Both of them were eventually decrypted. The decoy was a misdirection attempt to get people to shut up about the whole thing, since the original contained a passphrase that had been reused multiple times for Mojang's internal operations. But it only caused more people to go digging as they noticed the hash changed, along with an employee acting highly defensive about it.

They used "boxpig41" for the original and "thespicemustflow" for the decoy. Both of them contain the jar and assets for Minecraft 1.0, but the original also contained an ordinary copy of the Minecraft launcher, so that the files could used to run it during a live event even if internet access goes down, hence the larger file size.

Ah, the video is a year old. There is another link to a reddit post in the thread. Supposedly it is solved now! Read more there

See comments below.