{
 "id": "u1rti",
 "title": "201205231544",
 "title_time": "2012-05-23T15:44",
 "author": "[deleted]",
 "account": "A858DE45F56D9BC9",
 "subreddit": "A858DE45F56D9BC9",
 "created_utc": "2012-05-23T22:46:44Z",
 "permalink": "https://www.reddit.com/r/A858DE45F56D9BC9/comments/u1rti/201205231544/",
 "arctic_shift": "https://arctic-shift.photon-reddit.com/api/posts/ids?ids=u1rti",
 "sources": [
  "arctic-shift"
 ],
 "body": "A858\n\n4F69DF42D6763A6E D16CFA6690C11F68 3B58957B723C0C57 7F90A1A807AEDECC DFBE482CC27EE535 34A67FB278BC9C8A ",
 "body_source": "arctic-shift",
 "body_other_version": null,
 "body_hex_chars": 100,
 "bytes": 50,
 "score": 3,
 "num_comments": 0,
 "category": {
  "code": "S",
  "label": "S solved 3DES → text"
 },
 "kind": "manual",
 "encryption": "decrypted",
 "status": "partial",
 "summary": "A 40-hex SHA-1-shaped digest: the BitTorrent info-hash of 'Think Like Your Customer.rar'. 3DES, key MD5(A858). Open: the meaning of the post.",
 "content_type": [
  "Hashes and key-chain material"
 ],
 "cipher": {
  "algorithm": "3DES-EDE2 (two-key Triple DES)",
  "mode": "ECB",
  "padding": "PKCS7",
  "key_derivation": "MD5(password)",
  "password_recipe": "the label printed in the post",
  "password": "A858",
  "key_hex": "ecbb313d995eac9d1745c0f56f9c8531",
  "steps": [
   [
    "Unwrap",
    "The first 4 characters of the body are a label printed in the post, not ciphertext."
   ],
   [
    "Derive the key",
    "Password = <code>A858</code> (the label printed in the post); key = MD5(password) = <code>ecbb313d995eac9d1745c0f56f9c8531</code>, used as a two-key 3DES key."
   ],
   [
    "Decrypt",
    "3DES-EDE2 in ECB mode, then strip the PKCS7 padding."
   ]
  ],
  "ciphertext": "4F69DF42D6763A6ED16CFA6690C11F683B58957B723C0C577F90A1A807AEDECCDFBE482CC27EE53534A67FB278BC9C8A",
  "raw": "8550A81BD25563992652FE4090DF3081B7F59718"
 },
 "plaintext": "8550A81BD25563992652FE4090DF3081B7F59718",
 "word_layer": null,
 "credit": {
  "kind": "key",
  "what": "Key found: MD5(\"A858\"), the label printed in clear at the top of the post. It decrypts to a SHA-1 digest, identified as the info-hash of a BitTorrent file."
 },
 "decoded_layers": null,
 "guids": null,
 "count_from_length": null,
 "run": null,
 "known_solution": [
  {
   "Method": "3DES-ECB, key MD5(A858)",
   "Result": "SHA-1 digest 8550A81B...B7F59718",
   "Explanation": "Plaintext is a 40-hex digest; it is the BitTorrent info-hash of 'Think Like Your Customer.rar' (torrent has no seeders; meaning of the post open)",
   "Re-checked": "label + 3DES MD5(\"A858\")"
  }
 ],
 "tags": [
  "pre-automation",
  "2012",
  "Solved special post",
  "manual",
  "arctic-only",
  "key: the label printed in the post",
  "hashes and key-chain material",
  "found by this project"
 ],
 "title_zone_hours": -7,
 "title_zone": "UTC−7",
 "writeup": {
  "title": null,
  "markdown": "I have been going through some lesser known posts that are not in the auto analysis archive, amongst these I managed to find a solution for two of the posts `u1rti`(title 201205231544) which was originally found [here](http://www.reddit.com/r/A858DE45F56D9BC9/comments/u1rti/201205231544/)  (first two line breaks original, added linebreaks between the blocks for readability):\n\n    A858\n\n    4F69DF42D6763A6E D16CFA6690C11F68\n    3B58957B723C0C57 7F90A1A807AEDECC\n    DFBE482CC27EE535 34A67FB278BC9C8A \n\nWe can decrypt the hex after A858 using A858 as the password, yielding this:\n\n    8550A81BD25563992652FE4090DF3081B7F59718\n\n\nThe other post, `u58gm` (title 201205251618), originally found [here](http://www.reddit.com/r/A858DE45F56D9BC9/comments/u58gm/201205251618/) (line breaks added for readability):\n\n    D71038F75D26DB33 80C864491A4EC70D\n    B7E5F7DB8DFB8252 0CCAC7D42694D2F6\n    AAEDEFB883C6EAD5 34A67FB278BC9C8A \n\nThis decrypts using the same key to an output similar to the one from the other post:\n\n    D881ED889FCE527960951A1225E856A84C88AEB2\n\nCommands to decrypt both (be careful with the line breaks in the first command, they do matter in the `echo` and `cut`):\n\n    echo 'A858\n\n    4F69DF42D6763A6E D16CFA6690C11F68 3B58957B723C0C57 7F90A1A807AEDECC DFBE482CC27EE535 34A67FB278BC9C8A' \\\n      | cut -d '\n    ' -f 2,3,4,5,6,7 \\\n      | xxd -r -p \\\n      | openssl enc -d -des-ede-ecb -K \"$(printf 'A858' | md5sum | cut -d ' ' -f 1)\"; echo\n\n    echo 'D71038F75D26DB33 80C864491A4EC70D B7E5F7DB8DFB8252 0CCAC7D42694D2F6 AAEDEFB883C6EAD5 34A67FB278BC9C8A' \\\n      | xxd -r -p \\\n      | openssl enc -d -des-ede-ecb -K \"$(printf 'A858' | md5sum | cut -d ' ' -f 1)\"; echo\n**Update: the first one is a torrent info-hash**\n\nBoth outputs are 40 hex characters, which is exactly the size of a SHA-1 hash, and also of a BitTorrent info-hash. The first one turns out to be a real info-hash. A public torrent cache still has the `.torrent` file for `8550A81BD25563992652FE4090DF3081B7F59718`, and hashing that file's `info` section with SHA-1 gives exactly the value from `u1rti`. So this is not a coincidence: A858 posted the identifier of that specific torrent.\n\nThe torrent itself:\n\n- a single file called `Think Like Your Customer.rar`, 2,074,249 bytes (the title of a 2004 sales book)\n- created with uTorrent 2.2.1 on 2012-05-23 at 18:45 UTC\n\n`u1rti` was posted the same day at 22:46 UTC, four hours after the torrent was created.\n\nUnfortunately it's a dead end: nobody is seeding it any more, so there's no way to see what the `.rar` really contained. The book title may well be a cover name; `.rar` files can hold anything. It's also possible A858 simply took the hash of someone else's torrent from that day.\n\nThe second hash (`u58gm`, two days later) isn't in any torrent cache I could find, and neither hash is in public SHA-1 lookup databases. Given the first one, it's probably also an info-hash of a torrent that was never cached."
 },
 "page": "posts/u1rti/"
}