LCS35

LCS35 is a cryptographic challenge and a time-lock puzzle set by Ron Rivest in 1999. The challenge is to calculate the value

$${\displaystyle w=2^{2^{t}}{\pmod {n}}}$$

where t is a specific 14-digit (or 47-bit) integer, namely 79685186856218, and n is a specific 616-digit (or 2048-bit) integer that is the product of two large primes (which are not given). The value of w can then be used to decrypt the ciphertext z, another 616-digit integer. The plaintext provides the concealed information about the factorisation of n, allowing the solution to be easily verified.

The idea behind the challenge is that the only known way to find the value of w without knowing the factorisation of n is by t successive squarings. The value of t was chosen so that this brute-force calculation would require about 35 years using 1999 chip speeds as a starting point, taking into account Moore's law. Rivest notes that "just as a failure of Moore's Law could make the puzzle harder than intended, a breakthrough in the art of factoring would make the puzzle easier than intended."

The challenge was set at (and takes its name from) the 35th anniversary celebrations of the MIT Laboratory for Computer Science, now part of MIT Computer Science and Artificial Intelligence Laboratory.

The LCS35 challenge was solved on April 15, 2019, twenty years later, by programmer Bernard Fabrot.^[1][2] The plaintext begins with "!!! Happy Birthday LCS !!!".^[3]

On May 14, 2019, Ronald L. Rivest published a new version of LCS35 (named CSAIL2019) to extend the puzzle out to the year 2034.^[4]