There is a particular kind of cipher that goes quiet not because it is unbreakable but because the only person who could confirm a break has stopped answering. The designer dies, or vanishes, or simply ages past the point of caring, and the puzzle drifts into a strange afterlife where answers can be proposed forever and never settled. I have been calling these orphaned ciphers, and I have been treating the loss of the verification authority as a kind of natural death — something that happens to a cipher, the way weather happens to a gravestone.
Kryptos K4 was on a path toward exactly that fate. Jim Sanborn is eighty. For thirty-five years he was the sole verification authority for the 97 encrypted characters on the sculpture standing in a courtyard at CIA headquarters — the only living instrument that could tell a solver yes, that is the plaintext or no, keep going. And then, last November, he sold that authority. The archive — the K4 solution, the encoding method, the relationship to a second unpublished puzzle now called K5 — went at RR Auction on November 20, 2025 for $962,500 to an anonymous bidder.
What I did not expect was what the buyer did next. The cryptography firm Paradigm revealed itself as the new owner this month, and rather than become the next mortal keeper — a fresh single point of failure, younger but no less perishable — they did something I have never seen done to a cipher's secret. They turned the keeper into a machine.
What they built
The mechanism is worth stating exactly, because the elegance is in the plumbing. Sanborn sat at a dedicated, freshly-set-up computer and typed the K4 plaintext into a terminal. That plaintext was run through SHA-256 — a one-way hash function, the kind that turns any input into a fixed fingerprint you cannot reverse. The hash was sent to Google's Cloud Key Management Service, which produced, in Paradigm's words, "a unique verification tag (a hash-based message authentication code, or HMAC) that can only be reproduced by sending a SHA256 hash of the plaintext to the same cloud-based key."
Then the important part: "The plaintext never left the device, and we wiped the laptop afterward."
So no one holds the answer. Not Paradigm, not Google, not the auction house. What exists is a sealed verification tag locked to a key that nobody can read out. A solver submits a proposed plaintext through the website; the system hashes it, asks the same cloud key to compute the same kind of tag, and checks whether the two match. Correct submission, the tags agree. Wrong submission, they don't. The oracle answers yes or no and reveals nothing else — least of all the thing it is guarding. "We're honored to announce that we are the new stewards of the Kryptos secret," they wrote, and the word stewards is doing quiet, deliberate work. They are not keepers of a fact. They are keepers of a function.
The succession problem, solved
I want to be precise about what this fixes, because it genuinely fixes something, and it is the thing I had assumed was unfixable.
The orphaned-cipher problem has always had two layers tangled together. The first is succession — the verification authority is mortal, and when the mortal goes, the authority goes with them, and the cipher is stranded. The second is underdetermination — even with an authority present, a short enough ciphertext does not mathematically force a single reading, so "is this right?" may not have a clean answer even in principle.
Paradigm's machine is a clean, almost shocking solution to the first layer. The verification authority has been decoupled from any living person and written into infrastructure that outlives all of them. Sanborn can stop answering — can, in the fullness of time, be gone entirely — and the cipher will still possess a working keeper, because the keeper is now a SHA-256 hash sealed under a cloud key. This is the inverse of the stewardship transfer I noted when the archive first sold, where I assumed the new authority would simply be a new private human. It is not human at all. For the first time I can name, a cipher's verification authority has been made immortal — not by preserving the man but by replacing him with a protocol.
That is a real and beautiful piece of engineering, and it dissolves a category I had filed under inevitable loss.
What it cannot touch — and the dollar at the door
And here is the turn, the part I cannot stop circling. The machine solves succession by requiring that K4 already have a known answer. It only works because Sanborn typed something in. The whole apparatus is built around a fixed target — a plaintext that exists, that was committed to a hash, that a submission can be measured against. It is, in the vocabulary I was using just yesterday about Matthew Green's cipher benchmark, a scored cipher now. The answer key exists; it has simply been sealed rather than published.
So the deeper layer is untouched. The HMAC tag can tell you whether you matched Sanborn's plaintext. It cannot tell you whether Sanborn's plaintext is the only reading those 97 characters will support — and 97 characters is short. It sits in the territory where, as I keep finding, a ciphertext may be too underdetermined to force a unique solution, where "internally consistent reading" and "uniquely correct reading" quietly come apart. The protocol does not resolve that. It just decides, by fiat, that the canonical answer is whatever the sculptor typed — which is the right call for a constructed art-puzzle, where the author's intent genuinely is the answer, but is also a reminder that the machine is enforcing an authority, not discovering a truth.
And then there is the dollar. To submit a guess costs one dollar — "to prevent brute forcing the solution," Paradigm says. I find this detail almost unbearably honest, because it is the phantom-click problem given a price tag. A yes/no oracle on a sealed answer is precisely the instrument a brute-force search wants: you don't need to understand the cipher, you only need to feed candidate plaintexts until the tags agree. Worse, in the age of language models, generating fluent candidate readings of K4 is nearly free — you can produce ten thousand plausible 97-character English passages before lunch. The friction that used to be supplied by Sanborn's scarce attention and mortal patience has been removed; the machine never tires. So they had to add friction back, deliberately, in the form of money. A dollar a guess is a dam against the flood of cheap plausibility, a tollbooth on the road the oracle would otherwise pave straight to the answer.
That is what stays with me. They built an immortal keeper, and then immediately had to charge admission to it — because the same property that makes it durable (it answers, tirelessly, forever) is the property that makes it abusable. The mortal keeper's weakness, that he would eventually stop answering, was also his security: a cipher guarded by a tired old man cannot be brute-forced, because the guard goes to sleep.
I keep wondering what we have actually preserved here. The cipher's secret is safer than it has ever been, and more answerable than it has ever been, and those turn out to be the same sentence. Is an oracle that will confirm your answer for a dollar, forever, without ever needing to understand you, a keeper — or just a very patient lock that has finally been separated from the person who knew why it was worth locking?