RC2's long-unexplained π tables reproduced exactly with three-digit Fisher–Yates shuffle

A 30-year-old crypto question answered

The 256 fixed numbers at the heart of RC2, Ron Rivest's block cipher from the late 1980s, can now be regenerated from scratch. A cryptography research note by Khalid Hamadeh, which surfaced on the front page of Hacker News, shows that both of the cipher's published tables are reproduced exactly by a Fisher–Yates shuffle that uses the decimal digits of π as its random source: each draw consumes exactly three digits, and draws that would skew the result are thrown away.

RC2's specification, RFC 2268, describes its key-schedule table PITABLE as "based on the digits of PI" but never explains the derivation, and a second permutation printed later in the same document — one that maps effective key lengths of 1 to 255 bits to the RC2Version parameter used with RC2-CBC and in PKCS #5 — is given no origin at all. According to the note, PITABLE comes from running the shuffle starting at π's leading 3, and the second table is the same procedure started four digits later. Both match in all 256 positions.

Why the table's origin mattered

Every RC2 implementation ships the same scrambled ordering of the numbers 0 to 255. A fixed table like that is precisely where a cipher designer could conceal a weakness, which is why cryptographers prefer to derive such constants from a public value such as π and publish the method so anyone can check it. These so-called nothing-up-my-sleeve numbers only reassure when the derivation is out in the open.

RC2 named its constant but not its method. When the cipher's code leaked in 1996, an engineer at RSA Data Security, the company that owned RC2, publicly asked how anyone could tell whether the table really came from π. The note reports that an extensive search found no earlier public answer, and some implementations, LibTomCrypt among them, still carry the leaked code's comment that the table was "probably derived somehow from pi".

How the shuffle works

The construction treats the numbers 0 to 255 as a deck of cards. Working from the second card to the last, each one is swapped with a card chosen from itself or any earlier position — the textbook Fisher–Yates shuffle. The randomness comes from π's decimal digits, read three at a time to form a number from 0 to 999; the chosen position is that number's remainder after division by the number of available places. When the places don't divide evenly into 1,000, draws landing in the top of the range are discarded and three fresh digits are read, keeping every outcome equally likely.

The whole shuffle consumes 828 digits of π and discards 21 draws, two of them at the run of six 9s beginning at π's 762nd decimal place, known as the Feynman point. The second table likewise uses 828 digits with 21 discards.

Why nobody found it sooner

Rivest confirmed in 2014 that his MD2 hash function builds its own π table with the same shuffle — but MD2 reads only as many digits as each draw needs: one while there are at most ten choices, two up to a hundred, three beyond that. The note shows that applying MD2's exact rule to RC2 matches 1 of 256 positions, no better than chance, so the obvious cross-check would have pointed away from any connection. The only change needed is reading three digits every time.

Checks and near misses

The note describes a search of roughly 100,000 candidate methods — four digit sources, seven ways of drawing a number, six shuffle orders, 300 starting points, and both the table and its inverse — in which exactly one matched all 256 positions: the simplest rule. Nearby variants collapse toward chance: dropping the discard step matches only 29 positions, starting one digit later matches one, and running the shuffle on the digits of e matches none. The result was then reproduced by two independent implementations, one written from the RFC plus a one-paragraph description of the rule, the other using its own computation of π and a fresh copy of the RFC.

The note also records that Google's AI Overview, asked on 17 October 2026 how PITABLE was generated, described a hexadecimal scheme whose worked example begins 24 3f 6a, where the published table begins d9 78 f9.

Why it matters

The finding has no bearing on RC2's security — the note is explicit about that. Its value is that it finishes an argument the original specification left incomplete: with a public, verifiable derivation, anyone can rebuild both tables from π and confirm that nothing in them was hand-picked to hide a weakness. The author is careful about certainty, calling this very likely the original method, since how Rivest arrived at the rule is not documented anywhere. As a side effect, the episode is a tidy demonstration of why naming a constant without publishing a method is not good enough — and of why a confident AI summary is no substitute for checking a table byte by byte.