How RC2's π table was made

This explains how the 256-byte permutation used in RC2’s key schedule, long described as “based on the digits of π” without a published derivation, can be exactly reconstructed. The permutation is produced by applying the Fisher-Yates shuffle to the ordered list 0-255 while using decimal digits of π as the source of randomness: read exactly three digits per draw (0-999), take the draw mod k to choose the swap position, and reject any draw that would bias the outcome (rejection sampling when 1000 is not a multiple of k). PITABLE begins at the initial 3 of π; a second RC2 table starts four digits later. The procedure uses 828 digits and discards 21 draws (including ones at the Feynman point). A related MD2 shuffle reads varying numbers of digits per draw, which likely obscured the connection previously.

The reconstruction reproduces both published tables exactly and so provides strong, though not strictly definitive, evidence that this was the original method Rivest used. The history: the question was raised after a 1996 source leak and remained unanswered in public records; an automated search-and-check pipeline using AI agents found the three-digit rule and independent code verifies the match in under a second. The result has no impact on RC2’s security; it clarifies the “nothing-up-my-sleeve” provenance while noting that choice of starting points or rule variants could still reflect design choices.