201202070030 pegdm
solved decrypted manual
A Washington Post link to the 2012 earmarks story. 3DES, key MD5(name).
From the post to its content
As posted (encrypted)
A4BB3DF6B085358F 91064A5CDDDC5FE5 6462365ADBC9C1AC 8ACCE2D6E02C813F 8E39EF2C8FAA1C74 1B5B2C5D92395C84 46DF19BC385502BC 03F0CE67C58F0C24 A95BB98C5FD9FF0E 47373A201BC2B61D
- Decrypt. Key: MD5(name) ECB. 3DES-EDE2, then strip the PKCS7 padding.
Decrypted
http://www.washingtonpost.com/investigations/2012/01/12/gIQA97HGvQ_story.html
Explanation
Write-up
I have found a solution for pegdm (title 201202070030) which was originally found here (line breaks added for readability):
A4BB3DF6B085358F 91064A5CDDDC5FE5 6462365ADBC9C1AC 8ACCE2D6E02C813F
8E39EF2C8FAA1C74 1B5B2C5D92395C84 46DF19BC385502BC 03F0CE67C58F0C24
A95BB98C5FD9FF0E 47373A201BC2B61D
That is 80 bytes, which decrypts using des-ede-ecb with the same password/key as the other posts from around this time, MD5(A858DE45F56D9BC9) = 34a14a42e98ff96095af56604e290cae, to a single link:
http://www.washingtonpost.com/investigations/2012/01/12/gIQA97HGvQ_story.html
This is the Washington Post investigation "Congressional earmarks sometimes used to fund projects near lawmakers' properties" by David S. Fallis, Scott Higham and Kimberly Kindy, part of their "Capitol Assets" series. It found that 33 members of Congress had steered more than $300 million in earmarks to projects next to or near their own property. Despite the 2012/01/12 in the URL, the article was published on 2012-02-06, and the post went up on 2012-02-07 08:30 UTC, about a day later. So it looks like a topical link, much like the Max Lerner quote (which A858 described in the AMA as "topical"). I could not find the link or the article mentioned anywhere in the sub, on /r/Solving_A858 or in the wiki, so I believe this has not been decrypted before.
All the steps as one command
echo 'A4BB3DF6B085358F 91064A5CDDDC5FE5 6462365ADBC9C1AC 8ACCE2D6E02C813F 8E39EF2C8FAA1C74 1B5B2C5D92395C84 46DF19BC385502BC 03F0CE67C58F0C24 A95BB98C5FD9FF0E 47373A201BC2B61D' \
| xxd -r -p \
| openssl enc -d -des-ede-ecb -K "$(printf 'A858DE45F56D9BC9' | md5sum | cut -d ' ' -f 1)"; echo
Solution summary
- Method
- 3DES-ECB, key MD5(name)
- Result
- Washington Post URL (earmarks article of 2012-02-06)
- Explanation
- Arctic-only text; the linked article is dated the day before the post; tried the article as a source of key words, and the key that opened 15qth4 was MD5("2013") from the same period
- Re-checked
- 3DES MD5(name) -> URL