Nothing-Up-My-Sleeve Numbers
Constants whose construction puts them above suspicion of hidden properties. Hashes, ciphers, and pseudorandom generators need fixed values for mixing and initialization, and a designer who picks them freely could pick values that hide a weakness only the designer can exploit. A nothing-up-my-sleeve (NUMS) number is built from a source the designer cannot steer: the leading digits of π, the binary expansion of e, the square roots of small primes, the text of a famous document. The phrase comes from stage magic, where a performer holds open empty sleeves before a trick. 1
Where the idea comes from
The motivating case is DES. Its 1975 S-box constants arrived from the NSA with no explanation and drew sustained suspicion until differential cryptanalysis became public knowledge and the constants turned out to have been selected against exactly that then-classified technique. The lesson the field drew was not that unexplained constants are backdoors but that unexplained constants cannot be argued about at all, so later designs made their constants reproducible from public, unsteerable sources. 2
Construction recipes
The standard move is to take a famous, predetermined real number or document and derive the constant from its first digits, at a fixed, announced offset:
- Rivest generated MD2’s S-box from π and MD5’s constants from the sine function.
- SHA-1 and SHA-2 take their initial hash values from the binary expansions of the square roots of the first eight primes (plus a counting-pattern IV for SHA-1).
- Blowfish initializes its key schedule from the binary representation of π − 3; RFC 3526’s IKE primes come from π as well.
- The AES candidate DFC derives every constant, including its whole S-box, from the binary expansion of e; ARIA’s key schedule uses 1/π; RC5 mixes e and the golden ratio.
- TEA and Red Pike use 0x9e3779b9, which is ⌊2³²/φ⌋; BLAKE’s constant words are leading fractional bits of π; Salsa20 uses the ASCII string “expand 32-byte k”; OpenBSD’s bcrypt initializes from “OrpheanBeholderScryDoubt”; NewDES derives its S-box from the U.S. Declaration of Independence.
The offset matters as much as the source: leading digits leave little room for adjustment, while digits millions of places deep are suspect precisely because choosing the starting point is itself a free parameter. 3
Counterexamples and limits
The construction is a provenance argument, not a proof. Streebog’s S-box was claimed to be randomly generated and later reverse-engineered as algorithmic, with “puzzling” weaknesses (Biryukov, Perrin, and Udovenko, EUROCRYPT 2016). Dual_EC_DRBG’s recommended points were criticized in 2007 and, after the 2013 Snowden reporting, treated as an actual backdoor. ANSSI’s FRP256v1 ships totally unexplained parameters. DES itself is the ambiguous case — an unexplained constant whose explanation arrived decades late and exonerated it. 4
Between “transparent” and “backdoored” sits a middle tier Wikipedia labels manipulatable, but not trivially. ANSI X9.62’s “verifiably at random” curve selection is a hash applied to some piece of data: manipulation resistance rests entirely on the hash’s preimage resistance, while the choice of input remains unrestricted, so a motivated designer can grind candidate inputs until one lands on a curve with an exploitable property. IEEE P1363 and NIST 186, which inherited these curves, tone down the generation claims. The NIST P-curves are the best-known members of this class. 5
Bernstein and coauthors push the critique further: a NUMS number used as the starting point of a complex generation procedure may not prevent backdoors at all. “Harmless” constants are plentiful (π, e, Euler gamma, √2, √3, √5, √7, log 2, ζ(3), sin 1, …), each with several binary representations, and the seed can be fed through any of many hash functions; with enough adjustable parameters, combinatorial explosion gives an automatic search room to construct an object with desired backdoor properties while every ingredient looks innocent. Their BADA55 research program — eight named cryptographers studying “what you can get away with in a standard and what you can’t,” including the 2015 white paper How to manipulate curve standards — maps the boundaries of acceptability this creates. 67
Case study: the NIST curve seeds
The P-curves sit in the manipulatable-but-not-trivially tier by construction: SHA-1 over seeds that were supplied by the NSA with no explanation of how they were picked. Twenty-five years of argument followed, and the October 2026 recovery closed it — the seeds came from lrand48() seeded with Unix timestamps, giving a would-be selector barely 30 bits of freedom (timestamps times candidate index), too little to target a weak-curve class or embed a NOBUS backdoor. See nist-curve-seed-origins for the full provenance story. The case draws the practical boundary of the NUMS idea: a generation recipe can be mathematically transparent and still leave its inputs unexplained, and it is the inputs — not the recipe — that the suspicion lives in. 8
Open questions
- For the P-curves there remains no proof of the presence or absence of a backdoor; what changed is that the selection-freedom arithmetic now bounds what a backdoor could have been. 9
- Whether the BADA55-style manipulation search bites depends on the procedure around the constant: for simple uses (S-boxes, IVs, round constants) the construction is as strong as it looks, and the demonstrated failures involve extra generative steps where choices accumulate.
Related concepts
- nist-curve-seed-origins — the seed-provenance case study, resolved by recovering the generating program
- model-backdoors — the same suspicion one layer up: could an unexplained artifact hide planted behavior, and what evidence answers it
- weak-entropy-key-generation — generation whose provenance is unauditable because the entropy path is broken; NUMS is the parameter-side counterpart, built to be auditable by construction
- coldcard-entropy-incident-2026 — what unauditable generation costs when the output is a secret rather than a published constant
- reproducible-builds — the same posture applied to binaries: move the trust claim from “they said so” to “anyone can redo it”
Sources
- Wikipedia contributors — Nothing-up-my-sleeve number
- Bernstein, Chou, Chuengsatiansup, Hülsing, Lambooij, Lange, Niederhagen, van Vredendaal — BADA55: Introduction