RECOVERING THE FORGOTTEN RECIPE BEHIND BITCOIN'S STARTING POINT
Second investigation checkpoint | 17 October 2026

The original secp256k1 generator recipe remains unknown. This round produces
two useful advances: exact exclusions of specified historical random-number
constructions, and additional paired starting-point structure in SEC binary
curves. These are reproducible mathematical results. Their novelty is not
established, and compatible reconstructions do not establish historical use.

THE STRONGEST EXCLUSION: AN ENTIRE FREELIP COORDINATE ROUTINE

The FreeLIP source's zrandomb(p) routine collects one more random limb than
the bound p occupies, high limb first, then reduces the resulting integer
modulo p [1]. This is worth testing because Anthropic reconstructed the
separate NIST P-192 generator using FreeLIP [2]. That positive control does
not establish that SEC's designers used the same software.

For the specific source routine, at both 26-bit and 30-bit limb widths, we
can now exclude EVERY initial internal state and EVERY internal rejection
pattern that could produce either of these public secp256k1 x coordinates:

  H.x     = 3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63
  H.x - 1 = 3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c62

Here 2H=G. These are the only two starts permitted by the particular
first-valid-x increment construction checked in the earlier report. The
claim does not cover arbitrary later edits or different retry rules.

Why modular reduction does not hide the evidence:

  p = 2^256 - d, where d = 2^32 + 977.
  If a raw integer B reduces to x, B = q*p+x = q*2^256 + (x-q*d).

The known maximum size of B bounds q. For 26-bit limbs, q <= 2^30;
for 30-bit limbs, q <= 2^44. The maximum subtraction cannot borrow past
bit 64 or bit 78, respectively, for either target. Therefore six complete
26-bit limbs, or five complete 30-bit limbs, are fixed in B regardless of q:

  26-bit, in call order: 0, 0, 951, 36935055, 59351277, 38818774
  30-bit, in call order: 0, 0, 60899, 240533385, 674981125

Integer identities prove these sequences incompatible with FreeLIP's
recurrence. Internal rejection is included: exact finite counts show that
two rejected states cannot occur within 16 updates for either width. This
bounds all possible timing patterns among the five or six observed limbs.
All 22 target/timing certificates exclude a match; there are 11 distinct
observation/timing cases because the two target values share these limbs.

The checks use exact integer arithmetic, not a search over seeds. Short
identities were found with lattice reduction, but verification requires
only the published integer coefficients and Python's standard library.
The bundle includes an independently derived coordinate bound, independent
certificate audits, and authentic/synthetic positive controls.

Limits: this covers the named source routine, bound p, and limb widths
26 and 30. It does not cover 62-bit limbs, another bound, interleaved calls
between limbs, hashing, altered packing, or arbitrary transformations.
There is still no documentary link between FreeLIP and SEC generation.

OTHER EXACT RANDOM-OUTPUT EXCLUSIONS

The shared 152-bit interior of the four prime k1 half-generators is:
  8ce563f89a0ed9414f5aa28ad0d96d6795f9c6

Its prior discovery is documented in the earlier report. This round tests
whether it could be unmodified output from specified generators:

* lrand48: all 574 listed layouts excluded for every starting state.
  These cover packed 31-bit words, zero-padded 32-bit words, and one byte
  per output from each of 24 possible bit offsets, with the listed alignments
  and word/byte orders. There are 458 modular-interval contradictions and
  116 violations of mandatory zero padding. Independent audit passes.

* FreeLIP direct low-limb output: all 112 listed 26/30-bit layouts excluded
  for every state, including internal rejection. The full timing expansion
  has 506 cases. This is separate from the zrandomb(p) result above.

* Two 15-bit rand recurrences: all 188 listed layouts excluded, covering
  60 packed layouts and 128 padded layouts. The models are the POSIX
  documentation's portable example and the specified Microsoft CRT
  recurrence [3-4]. POSIX does not mandate that example algorithm, and
  the fetched Microsoft source mirror does not prove a 1990s lineage.

These are finite, precisely defined model exclusions, not blanket claims
that the constants could not come from any pseudorandom generator.
Except for FreeLIP's explicit internal rejection, skipped calls are not
covered by the direct-output tests. Hashing remains outside their scope.

A SECOND SET OF STARTING-POINT FINGERPRINTS

SEC2 v1 supplies the published parameters [5]. Exact arithmetic on binary
fields reveals these smaller-x cofactor preimages P with 2P=G:

  sect113r1  x=3
  sect113r2  x=2
  sect131r1  x=10134db223421eb623422888a7879682
  sect131r2  x=10134db223421eb623422888a7879684
  sect193r1  x=23daf8a23206f9c4f299d7b21a9c369137f2c84ae1aa04
  sect193r2  x=23daf8a23206f9c4f299d7b21a9c369137f2c84ae1aa04

All x values are hexadecimal. In each pair, start from one shared x and
increment until a usable point exists, choose the smaller integer y, then
double. This reproduces all six published generators exactly. Starting
from 1 works for the 113-bit pair. For the 131-bit pair, start at ...682:
r1 accepts it, while r2 rejects two x values before accepting ...684.
The 193-bit pair accepts the same starting x immediately on both curves.

Under this particular forward-scan model, neighboring valid points force
the common starts for the 131- and 193-bit pairs to the values shown.
Their origin remains unexplained. A canonical half-trace root rule also
matches all six, so these observations do not identify the root-selection
rule. Normalizing the sign of the final generator is another possibility.

Five of these six precursors lie outside the odd-order subgroup. Looking
only at inverse(2 modulo n)*G would miss them. The verifier enumerates
both cofactor preimages and checks their doubling and subgroup membership.
It also checks the published G, its order relation, both root conventions,
neighboring coordinates, and an independent doubling-x identity.

The sect113r1 x=3 observation is already in a 2023 public discussion [6].
Our limited searches did not locate the 131/193 pair relationships, but
this is not evidence sufficient to claim priority. The plausible research
lead is shared generation machinery across more SEC curve families.

ARCHIVAL AND HASH CHECKS

We recovered original 1999 ECC slides and inspected a September 1998
X9.62 working draft [7-8]. The latter specifies drawing random points and
clearing the cofactor; its random-x procedure retries with a fresh random
x. It does not prescribe the shared increment construction tested here.
The original 2019 rump-talk transcript already discusses SHA-1, edited
end nibbles, and extra prefixes [9]. Those ideas are prior art.

A bounded hash check covered 87 distinct public standard/challenge seeds,
five encodings, the fixed 0..255 raw-seed offsets, and four literal name
forms. On this machine, 84,456 SHA-0/SHA-1/MD5/RIPEMD-160 evaluations gave
no match to the specified targets. SHA-0's original test vector and eleven
SHA-1 cross-checks passed. This result does NOT exclude hashing: unknown
messages and other transformations were not searched.

WHAT WOULD JUSTIFY A RECOVERY CLAIM

A candidate recipe must explain the full published coordinates, the
cross-curve relationships, the prefixes and final increments, and the
doubling/root convention. Its historical plausibility needs independent
support: original generation code or notes, an archived seed, or a known
contemporary control generated by the same procedure. The remaining best
archival targets are pre-2000 SECG drafts and authenticated generation
records. No messages to possible participants were sent.

REPRODUCIBILITY

The followup/ directory contains numerical fixtures, standard-library
verifiers, fixed exclusion certificates, independent audits, and source
references. Run python followup/run_checks.py from the extracted bundle.
It needs no network connection and does not infer private keys or attack
any deployed system. Check followup/VALIDATION.json for this run's actual
validation record. SHA256SUMS.txt covers the complete bundle.

SELECTED PRIMARY AND FIRSTHAND SOURCES

[1] FreeLIP source mirror, zrandom and zrandomb:
https://github.com/lrobot/freelip/blob/master/lip.c
[2] Anthropic reconstruction and published control recipes:
https://www.anthropic.com/research/ecdsa-curve-origins
[3] POSIX rand documentation and portable example:
https://pubs.opengroup.org/onlinepubs/009696799/functions/rand.html
[4] Microsoft rand documentation and public control output:
https://learn.microsoft.com/en-us/cpp/c-runtime-library/reference/rand?view=msvc-170
[5] SEC2 version 1.0, 20 September 2000:
https://www.secg.org/SEC2-Ver-1.0.pdf
[6] Firsthand 2023 generator discussion:
https://bitcointalk.org/index.php?topic=5469657.0
[7] ECC99 original Gallant slides:
https://cacr.uwaterloo.ca/conferences/1999/ecc99/gallant.ps
[8] ANSI X9.62 working draft, 20 September 1998, archived copy:
https://safecurves.cr.yp.to/grouper.ieee.org/groups/1363/private/x9-62-09-20-98.pdf
[9] Original 2019 rump talk; automatic captions need name corrections:
https://www.youtube.com/watch?v=NGLR2N4EK58

