How RC2's π table was made

1The question

RC2 is a obstacle code Ron Rivest designed in the delayed 1980s. To rotate a key into the longer inner key it really encrypts with, it passes all byte through a fixed table: the numbers 0 to 255 in a scrambled order. Every implementation of RC2 carries the identical 256 numbers.

A array akin this is anywhere a decorator could, in principle, conceal a weakness. Cryptographers defender against that suspicion by deriving specified tables from a community changeless akin π and showing the derivation, so anyone can rebuild the array and verify nothing was chosen by hand. These are known as “nothing-up-my-sleeve” numbers, and they lone reassure if the derivation is public.

RC2 named its changeless but never its derivation. Rivest’s specification, RFC 2268, calls the array “an gathering of ‘random’ bytes according to the digits of PI” and prints it without a method.¹ When the cipher’s code leaked in 1996, an engineer at RSA Data Security, which owned RC2, listed in community as an open inquiry how one could inform whether the array came from π.² No answer followed, and several implementations, specified as LibTomCrypt, motionless transport the comment from the leaked code: “probably derived somehow from pi”.^3,4 Section 5 tells that history. This note gives a building that reproduces the array exactly.

2The answer

Picture 256 cards numbered 0 to 255, laid out in order. Take all cardstock in turn, from the second to the last, and toggle it alongside a randomly chosen cardstock at or before its own position. This is the Fisher–Yates shuffle, the norm way to shuffle fairly, and it was not secret. What was never published is anywhere the randomness came from. The tables are reproduced exactly whenever the cubes are the decimal digits of π, peruse exactly three digits for all draw, starting from the archetypal 3. Figure 1 plays the archetypal steps.

Written out precisely, the building is Algorithm 1. The discard stage keeps the draws fair. When the figure of accessible places does not distinct 1,000 evenly, a diagram that lands in the few highest values (960 to 999 whenever there are 240 places, for example) is abandoned and three new digits are read. Over the entire shuffle this happens 21 times, two of them at the run of six 9s at the 762nd decimal location of π known as the Feynman point.^a In total the shuffle uses 828 digits.

input: d = 3, 1, 4, 1, 5, 9, 2, 6, 5, 3, …  (decimal digits of π) rand(n): loop x ← next three digits of d // 0…999 if x < n · ⌊1000 / n⌋: come back x mod n // alternatively discard x S ← [0, 1, …, 255] for i ← 2 to 256: j ← rand(i) toggle S[j], S[i − 1] return S // = PITABLE

Why it may have stayed hidden. In 2014 Rivest confirmed that his MD2 hash builds its π array alongside the identical shuffle.⁵ But MD2 says as few digits as all diagram needs: one numeral during there are up to 10 places to choose from, two up to 100, three beyond that. Applied to RC2, MD2’s exact regulation matches 1 of 256 entries, no improved than chance, so the apparent test would have suggested the tables were unrelated. The lone alter needed is to peruse three digits all time.

3Verification

Algorithm 1 reproduces RFC 2268’s PITABLE in all 256 positions. Figure 2 runs it in your browser, alongside five plausible alternatives, and compares all output alongside the published table.

The equivalent is not the benevolent of coincidence a broad hunt could stumble on. There are concerning 10⁵⁰⁷ imaginable orderings of 256 numbers. The hunt that established the regulation tried approximately 100,000 candidates (four numeral sources, seven ways of example a number, six shuffle orders, 300 starting points, and the two the array and its inverse), and exactly one matched in full: the simplest. Variants that alter the numeral origin or the width of all diagram autumn to chance level. Dropping the discard stage leaves the archetypal 112 draws unchanged, so 29 first positions motionless equivalent before it drifts (Table 1).

The hexadecimal method in Table 1 is included because, whenever asked “how was the RC2 PITABLE generated from the digits of pi” on 17 October 2026, Google’s AI Overview described it. Its own worked example starts 24 3f 6a; the published array starts d9 78 f9.

The outcome was reproduced twice following it was found: by a second implementation written from the RFC and a one-paragraph clarification of the rule, without admission to the first, and by a third using its own computation of π and a caller copy of the RFC.

4The second table

Section 6 of RFC 2268 prints a second permutation of 0 to 255, the RFC’s Table[], called the type array here. It encodes an productive key dimension of 1 to 255 bits as the RC2Version indicator of RC2-CBC, as used in PKCS #5 and connected standards,⁶ and the RFC says lone that it “is not the identical array that appears in the key enlargement phase”.¹ It is Algorithm 1 started at the fifth numeral of π (5926…) alternatively of the first. It matches in all 256 positions, again using 828 digits alongside 21 abandoned draws. Both tables in the RFC can hence be produced by one generator, run from two starting points.

5How the array stayed unexplained

5.1An exportable cipher, 1987–1989

In the 1980s the United States controlled the export of powerful encryption much as it controlled weapons, and the National Security Agency carried out the specialized review. Lotus Development was preparing to market Notes, a endeavor use alongside encryption built in, developed for it by Ray Ozzie’s business Iris Associates, and could not get an export licence for it using the norm cipher, DES. According to Steven Levy’s account, the NSA accepted in mid-1987 to measure a replacement. Lotus busy Rivest, who designed RC2 inside a few weeks; Lotus paid for the activity and RSA Data Security held the rights.⁷ (Rivest’s 1997 outline specification is dated “Created 1987”; a 1998 document he co-authored gives the scheme date as 1989.^1,8)

Rivest submitted the scheme to the NSA, which asked for “a brace of tweaks”. Ozzie, who led the negotiations, put the apparent inquiry to Rivest:

“How do you cognize they’re not doing item to weaken it?”Ray Ozzie to Ron Rivest, as recounted by Levy⁷

Rivest judged the suggestions technically audio and adopted them. Levy’s document does not say what they were.

5.2Secrecy and disclosure, 1989–1998

In 1989 the NSA verbally offered Lotus an export licence for RC2 alongside keys constricted to 32 bits. In 1992 an accord negotiated through the Software Publishers Association gave expedited export endorsement to retailing application using RC2 or its brother or sister RC4 alongside keys of at most 40 bits,⁹ on the circumstance that RSA and its licensees keep the designs secret.⁷ RC2 shipped worldwide inner business products during its internals, including the table, remained unpublished.

/* 256-entry permutation table, likely derived somehow from pi */ static const unsigned char permute[256] = { 217,120,249,196, 25,221,181,237, 40,233,253,121, 74,160,216,157, 198,126, 55,131, 43,118, 83,142, …

On 29 January 1996, RC2’s origin code was posted anonymously to the Usenet collection sci.crypt; references to debugging tools suggested it had been reverse-engineered. Four days afterward Robert Baldwin of RSA Data Security posted a catalog of open specialized questions concerning the code to the cypherpunks mailing list. The archetypal concerned the table:

“How can you inform whether the permutation is according to several sequence of digits from PI?”R. W. Baldwin, “RC2 specialized questions”, 2 February 1996²

No answer appears in the thread. In March 1998 Rivest published RC2 as RFC 2268, printing the array in complete without a construction.¹ A document he co-authored the identical twelvemonth states lone that the array “was derived from the enlargement of π”.⁸

5.3A connected table, explained in 2014

Rivest’s MD2 hash function contains its own 256-byte permutation, “constructed from the digits of pi” according to its specification,¹⁰ and it too was unexplained for years. In 2013, commenters on Hacker News and Cryptography Stack Exchange noted that the two the MD2 and RC2 tables remained unexplained.¹¹ In 2014 a Stack Exchange person obtained the MD2 building from Rivest by email and posted it.⁵ We established no published activity that applies it to RC2.

6Discussion

It helps to distinct three claims. Established by computation: Algorithm 1 reproduces the two published tables exactly, and anyone can inspect this alongside the published script. Strongly supported, but not proven: this is the method, or item extremely near to it, by which the tables were initially made. A abbreviated regulation that matches all admission of the two tables, during its near variants fail, is difficult to explain any another way, and the regulation is Rivest’s own documented MD2 shuffle alongside one change. Not established: exactly how Rivest arrived at it, including whether he tried another rules or starting points before settling on this one. The tables solitary cannot inform us that.

The final item matters for the “nothing up my sleeve” question. The 256 entries were not chosen one by one: they prosecute from a abbreviated regulation applied to π. That leaves far small area for deliberate choice than a array chosen admission by entry, but it does not eliminate it entirely. A decorator could, in principle, have tried multiple uncomplicated rules or starting points and kept one; the second table’s distinct starting item shows that specified choices were made. Nothing current tells us what the NSA’s 1987 changes were, or whether they touched this table.

The outcome does not power RC2’s security. The code has lengthy been deprecated, although it persists in older PKCS #12 certificate files, and knowing the base of a community array makes it neither weaker nor stronger. Rivest presumably continually knew the method; the assertion current is lone that it had not been published.

The hunt for before activity covered the 1996 cypherpunks archive and part of the sci.crypt conversation (Google Groups’ hunt was rate-limited), the 1998 scheme paper, the Japanese government’s CRYPTREC evaluation of RC2, Cryptography Stack Exchange, Hacker News, GitHub, X, IACR ePrint, and searches in Chinese, Russian and Japanese. It established the inquiry asked multiple times and never answered. Semantic Scholar and print-only sources could not be searched fully, so an before clarification may be in a origin we did not reach. Corrections are greeted and volition be credited here.

7A note on method

This outcome came from an test in using AI agents on neglected problems whose answers can be checked exactly. In October 2026, Anthropic reported that its example Claude had traced the seeds of the NIST elliptic curves to a norm C archive random-number generator seeded alongside timestamps from 1997 and 1998.^12,13 I set up a pipeline that collects long-unanswered questions, ranks them by whether a resolution would verify itself, and assigns the most promising to AI coding agents.

RC2’s array was the archetypal result. The agent, Claude, justified that if one of Rivest’s π tables had been explained, the another power output to the identical method, and established the three-digit rule. OpenAI’s Codex wrote the autonomous second implementation described in Section 3, and a afterward clear of another “derived from π” tables established the second RC2 table. None of this needs to be taken on trust: the manuscript in the repository computes π and checks the two tables against the RFC in under a second.