(Background at the bottom). Reading through the implementation (link at very bottom), they seem to be giving away quite a few bits of the secret, which makes me wonder if they did that on purpose. The challenge is to find the secret value w = 2^(2^t) (mod n) given t and n. But then they also give us w XOR an ASCII congratulatory message sgen, which includes some known appended plaintext: sgen = sgen.append(" (seed value b for p = "+prand.toString()+")"); prand is an ASCII decimal representation, where they find the next prime after 5^prand % (2^1024) to get p, one of the factors of n, which lets you prove that you've solved the puzzle. They also right justify the congratulatory message before XOR, so they're presumably also giving us some number of high order bits of w. So that makes me wonder things like: * Is it easier to compute w = 2^(2^t) (mod n) given known bits of w? * Is there some relationship between 5^prand % (2^1024) and w = 2^(2^t) (mod n) such that, say, the first ASCII digit of prand XOR the appropriate bits of w lets us recover prand a piece at a time? * Seems like w should be hard to predict but isn't expected to be as random as a secure PRNG. Does that give us any further hints about w XOR sgen? Background: https://hackaday.com/2019/04/30/mit-cryptographers-are-no-match-for-a-determ... Twenty years ago, a cryptographic puzzle was included in the construction of a building on the MIT campus. The structure that houses what is now MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) includes a time capsule designed by the building’s architect, [Frank Gehry]. It contains artifacts related to the history of computing, and was meant to be opened whenever someone solved a cryptographic puzzle, or after 35 years had elapsed. The puzzle was not expected to be solved early, but [Bernard Fabrot], a developer in Belgium, has managed it using not a supercomputer but a run-of-the-mill Intel i7 processor. The capsule will be opened later in May. ... https://people.csail.mit.edu/rivest/lcs35-puzzle-description.txt