PAPER CHECKPOINT -- ARCHIVE FOLLOW-UP AND SHARED STREAM
17 October 2026

The original recipe remains unknown. The missing manual was not recovered
from the software-collection leads. Five precise conversions of a common
reset stream are excluded for arbitrary first two 160-bit blocks. See
archive-and-stream/FINDINGS.txt for assumptions and archive coverage.
All nine paper-preparation Python checks passed in a separate fresh copy.
The enclosing paper package includes PAPER-VALIDATION.json.

--- PREVIOUS CHECKPOINT ---

CERTICOM SOURCE SEARCH -- NEW ADDENDUM
17 October 2026

The original program and seed remain unknown. See certicom-source/FINDINGS.txt.
New primary evidence identifies the 1998 SDK RNG APIs and a documented XOR
seed-mixing mechanism in a Certicom EC-card product. Its connection to the
SEC generation program is unproven. A later-preserved SSL Plus sample
contains library calls, not the underlying generator implementation.

A reconstructed FIPS 186 SHA-1 compression experiment passes published
controls but gives no exact starts from the 102 public seeds in the
specified scope. This does not exclude unknown seeds or preprocessing.
The missing 1997 manual is now identified as SBPR-9706-0001.

Offline replay: certicom-source/run_checks.py.
All prior checkpoints and checks are retained below.

--- PREVIOUS CHECKPOINT ---

ORIGINAL PROGRAM / SEED SEARCH -- NEW ADDENDUM
17 October 2026

The original seed and program remain unknown. The new origin-followup/FINDINGS.txt
records the recovered 1995 FreeLIP source, complete-source controls, and all-state
exclusions of direct zrandomb(2^131) and zrandomb(2^193) construction at
26-, 30-, and 62-bit limb widths. Hashing and other processing remain outside
those exclusions. A recovered November 1995 P1363 draft supplies context but
no numerical seed-to-start recipe.

Run origin-followup/run_checks.py for the new offline checks; the fresh-copy
receipt is origin-followup/VALIDATION.json. All earlier work is retained below.

--- PREVIOUS CHECKPOINT ---

RECOVERING THE RECIPE BEHIND THE SEC GENERATORS
Current checkpoint: 17 October 2026

STATUS

The original seed and generation program have not been recovered. This checkpoint
adds earlier numerical evidence, stronger exclusions for specific historical
software models, and independently audited arithmetic. It does not establish a
new cryptographic weakness or identify who generated the constants.

THE HISTORICAL GAP HAS NARROWED

The complete 50-page SEC 2 Version 0.6 working draft, printed October 1999,
has been recovered. All ten relevant curves match the later standard: the four
prime-field k1 curves and the six binary curves at 113, 131 and 193 bits.
Field parameters, coefficients, point encodings, orders, cofactors and the six
binary curve seeds were checked. Point arithmetic reproduces the same halves.

Cached numerical pages of GEC 1 Version 0.5, printed September 1999, give the
same ten curves. This evidence is weaker than the complete October PDF because
the September PDF itself remains unavailable. It is nevertheless a concrete
comparison of numerical pages, rather than a citation or table-of-contents claim.

Two separate PDF extraction and parsing paths agree on all 82 numerical fields
checked in the October document. Its metadata corroborates the printed month,
but neither metadata nor the later archive capture proves an exact publication day.

An earlier control is now verified: WTLS Version 11-Feb-1999, page 80, assigned
curve 4, matches sect113r1 in every checked parameter. Its smaller doubling
preimage has x=3. The April 1998 WTLS table lists only curves 1-3; that dates the
change to this document series, not the creation of the curve. It does not date
the 131/193 shared starts or Bitcoin's curve to February 1999.

The recovered September 1999 GEC 2 test-vector document offers additional source
context but no generator-selection recipe. Its contact names are not evidence
of authorship of particular constants.

WHAT THE ARITHMETIC NOW EXCLUDES

* PARI 2.0.16, released June 1999: the three inspected recurrence/packing models
  cannot directly produce the specified coordinates for any initial state.
  The original check has 36 target/model cases. A separate prefix proof covers
  all nine candidate/curve starting values in the established first-valid-x
  model for the four prime curves, under all three PARI layouts. These counts
  overlap and must not be added as independent trials. Original C controls and
  a separately written audit pass. Different postprocessing remains possible.

* lrand48: all 1,148 declared direct-output layouts fail for the two shared
  binary starts for every 48-bit state. These proofs use only the actual
  significant bits, without manufactured leading zero bytes. They do not
  cover hashing, modular reduction or calls interleaved with other work.

* Maple-style decimal assembly: all 24 specified public target/bound cases
  fail for every state. Twenty-two have no possible integer lift satisfying
  a necessary congruence; the remaining two each have one lift, which fails
  the exact recurrence. The independent audit uses different floor-sum and
  residue-count formulas and reproduces every result. This generalizes the
  assembly shown in current official compatibility documentation using the
  smallest required output count. The exact pre-1999 large-bound procedures
  have not been recovered, so this is a model exclusion, not an exclusion of
  every historical Maple implementation. Starting from zero and rejecting an
  order-two point is outside the positive-start 113-bit cases.

* The apparent ECC2-131 resemblance still yields no construction. The specified
  arithmetic, word-packing and parsing models all fail their untouched upper
  bits. A separate algebraic proof shows that infinity-preserving changes
  between the normalized binary curve equations cannot change x. Together
  with the earlier trace mismatch, this rules out that specific explanation
  of the exact published challenge coordinate. Edits and other maps remain
  different hypotheses.

The archived MIRACL default-state check also has no match in its explicitly
bounded output prefix. It is a finite check, unlike the all-state proofs above.

The recovered NTL 3.8b default stream gives no match in 50 distinct API
configurations, each checked at raw 32-bit output offsets 0 through 4095.
The exact first calls were also recorded separately. Binary-field word packing,
integer limb packing, and bounded-integer rejection differ and were modeled
separately. Original-source controls match 1,024 raw words, 672 API calls and
four deliberately exercised rejected draws, including their following outputs.
The controls use extracted function bodies with a documented exact-integer
harness; they are not a build of the entire old library. The recovered source
dates to February 2000. Its identity with the pre-September-1999 implementation
is unverified, and a fixed default prefix cannot exclude other seeds or offsets.
An independent implementation reproduces all 204,800 tested call positions,
including the first values, target sets and output-consumption counts.

GMP 2.0.2's generic 32-bit branch is a separate model: it XORs two random()
outputs per limb. Using the literal default tables from original GNU libc
1.09.1 and 2.0.6, the first 64 whole-number draws in each of seven size groups
give no match to the 15 fixed public target values. Both per-limb evaluation
orders are allowed. The independently audited total is 896 draw positions;
the larger 164,656 count includes alternate packing and caller reductions,
not independent RNG draws. Original C controls were run at actual 32-bit
width and matched at two optimization levels. This does not cover explicit
seeding, arbitrary earlier calls, other platforms or other GMP routines.

The mrand48 branch required special care. Literal 1997 GNU libc code emits
only a small signed magnitude; the May 1999 source restores the missing shift
but uses sign-magnitude conversion. Neither is interchangeable with conventional
raw top-32-bit extraction. All three were therefore checked separately.
The 2,352 declared packing cases fail for every state, including 384 full-word
layouts for each of the three output models and 1,200 conditional raw-top32
byte-window cases. Of those byte cases, 1,152 overlap prior proofs; the count
must not be presented as 2,352 wholly new hypotheses. The result covers direct
packing and truncation, not arbitrary field-prime reduction or transformations.
The raw-top32 model is explicitly conditional and is not attributed to those
GNU releases or to an uninspected HP-UX implementation. Original i386 source
controls verify the two distinct historical GNU mappings.

WHAT IS STILL NEEDED

We can reconstruct the shared scan-and-double pattern, date it to the early
drafts, and reject several precise recipes. We still cannot derive the two
larger starting integers from an independently specified historical input.
The decisive positive evidence would be generation code, a dated generation
record, or a compact construction that predicts an untouched second constant.
The currently tested hypotheses provide none of those.

REPRODUCIBILITY AND READING ORDER

This report supersedes the earlier checkpoint's statement that the October
numeric draft pages were unavailable. Earlier reports remain in the bundle as
historical checkpoints. Read this file first, then continuation/ for this work,
shared-starts/ for the preceding trace and hash-input checks, and followup/ for
the earlier reconstruction and software exclusions.

The complete Standards for Efficient Cryptography (SEC) Version 0.6 PDF is in
continuation/secp-fourth-archive/sec2-v06.pdf. Its cover grants copying with SEC
identification. The WTLS portable subset contains numeric facts and provenance,
not a full PDF; its verifier explicitly does not revalidate the absent PDF hash.
The original PARI source archive is included intact with its notices.

Run continuation/run_checks.py with Python 3 to replay the packaged checks.
The scripts use the standard library and no network. VALIDATION.json records
which checks actually ran and whether their supplied results reproduced.
The bundle's root SHA256SUMS.txt and ZIP cover the saved files.

PRIMARY SOURCES

SEC 2 v0.6 complete archived PDF:
https://web.archive.org/web/20240414044829if_/https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=2840bfaf7cf8f97deeaddcd4274e82863ec522ee
GEC 1 v0.5 indexed primary document:
https://citeseerx.ist.psu.edu/document?doi=fe42ff586c6b5bd314cee6577221a2675319ed5e&repid=rep1&type=pdf
WTLS February 1999, Table 8, page 80:
https://www.c3.hu/docs/wml1.1/SPEC-WTLS-19990211.pdf
WTLS April 1998:
https://www.c3.hu/docs/wml1.0/WTLS-30-Apr-98.pdf
PARI 2.0.16 original source:
https://pari.math.u-bordeaux.fr/pub/pari/OLD/2.0/pari-2.0.16.beta.tgz
Maplesoft recurrence and assembly:
https://www.maplesoft.com/support/help/maple/view.aspx?path=RandomTools/LinearCongruence
https://www.maplesoft.com/support/help/maple/view.aspx?path=RandomTools/LinearCongruence/NewGenerator
https://www.maplesoft.com/support/help/maple/view.aspx?path=RandomTools/LinearCongruence/SetState
