of its arbitrary constants, including all entries of the S-box, from the binary expansion of . The ARIA key schedule uses the binary expansion of 1/. The key schedule of the RC5 cipher uses binary digits from both and the golden ratio. Multiple ciphers including TEA and Red Pike use 2654435769 or 0x9e3779b9 which is , where ϕ is the golden ratio. The BLAKE hash function, a finalist in the SHA-3 competition, uses a table of 16 constant words which are the leading 512 or 1024 bits of the fractional part of . The key schedule of the KASUMI cipher uses 0x123456789ABCDEFFEDCBA9876543210 to derive the modified key. The Salsa20 family of ciphers use the ASCII string "expand 32-byte k" as constants in its block initialization process. Bcrypt uses the string "OrpheanBeholderScryDoubt" as an initialization string Counterexamples The Streebog hash function S-box was claimed to be generated randomly, but was reverse-engineered and proven to be generated algorithmically with some "puzzling" weaknesses. The Data Encryption Standard (DES) has constants that were given out by NSA. They turned out to be far from random, but instead made the algorithm resilient against differential cryptanalysis, a method not publicly known at the time. Dual_EC_DRBG, a NIST-recommended cryptographic pseudo-random bit generator, came under criticism in 2007 because constants recommended for use in the algorithm could have been selected in a way that would permit their author to predict future outputs given a sample of past generated values. In September 2013 The New York Times wrote that "internal memos leaked by a former NSA contractor, Edward Snowden, suggest that the NSA generated one of the random number generators used in a 2006 NIST standard—called the Dual EC DRBG standard—which contains a back door for the NSA." P curves are standardized by NIST for elliptic curve cryptography. The coefficients in these curves are generated by hashing unexplained random seeds, such as: P-224: bd713447 99d5c7fc dc45b59f a3b9ab8f 6a948bc5. P-256: c49d3608 86e70493 6a6678e1 139d26b7 819f7e90. P-384: a335926a a319a27a 1d00896a 6773a482 7acdac73. Although not directly related, after the backdoor in Dual_EC_DRBG had been exposed, suspicious aspects of the NIST's P curve constants led to concerns that the NSA had chosen values that gave them an advantage in finding private keys. Since then, many protocols and programs started to use Curve25519 as an alternative to NIST P-256 curve. Limitations Bernstein and coauthors demonstrate that use of nothing-up-my-sleeve numbers as the starting point