{
 "id": "u58gm",
 "title": "201205251618",
 "title_time": "2012-05-25T16:18",
 "author": "[deleted]",
 "account": "A858DE45F56D9BC9",
 "subreddit": "A858DE45F56D9BC9",
 "created_utc": "2012-05-25T23:17:34Z",
 "permalink": "https://www.reddit.com/r/A858DE45F56D9BC9/comments/u58gm/201205251618/",
 "arctic_shift": "https://arctic-shift.photon-reddit.com/api/posts/ids?ids=u58gm",
 "sources": [
  "arctic-shift"
 ],
 "body": "D71038F75D26DB33 80C864491A4EC70D B7E5F7DB8DFB8252 0CCAC7D42694D2F6 AAEDEFB883C6EAD5 34A67FB278BC9C8A ",
 "body_source": "arctic-shift",
 "body_other_version": null,
 "body_hex_chars": 96,
 "bytes": 48,
 "score": 1,
 "num_comments": 0,
 "category": {
  "code": "S",
  "label": "S solved 3DES → text"
 },
 "kind": "manual",
 "encryption": "decrypted",
 "status": "partial",
 "summary": "A 40-hex SHA-1-shaped digest. 3DES, key MD5(A858). Open: its preimage.",
 "content_type": [
  "Hashes and key-chain material"
 ],
 "cipher": {
  "algorithm": "3DES-EDE2 (two-key Triple DES)",
  "mode": "ECB",
  "padding": "PKCS7",
  "key_derivation": "MD5(password)",
  "password_recipe": "the label printed in the post",
  "password": "A858",
  "key_hex": "ecbb313d995eac9d1745c0f56f9c8531",
  "steps": [
   [
    "Derive the key",
    "Password = <code>A858</code> (the label printed in the post); key = MD5(password) = <code>ecbb313d995eac9d1745c0f56f9c8531</code>, used as a two-key 3DES key."
   ],
   [
    "Decrypt",
    "3DES-EDE2 in ECB mode, then strip the PKCS7 padding."
   ]
  ],
  "raw": "D881ED889FCE527960951A1225E856A84C88AEB2"
 },
 "plaintext": "D881ED889FCE527960951A1225E856A84C88AEB2",
 "word_layer": null,
 "credit": {
  "kind": "key",
  "what": "Same key as u1rti, MD5(\"A858\"); it decrypts to a second SHA-1 digest."
 },
 "decoded_layers": null,
 "guids": null,
 "count_from_length": null,
 "run": null,
 "known_solution": [
  {
   "Method": "3DES-ECB, key MD5(A858)",
   "Result": "SHA-1 digest D881ED88...4C88AEB2",
   "Explanation": "Plaintext is a 40-hex digest; preimage and meaning unknown; not in any torrent cache found",
   "Re-checked": "3DES MD5(\"A858\")"
  }
 ],
 "tags": [
  "pre-automation",
  "2012",
  "Solved special post",
  "manual",
  "arctic-only",
  "key: the label printed in the post",
  "hashes and key-chain material",
  "found by this project"
 ],
 "title_zone_hours": -7,
 "title_zone": "UTC−7",
 "writeup": {
  "title": null,
  "markdown": "I have been going through some lesser known posts that are not in the auto analysis archive, amongst these I managed to find a solution for two of the posts `u1rti`(title 201205231544) which was originally found [here](http://www.reddit.com/r/A858DE45F56D9BC9/comments/u1rti/201205231544/)  (first two line breaks original, added linebreaks between the blocks for readability):\n\n    A858\n\n    4F69DF42D6763A6E D16CFA6690C11F68\n    3B58957B723C0C57 7F90A1A807AEDECC\n    DFBE482CC27EE535 34A67FB278BC9C8A \n\nWe can decrypt the hex after A858 using A858 as the password, yielding this:\n\n    8550A81BD25563992652FE4090DF3081B7F59718\n\n\nThe other post, `u58gm` (title 201205251618), originally found [here](http://www.reddit.com/r/A858DE45F56D9BC9/comments/u58gm/201205251618/) (line breaks added for readability):\n\n    D71038F75D26DB33 80C864491A4EC70D\n    B7E5F7DB8DFB8252 0CCAC7D42694D2F6\n    AAEDEFB883C6EAD5 34A67FB278BC9C8A \n\nThis decrypts using the same key to an output similar to the one from the other post:\n\n    D881ED889FCE527960951A1225E856A84C88AEB2\n\nCommands to decrypt both (be careful with the line breaks in the first command, they do matter in the `echo` and `cut`):\n\n    echo 'A858\n\n    4F69DF42D6763A6E D16CFA6690C11F68 3B58957B723C0C57 7F90A1A807AEDECC DFBE482CC27EE535 34A67FB278BC9C8A' \\\n      | cut -d '\n    ' -f 2,3,4,5,6,7 \\\n      | xxd -r -p \\\n      | openssl enc -d -des-ede-ecb -K \"$(printf 'A858' | md5sum | cut -d ' ' -f 1)\"; echo\n\n    echo 'D71038F75D26DB33 80C864491A4EC70D B7E5F7DB8DFB8252 0CCAC7D42694D2F6 AAEDEFB883C6EAD5 34A67FB278BC9C8A' \\\n      | xxd -r -p \\\n      | openssl enc -d -des-ede-ecb -K \"$(printf 'A858' | md5sum | cut -d ' ' -f 1)\"; echo\n**Update: the first one is a torrent info-hash**\n\nBoth outputs are 40 hex characters, which is exactly the size of a SHA-1 hash, and also of a BitTorrent info-hash. The first one turns out to be a real info-hash. A public torrent cache still has the `.torrent` file for `8550A81BD25563992652FE4090DF3081B7F59718`, and hashing that file's `info` section with SHA-1 gives exactly the value from `u1rti`. So this is not a coincidence: A858 posted the identifier of that specific torrent.\n\nThe torrent itself:\n\n- a single file called `Think Like Your Customer.rar`, 2,074,249 bytes (the title of a 2004 sales book)\n- created with uTorrent 2.2.1 on 2012-05-23 at 18:45 UTC\n\n`u1rti` was posted the same day at 22:46 UTC, four hours after the torrent was created.\n\nUnfortunately it's a dead end: nobody is seeding it any more, so there's no way to see what the `.rar` really contained. The book title may well be a cover name; `.rar` files can hold anything. It's also possible A858 simply took the hash of someone else's torrent from that day.\n\nThe second hash (`u58gm`, two days later) isn't in any torrent cache I could find, and neither hash is in public SHA-1 lookup databases. Given the first one, it's probably also an info-hash of a torrent that was never cached."
 },
 "page": "posts/u58gm/"
}