201201311658 p5dsk

I have managed to find a solution for p5dsk (title 201201311658) which was originally found here. The post is 145 blocks of 16 hex characters (1,160 bytes), looking like this (line breaks added for readability):

869F477E833E639F 2218569AC0372C13 D5D75C84B198B2D1 4DB522730BAEBC7C
177441BB4A15EBAC 7F98A8973F89C6BB 985D488884AC011E C4FBF6C2BC8CC5D3
1234263B1AA0E74F A26FCA96CCBB5F6C 5C156ABBEC0496DF B7EBDCC24FEC5074
...

It does not decrypt with MD5(A858DE45F56D9BC9) like the other posts from around this time, but I does decrypt with hasing BORG twice. First MD5(BORG) = C5EDCDEA87C43A03EC474CEC47C127E5, then the MD5 of that upper case hex string, MD5(C5EDCDEA87C43A03EC474CEC47C127E5) = 1dc53e459cb26479c68bec290dd9312d. With that as the key it decrypts using des-ede-ecb to this (only the first lines shown):

f5fa62f14f8a0c1e 807077dab9ceaf27
cc65546a38c335 238fce63f1e6eb29 a5
35773ade6e68 34d992603180057f 9ebb
548b701690 c7602b865c188ff3 5f18a7
4a7433ab a93c6bef8d1c5c73 e1f499c6
...

This is lower case hex in groups of 16 characters, wrapped every 32 characters (which is why the groups drift across the lines). 32 lines, 1,024 hex characters, so 512 bytes. If you remove the spaces and line breaks and split it into chunks of 32 characters, it turns out to be 32 GUIDs in the masked format (see the GUID posts wiki page). Formatted as GUIDs it looks like this:

f5fa62f1-4f8a-0c1e-8070-77dab9ceaf27
cc65546a-38c3-3523-8fce-63f1e6eb29a5
35773ade-6e68-34d9-9260-3180057f9ebb
548b7016-90c7-602b-865c-188ff35f18a7
4a7433ab-a93c-6bef-8d1c-5c73e1f499c6
e3566141-c3a7-4907-afeb-f203bb3879e7
aa56923c-12a8-21fb-8624-77182a51f34a
c911d177-f7f2-8953-bdcd-771e23110015
a5a23438-a7a3-5c43-ae61-fa3421fb5f33
27c1c33b-9aab-4477-83fa-954692a7d7e0
66fb4fad-c4f8-2a15-99a7-fe95a2090512
6454ecf7-c1eb-69e4-be43-f5728328a450
b6c3cf0c-88d3-18b3-9fc0-cf7e97871ae2
5d9201c2-7baf-4dc8-b4aa-ebb99e17edf7
e78dd61b-cf61-2042-b330-bd0e226ef973
6aefe140-a4a9-559f-9681-43d9dc6b5770
00d5ae66-72d4-04f7-b322-b50589e14b53
2651f723-ed4d-6b7e-af08-dc0966c4c297
b9b8b38f-8704-31b2-a8ac-54d4a2b76011
f05a7644-8e7d-83f3-ba41-07043f190fcb
d5037c3e-f754-0c99-9df5-7e1e568844f2
311c5488-ecf3-65aa-b0fd-5bc15be5dc2a
664c38f1-992c-5046-bb0c-8c1e22c057ac
91928425-b643-2e63-9aae-0fe0f41db902
515f7bb8-5f0b-357f-82b6-b9317c95683e
7706c2e6-26ba-552b-96e7-f397a73d5be4
7f8775fb-a04c-194b-9f75-5a6ac24e68fa
8b1c55ad-dd4d-2b97-93bc-b47376b98798
94e957b2-5364-447c-bbe5-c28be3be2801
dc192747-131a-5e5f-92ec-40ec353cd28b
7adca393-6416-6444-952d-7f634ac35dab
a0185b8d-0f68-4000-9173-5caf50de7feb

All 32 have the variant character (first character of the fourth group) in 8, 9, a or b, and the version character (first character of the third group) is a digit from 0 to 8 instead of the usual 4. The version digits read 03366428542614250638065235124564, which is exactly what the C# random number generator gives with seed 619:

var random = new Random(619);
var str = new StringBuilder();
for(var i = 0; i < 32; ++i)
    str.Append(random.Next(9));
Console.WriteLine(str);
// Outputs: 03366428542614250638065235124564

So it is the same kind of masked GUID list as the other posts, it has just been wrapped in an extra layer of encryption with a different key. Nothing else hidden in it as far as I can tell.

As far as I know this is the first post where the password was not something visible in or around the post (A858DE45F56D9BC9, the title, or the A858 label in u1rti), and the first with the double MD5.

The obvious reading of BORG is Star Trek, but the timing is worth putting on record: this post went up 2012-01-31, three weeks after two major galaxy-cluster discoveries shared the same press cycle at the American Astronomical Society's 219th meeting in Austin (2012-01-10) - the "El Gordo" cluster, and a distant protocluster catalogued as "BoRG-58" (named for the Hubble "Brightest of Reionizing Galaxies" survey that found it). Both got wide NASA/ESO/Hubble coverage that week (e.g. ESO's El Gordo release, NASA's BoRG-58 protocluster release). A858 has used topical material before like the earmarks story linked in pegdm, and the Max Lerner quote A858 itself called "topical" in the AMA, so a science-news reading is at least as plausible as the Star Trek one here. I can't tell which, if either, was actually in mind; noting it in case it's useful for finding more passwords from the same period.

The post is too long to paste into a command here, so this fetches it from the Arctic Shift archive, decrypts it, and formats the result as GUIDs (needs curl and jq):

curl -s 'https://arctic-shift.photon-reddit.com/api/posts/ids?ids=p5dsk&fields=selftext' \
  | jq -r '.data[0].selftext' \
  | xxd -r -p \
  | openssl enc -d -des-ede-ecb -K "$(printf 'BORG' | md5sum | cut -d ' ' -f 1 | tr a-f A-F | tr -d '\n' | md5sum | cut -d ' ' -f 1)" \
  | tr -d ' \r\n' \
  | fold -w 32 \
  | sed -E 's/(.{8})(.{4})(.{4})(.{4})(.{12})/\1-\2-\3-\4-\5/'