A858DE45F56D9BC9 archive

201202070030 pegdm

solved decrypted manual

A Washington Post link to the 2012 earmarks story. 3DES, key MD5(name).

Metadata

Post ID
pegdm
Title
201202070030 → 2012-02-07 00:30 on A858's clock
Posted (UTC)
2012-02-07 08:30:05
Timezone
UTC−8 · title 00:30 against posted 08:30 UTC
Author
[deleted]
Account
A858DE45F56D9BC9 main account
Subreddit
r/A858DE45F56D9BC9 the main subreddit
Category
S solved 3DES → text
Content
Puzzles and references
Size
160 hex characters · 80 bytes
Cipher
3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key
MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae (name)
New here
A Washington Post link to that week's story on congressional earmarks. (new results)
Sources
arctic-shift · body from arctic-shift
Links
Reddit · Arctic Shift · JSON
Score · comments
12 · 8
Tags
pre-automation2012Solved special postmanualarctic-onlykey: namepuzzles and referencesfound by this project

From the post to its content

As posted (encrypted)

A4BB3DF6B085358F 91064A5CDDDC5FE5 6462365ADBC9C1AC 8ACCE2D6E02C813F 8E39EF2C8FAA1C74 1B5B2C5D92395C84 46DF19BC385502BC 03F0CE67C58F0C24 A95BB98C5FD9FF0E 47373A201BC2B61D 
  • Decrypt. Key: MD5(name) ECB. 3DES-EDE2, then strip the PKCS7 padding.

Decrypted

http://www.washingtonpost.com/investigations/2012/01/12/gIQA97HGvQ_story.html

Explanation

Write-up

I have found a solution for pegdm (title 201202070030) which was originally found here (line breaks added for readability):

A4BB3DF6B085358F 91064A5CDDDC5FE5 6462365ADBC9C1AC 8ACCE2D6E02C813F
8E39EF2C8FAA1C74 1B5B2C5D92395C84 46DF19BC385502BC 03F0CE67C58F0C24
A95BB98C5FD9FF0E 47373A201BC2B61D

That is 80 bytes, which decrypts using des-ede-ecb with the same password/key as the other posts from around this time, MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae, to a single link:

http://www.washingtonpost.com/investigations/2012/01/12/gIQA97HGvQ_story.html

This is the Washington Post investigation "Congressional earmarks sometimes used to fund projects near lawmakers' properties" by David S. Fallis, Scott Higham and Kimberly Kindy, part of their "Capitol Assets" series. It found that 33 members of Congress had steered more than $300 million in earmarks to projects next to or near their own property. Despite the 2012/01/12 in the URL, the article was published on 2012-02-06, and the post went up on 2012-02-07 08:30 UTC, about a day later. So it looks like a topical link, much like the Max Lerner quote (which A858 described in the AMA as "topical"). I could not find the link or the article mentioned anywhere in the sub, on /r/Solving_A858 or in the wiki, so I believe this has not been decrypted before.

All the steps as one command

echo 'A4BB3DF6B085358F 91064A5CDDDC5FE5 6462365ADBC9C1AC 8ACCE2D6E02C813F 8E39EF2C8FAA1C74 1B5B2C5D92395C84 46DF19BC385502BC 03F0CE67C58F0C24 A95BB98C5FD9FF0E 47373A201BC2B61D' \
  | xxd -r -p \
  | openssl enc -d -des-ede-ecb -K "$(printf 'A858DE45F56D9BC9' | md5sum | cut -d ' ' -f 1)"; echo

Solution summary

Method
3DES-ECB, key MD5(name)
Result
Washington Post URL (earmarks article of 2012-02-06)
Explanation
Arctic-only text; the linked article is dated the day before the post; tried the article as a source of key words, and the key that opened 15qth4 was MD5("2013") from the same period
Re-checked
3DES MD5(name) -> URL