SECRA / CRYPTOGRAPHY & DIGITAL FORENSICS

Inside Liber Primus

The strongest findings from our Cicada 3301 investigation

Research through 15 October 2026

By Max SawickiPublished 15 October 2026

A familiar insect drawn in scattered dots. A guitar recording framed by static. Three number squares whose centers lead to the letters LP. These are some of the most striking results from our investigation into Cicada 3301’s Liber Primus—and they do not all carry the same weight.

The second release of Liber Primus contains 58 pages, numbered 0–57. The established public solutions cover pages 56 and 57; pages 0–55 remain unsolved. Our work has not changed that status. What it has produced is a set of reproducible observations about the artwork, audio and ciphertext, alongside a sharper understanding of which tempting interpretations still need proof. [S1]

01 The mayfly carries a software fingerprint

The dotted insect on page 57 looks as if it is disintegrating. The important clue turned out to be the placement of its dots. Their positions strongly match the deterministic pattern used by an older version of GIMP’s Dissolve operation, available before Liber Primus 2 appeared in 2014. [S2] [E1]

Dissolve turns partial opacity into scattered visible pixels. Although the result looks random, the historical implementation uses a repeatable pseudorandom field. That means its dot pattern can leave a recognizable fingerprint. A search across 268,435,456 offset, orientation and polarity configurations singled out one alignment; separate checks on reserved image regions and independent implementations supported the same result.

Four panels compare the original dotted mayfly, an earlier reconstruction, the refined reconstruction, and the remaining pixel disagreements. — The refined model reaches 96.0% whole-image F1 and 93.9% F1 on reserved cells. F1 measures agreement on black dots while penalizing missing and extra dots. It is not the percentage of the puzzle solved.

Using related insect artwork in Liber Primus as an opacity reference, then fitting geometric and tonal adjustments, reproduced most of the pattern. The selected reconstruction still differs at 166 cells. The software fingerprint is stronger evidence than any claim that we have recovered the exact original image or every historical editing step.

One especially satisfying detail concerns four isolated dots near the lower-left of the image. All four land on the historical generator’s lowest threshold, where even a tiny nonzero opacity can produce a black pixel. That gives them a concrete rendering explanation without needing to assign them letters or numbers.

The four isolated lower-left mayfly dots line up with zero-threshold positions in the historical GIMP field. — All four marked dots coincide with threshold zero. A low threshold alone is not enough: the source must also have nonzero opacity. The match supports a production explanation, not a hidden four-character message.

There is another numerical trap here: the historical GIMP code uses the seed 314159265. Its resemblance to π is real, but it is a software default. Finding it in this reconstruction does not establish that Cicada selected a π-based cipher key.

02 The MP3 repeats its own noise

Interconnectedness is an existing artifact from the 2014 puzzle, not a newly discovered song. We reconstructed its MP3 bytes from an archived signed message, verified the signature, and matched the resulting file against a second archive. Its embedded title is Interconnectedness and its artist tag is 3301. [S3] [E2]

Listen to Interconnectedness

The original archived MP3, approximately 4 minutes 37 seconds. This is the existing puzzle artifact, included without re-encoding.

The recording’s opening and ending contain the same forward noise waveform, separated by 11,559,607 samples—about 262.122608 seconds at 44.1 kHz. This is more specific than two passages merely sounding alike: after alignment and level adjustment, fine waveform details coincide. A second decoder reproduced the relationship. [E3]

An eight-millisecond excerpt of the aligned opening and ending noise shows the two normalized waveforms almost overlapping. — A short excerpt of the shared waveform, filtered to 3.5–9 kHz and normalized separately for display. The fixed delay was measured from the recording; the excerpt illustrates the match rather than establishing it by itself.

Opening excerpt

Ending excerpt at the matching position

Two nine-second excerpts at their original decoded amplitudes. They contain different levels and musical overlap, so they will not sound identical. No normalization has been applied to these listening files.

We then fitted one fade model in designated intervals and tested subtraction elsewhere. It removed 99.60%, 99.75% and 93.53% of the 3.5–9 kHz energy in three validation intervals. That establishes substantial reuse. It does not make the remaining sound a hidden message.

Against 232 ordinary-production simulations involving noise, guitar, fades and MP3 compression, the residual did not stand out in the combined signal tests. Checks with deliberately added tones, pulses and FSK signals showed that the analysis could detect many such additions, with weaker performance on the faintest FSK examples. No additional message or key emerged. The separate, historically archived OpenPuff payload associated with the track is a different channel. [E4]

03 3301 and 1033 are deliberate puzzle numbers

Three archived magic squares associated with the MP3 have line sums of 3301, 1033 and 1033. Every row, column and both main diagonals in each square produce its prescribed total. The first is 5 × 5, the second 7 × 7, and the third 5 × 5. [S4] [E5]

Three archived magic squares with centers 809, 331 and 91 highlighted, and line sums 3301, 1033 and 1033. — The archived square values, in their recorded order. The highlighted centers are 809, 331 and 91. These are numerical diagrams redrawn from the archive, not screenshots of a newly extracted payload.

Both 3301 and 1033 are prime, and reversing the digits of either gives the other. More importantly, an archived puzzle form explicitly requests squares with these orders and totals. Their presence is therefore a design requirement, not something we noticed only after trying enough sums. The request prose is signed; the order and total labels sit outside that signed block. [S5]

The archive preserves all three squares, and two also appear in LP1. Those repeated appearances connect the materials, but they are not independent discoveries. Our audit checked the archived values and carrier provenance; it did not perform a fresh OpenPuff extraction of the MP3.

04 The centers lead to LP under one exact rule

A community observation supplied to this project takes the centers 809, 331 and 91, applies the prime-counting function π(x), and subtracts consecutive results. Here π(x) means the number of primes less than or equal to x—not the circle constant π and not Euler’s totient function φ. [E6]

π(809) = 140 π(331) = 67 π(91) = 24

140 − 67 = 73 → L

67 − 24 = 43 → P

Gematria Primus assigns 73 to L and 43 to P. Together, the two outputs read LP—the initials of Liber Primus.

Prime counts of 809, 331 and 91 are 140, 67 and 24. Consecutive subtraction gives 73 and 43, which Gematria Primus maps to L and P. — An exact arithmetic relationship, reproduced from a community observation. The unresolved part is whether Cicada intended this particular selection and sequence of operations.

We tested its specificity. Keeping the square order and operation fixed, only one of the 30,625 ways to choose one cell from each square produces exactly LP: the three centers. That is an interesting property of these particular squares. It is not a one-in-30,625 probability that the result happened by chance. The desired letters and formula were already known, and rotational symmetry duplicates noncentral values.

The deliberate magic sums and the LP extraction deserve different labels. The sums are documented puzzle requirements. LP is a plausible signature or signpost, but the inspected sources do not uniquely instruct us to choose centers, count primes and subtract. Extending the rule outward and testing square-derived cipher keys did not produce a validated continuation. We verified the relationship; we did not discover it first or turn it into a working key.

05 The ciphertext avoids immediately repeated runes

One of the strongest unresolved constraints lies in the text itself. In our transcription of LP2 pages 0–55, counting adjacent runes within each page and omitting delimiters, there are 86 immediate repeats. Every one of those reported pairs was checked against the page images, alongside a sample of nonrepeating pairs. Page 50’s numerical table contributes no rune pairs. [E7]

The shortage appears inside words and across ordinary word boundaries. Inside words, we counted 63 repeats where shuffling runes within their existing words predicts about 246.6. Across ordinary word boundaries, we counted 22 where that comparison predicts about 85.4. A further repeat occurs across a sentence boundary.

Observed repeat counts are 63 inside words and 22 across ordinary word boundaries, compared with within-word-shuffle expectations of 246.6 and 85.4. — Both contexts have roughly 74% fewer repeats than this word-preserving shuffle comparison. Shuffling provides a statistical baseline, not a proposed encryption method; the two rows contain different numbers of adjacent pairs.

This matters because an explanation confined to ordinary doubled letters inside words cannot account for the boundary effect. A successful cipher model must explain both the scarcity and the repeats that remain. Tests of several reversible mechanisms, resets and changing states have not recovered a key. The observation survives; the mechanism is still unknown.

06 Words we reproduced but could not certify

A community proposal by 2retooz270703 arranges the 729 runes from pages 0–2 into a 27 × 27 grid. It uses mirrored three-rune nodes, totients, Möbius values and modular subtraction to obtain a proposed English passage. Our audit reproduced the supplied route’s arithmetic. [S6] [E8]

Community-proposed text — not a verified solution

AS I GO THE WEATHER TURNS COLD, I MAY CRY NOW. THE IDEA OF THE END IS DEATH, SEE YOU SOON THEN

Reproduced from the documented community route; punctuation is editorial, not independently recovered.

The reproduction covered 61 rune subtractions using 54 distinct ciphertext cells, about 7.4% of the grid. The proposed signature rule also matched all 16 documented transitions along the selected route. Those are reproducible calculations, but they depend on route choices already supplied with the proposed words.

Removing those choices exposed alternative paths and changed forecasts. We did not find an independent rule that selects each next node and reading path before checking the output. A candidate stopping condition at THEN was likewise dependent on the chosen route. The passage may read naturally, but that does not establish it as Cicada’s plaintext or prove that THEN is its intended ending.

07 What these findings give us

The mayfly’s rendering pattern and the MP3’s repeated waveform reveal how parts of the puzzle were produced. The magic squares establish deliberate numerical structure. The LP relationship remains a specific, testable possibility. The shortage of repeated runes imposes a constraint that any proposed decryption must meet.

The next decisive step would be a rule that predicts something unused: a new key, a complete passage, or another artifact property before the answer is examined. Until then, keeping the measured facts separate from attractive interpretations is what makes this work useful to the next solver.