Your Tiny Key and the Number Lock

If you bought a recent prime, you might have noticed a small detail: alongside your prime number, there’s a tiny 3-character key. Something like K7P or M3X.

It looks almost dismissively short. Three characters? Modern passwords are supposed to be the length of a small novel. So what’s it for, and why isn’t it longer?

The answer involves a clever piece of 1970s cryptography, a deliberate decision to not be secure, and a quietly satisfying property called reversibility.

What the key is hiding

Inside your prime, the puzzle bits — the count of characters, your Huffman-packed name, a small nonce region — aren’t sitting there in plain sight. They’ve been run through a scrambler that uses your key as the recipe for the scrambling.

Pick a different key, and the same bits scramble to a completely different prime. Pick the correct key during decoding, and the scrambling unwinds perfectly and you get the original bits back.

The scrambler we use is called a Feistel network, named after Horst Feistel, an IBM cryptographer who designed it in the early 1970s. It’s the same family of design that became DES, the U.S. government encryption standard for decades, and it shows up inside dozens of modern ciphers. The trick that makes Feistel networks special is that the same machinery runs in both directions — you don’t need separate “encrypt” and “decrypt” hardware. Run it forward with the key, the bits are scrambled. Run the very same steps in reverse with the same key, and they unscramble. It’s a kitchen blender that can also un-blend a smoothie.

Why three characters?

The alphabet we draw the key from is:

ABCDEFGHJKMNPQRSTVWXYZ23456789

Thirty symbols. We left out 0 and O (too easy to confuse), 1, I, and L (same problem), and U (because we wanted to keep the alphabet short and V was already there). A three-character key from this alphabet has 30 × 30 × 30 = 27,000 possibilities — about 14.7 bits of entropy, in cryptographer-speak.

For comparison, a real cryptographic key is 128 bits, 256 bits, sometimes more. 14.7 bits is, by those standards, adorable. A well-equipped attacker could try every possible key in well under a second.

This is on purpose.

A puzzle, not a vault

The point of the key isn’t to keep your name safe from a state-level adversary. It’s to make decoding feel like solving something — a tiny puzzle baked into your prime. If we wanted bulletproof secrecy, we’d use a 256-bit key and you’d need a password manager just to read your own certificate.

Instead, the design makes a different trade:

Your prime is yours. Even without the key, the prime alone reveals nothing about your name — to a casual onlooker it’s just a number.
The key turns it into a story. Hand someone the key (or post it on the internet), and they can recover the original name in a few milliseconds.
The key is small enough to write on a card. It fits on the certificate. It fits in a text message. You can read it out loud to a friend without losing your place.

Privacy here works the way a magician’s deck works: the trick is hidden until you’re ready to reveal it. Keep the key to yourself and your prime is anonymous. Share the key and the curtain comes up.

So what’s the “lock,” really?

It’s a reversible scrambler with a short, friendly key — designed for delight, not defense. Every prime in the a3.0 algorithm carries one. Without the key, the prime is a number. With the key, the prime tells you who it belongs to.

Three characters of mathematics, doing exactly the job they were asked to do.