7 6011\r\nf05a76448e 7d83f3ba4107043f 190fcb\r\nd5037c3e f7540c999df57e1e 568844f2\r\n311c54 88ecf365aab0fd5b c15be5dc2a\r\n664c 38f1992c5046bb0c 8c1e22c057ac\r\n91 928425b6432e639a ae0fe0f41db902\r\n 515f7bb85f0b357f 82b6b9317c95683e \r\n7706c2e626ba55 2b96e7f397a73d5b e4\r\n7f8775fba04c 194b9f755a6ac24e 68fa\r\n8b1c55addd 4d2b9793bcb47376 b98798\r\n94e957b2 5364447cbbe5c28b e3be2801\r\ndc1927 47131a5e5f92ec40 ec353cd28b\r\n7adc a39364166444952d 7f634ac35dab\r\na0 185b8d0f68400091 735caf50de7feb",
 "word_layer": null,
 "credit": {
  "kind": "key",
  "what": "Key found: MD5 of the uppercase hex MD5 of \"BORG\". It decrypts to an ordinary masked GUID list."
 },
 "decoded_layers": null,
 "guids": {
  "count": 32,
  "mask_digits": "03366428542614250638065235124564",
  "mask_seed": 619,
  "mask_seed_candidates": null,
  "mask_seed_verified": true,
  "seed_table_layer": "md5(md5HEX(\"BORG\")), 3DES-ECB"
 },
 "count_from_length": null,
 "run": {
  "id": "group-pre-automation",
  "name": "Before the scheduler",
  "type": "pre-automation",
  "draw": null,
  "count": 36,
  "predicted_count": null,
  "reproduced": null,
  "note": "before the scheduled app (Jun 26 2012): sparse single tool runs / hand lists (o5o4o, jbucr, jkuyr), 2011 genuine-v4 lists; no long-lived count stream to fit"
 },
 "known_solution": [
  {
   "Method": "3DES-ECB, key md5(md5HEX(BORG)), 7-byte PKCS7 pad",
   "Result": "32 masked GUIDs, seed 619",
   "Explanation": "Layer 1 is a masked GUID list (Random(619).Next(9)); nothing further hidden in it",
   "Re-checked": "3DES md5(md5HEX(\"BORG\")) -> masked GUIDs"
  }
 ],
 "tags": [
  "pre-automation",
  "2012",
  "GUID list under a hand-post key",
  "manual",
  "arctic-only",
  "key: MD5 of the uppercase hex MD5 of \"BORG\"",
  "run: pre-automation",
  "found by this project"
 ],
 "title_zone_hours": -8,
 "title_zone": "UTC−8",
 "writeup": {
  "title": null,
  "markdown": "I have managed to find a solution for `p5dsk` (title 201201311658) which was originally found [here](http://www.reddit.com/r/A858DE45F56D9BC9/comments/p5dsk/201201311658/). The post is 145 blocks of 16 hex characters (1,160 bytes), looking like this (line breaks added for readability):\n\n    869F477E833E639F 2218569AC0372C13 D5D75C84B198B2D1 4DB522730BAEBC7C\n    177441BB4A15EBAC 7F98A8973F89C6BB 985D488884AC011E C4FBF6C2BC8CC5D3\n    1234263B1AA0E74F A26FCA96CCBB5F6C 5C156ABBEC0496DF B7EBDCC24FEC5074\n    ...\n\nIt does not decrypt with `MD5(A858DE45F56D9BC9)` like the other posts from around this time, but I does decrypt with hasing `BORG` twice. First `MD5(BORG) = C5EDCDEA87C43A03EC474CEC47C127E5`, then the MD5 of that upper case hex string, `MD5(C5EDCDEA87C43A03EC474CEC47C127E5) = 1dc53e459cb26479c68bec290dd9312d`. With that as the key it decrypts using des-ede-ecb to this (only the first lines shown):\n\n    f5fa62f14f8a0c1e 807077dab9ceaf27\n    cc65546a38c335 238fce63f1e6eb29 a5\n    35773ade6e68 34d992603180057f 9ebb\n    548b701690 c7602b865c188ff3 5f18a7\n    4a7433ab a93c6bef8d1c5c73 e1f499c6\n    ...\n\nThis is lower case hex in groups of 16 characters, wrapped every 32 characters (which is why the groups drift across the lines). 32 lines, 1,024 hex characters, so 512 bytes. If you remove the spaces and line breaks and split it into chunks of 32 characters, it turns out to be 32 GUIDs in the masked format (see the [GUID posts wiki page](https://www.reddit.com/r/Solving_A858/wiki/guid_posts)). Formatted as GUIDs it looks like this:\n\n    f5fa62f1-4f8a-0c1e-8070-77dab9ceaf27\n    cc65546a-38c3-3523-8fce-63f1e6eb29a5\n    35773ade-6e68-34d9-9260-3180057f9ebb\n    548b7016-90c7-602b-865c-188ff35f18a7\n    4a7433ab-a93c-6bef-8d1c-5c73e1f499c6\n    e3566141-c3a7-4907-afeb-f203bb3879e7\n    aa56923c-12a8-21fb-8624-77182a51f34a\n    c911d177-f7f2-8953-bdcd-771e23110015\n    a5a23438-a7a3-5c43-ae61-fa3421fb5f33\n    27c1c33b-9aab-4477-83fa-954692a7d7e0\n    66fb4fad-c4f8-2a15-99a7-fe95a2090512\n    6454ecf7-c1eb-69e4-be43-f5728328a450\n    b6c3cf0c-88d3-18b3-9fc0-cf7e97871ae2\n    5d9201c2-7baf-4dc8-b4aa-ebb99e17edf7\n    e78dd61b-cf61-2042-b330-bd0e226ef973\n    6aefe140-a4a9-559f-9681-43d9dc6b5770\n    00d5ae66-72d4-04f7-b322-b50589e14b53\n    2651f723-ed4d-6b7e-af08-dc0966c4c297\n    b9b8b38f-8704-31b2-a8ac-54d4a2b76011\n    f05a7644-8e7d-83f3-ba41-07043f190fcb\n    d5037c3e-f754-0c99-9df5-7e1e568844f2\n    311c5488-ecf3-65aa-b0fd-5bc15be5dc2a\n    664c38f1-992c-5046-bb0c-8c1e22c057ac\n    91928425-b643-2e63-9aae-0fe0f41db902\n    515f7bb8-5f0b-357f-82b6-b9317c95683e\n    7706c2e6-26ba-552b-96e7-f397a73d5be4\n    7f8775fb-a04c-194b-9f75-5a6ac24e68fa\n    8b1c55ad-dd4d-2b97-93bc-b47376b98798\n    94e957b2-5364-447c-bbe5-c28be3be2801\n    dc192747-131a-5e5f-92ec-40ec353cd28b\n    7adca393-6416-6444-952d-7f634ac35dab\n    a0185b8d-0f68-4000-9173-5caf50de7feb\n\nAll 32 have the variant character (first character of the fourth group) in `8`, `9`, `a` or `b`, and the version character (first character of the third group) is a digit from 0 to 8 instead of the usual `4`. The version digits read `03366428542614250638065235124564`, which is exactly what the C# random number generator gives with seed 619:\n\n    var random = new Random(619);\n    var str = new StringBuilder();\n    for(var i = 0; i < 32; ++i)\n        str.Append(random.Next(9));\n    Console.WriteLine(str);\n    // Outputs: 03366428542614250638065235124564\n\nSo it is the same kind of masked GUID list as the other posts, it has just been wrapped in an extra layer of encryption with a different key. Nothing else hidden in it as far as I can tell.\n\nAs far as I know this is the first post where the password was not something visible in or around the post (`A858DE45F56D9BC9`, the title, or the `A858` label in `u1rti`), and the first with the double MD5.\n\nThe obvious reading of `BORG` is Star Trek, but the timing is worth putting on record: this post went up 2012-01-31, three weeks after two major galaxy-cluster discoveries shared the same press cycle at the American Astronomical Society's 219th meeting in Austin (2012-01-10) - the \"El Gordo\" cluster, and a distant protocluster catalogued as [\"BoRG-58\"](https://en.wikipedia.org/wiki/BoRG-58) (named for the Hubble \"Brightest of Reionizing Galaxies\" survey that found it). Both got wide NASA/ESO/Hubble coverage that week (e.g. [ESO's El Gordo release](https://www.eso.org/public/news/eso1203/), [NASA's BoRG-58 protocluster release](https://www.nasa.gov/mission_pages/hubble/science/far-protocluster.html)). A858 has used topical material before like the earmarks story linked in `pegdm`, and the Max Lerner quote A858 itself called \"topical\" in the AMA, so a science-news reading is at least as plausible as the Star Trek one here. I can't tell which, if either, was actually in mind; noting it in case it's useful for finding more passwords from the same period.\n\nThe post is too long to paste into a command here, so this fetches it from the Arctic Shift archive, decrypts it, and formats the result as GUIDs (needs `curl` and `jq`):\n\n    curl -s 'https://arctic-shift.photon-reddit.com/api/posts/ids?ids=p5dsk&fields=selftext' \\\n      | jq -r '.data[0].selftext' \\\n      | xxd -r -p \\\n      | openssl enc -d -des-ede-ecb -K \"$(printf 'BORG' | md5sum | cut -d ' ' -f 1 | tr a-f A-F | tr -d '\\n' | md5sum | cut -d ' ' -f 1)\" \\\n      | tr -d ' \\r\\n' \\\n      | fold -w 32 \\\n      | sed -E 's/(.{8})(.{4})(.{4})(.{4})(.{12})/\\1-\\2-\\3-\\4-\\5/'"
 },
 "page": "posts/p5dsk/"
}