Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

For fun, I'm learning more about cryptography and hashing. I'm implementing the MD2 hash function following RFC 1319 (http://tools.ietf.org/html/rfc1319). I'll preface by saying I know there are libraries, I know this is an old hash, and I do not intend to use this in anything real-world, so don't anyone freak out.

In learning about S-tables I notice MD2 uses an S-table based on Pi. What I don't understand, is how these numbers relate to Pi. And oddly, I can't find anywhere that describes it. The RFC just says:

This step uses a 256-byte "random" permutation constructed from the digits of pi.

In the reference code, there is the following comment:

Permutation of 0..255 constructed from the digits of pi. It gives a "random" nonlinear byte substitution operation.

Looking at the first few bytes:

41, 46, 67

I cannot see how you get these numbers from Pi. I've tried looking at the binary representation of Pi, and these numbers do not seem to match up with the first bytes of pi.

My usual Googling just leads me back to the RFC or other implementations which seem to copy the above comment exactly. No where can I find where the construction of this table from Pi is explained.

share|improve this question

migrated from stackoverflow.com Nov 25 '13 at 12:19

This question came from our site for professional and enthusiast programmers.

@user8911 - they are not pi. the question is how the fractional part of pi is used to derive a permutation of 0...255 –  andrew cooke Nov 25 '13 at 16:09
Interesting question, I don't know the answer yet (and couldn't find it with some googling). Might be actually not a nothing-up-my-sleeve-number, but only pretending to be one ;-) –  Paŭlo Ebermann Nov 25 '13 at 20:10
The authors of Network Security: Private Communications in a Public World cast some doubt on whether this table is actually based on Pi. –  archie Nov 26 '13 at 0:30
Also note that RC2 (in RFC2268) also has a permutation supposedly based on the digits of $\pi$ in its key schedule. The final table in that RFC is also unexplained (and used in other algorithms from RSA as well). These were also never explained, AFAIK. –  Henno Brandsma Dec 10 '13 at 16:06
It's a mystery to me why no one ever asked the creator of that s-table. When weird things show up in RFCs, someone like me expects the crypto-pros to speak up and ask. But we have to remember that crypto-professionals were a bit rarer "back in the days". I'm probably expecting too much from the past. –  Trina Jan 7 at 21:38

1 Answer 1

The world may never know. As other's have stated, no amount of googling turns anything up. Also, as archie noted, some industry professionals have tried to find the relationship and failed. Below is a scan from the text Private Communication in a Public World.

enter image description here

share|improve this answer
As an aside: about half a year ago, I did “cheat” by sending a friendly email to the office of Mr. Rivest, pointing to this question with a link and describing in a few (3-4) lines what we’re trying to find out. I kindly asked if it were possible to shine some light on the permutation that could possibly have been used, or if I – at least – could get a little note/feedback saying that “that knowledge is lost forever”. Sadly, I never received any reply… (I guess that’s what you get when things get marked as “historic”.) –  e-sushi 5 hours ago
I sent basically the same email and was also unanswered. –  Keith 4 hours ago

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.