FOLLOWING THE SHARED STARTING NUMBERS
17 October 2026 | Third investigation pass

RESULT

The actual historical recipe has not been recovered. The shared numbers
remain exact arithmetic facts. This pass investigated their possible inputs,
found a plausible-looking Certicom connection, and ruled out its simplest
mathematical explanations. It also recovered a more precise document trail.
There is no supported claim of an original seed or original generation code.

WHAT IS STILL UNEXPLAINED

The prior verifier reconstructs the six binary SEC generators by taking a
shared starting x for each field size, incrementing to a usable point,
choosing a compatible root, and doubling. The starts are:

  113-bit pair: 1 works; 2 also works under the positive-integer scan model.
  131-bit pair: 0x10134db223421eb623422888a7879682
  193-bit pair: 0x23daf8a23206f9c4f299d7b21a9c369137f2c84ae1aa04

The two larger starts are respectively 125-bit and 182-bit integers. They
are uniquely constrained only within that specified shared forward-scan
model. The observed results do not identify their original source, the
historical root rule, or a connection to the prime-field Bitcoin curve.

THE BEST NUMERICAL LEAD, AND WHAT HAPPENED TO IT

Certicom's published ECC2-131 challenge has a known point seed [1]:

  b55555555554d696e67687561517586aa17bf3f4

Hashing its 20 decoded bytes with SHA-1 gives:

  33255631db221deb61dc208ada4d88885a787969

Taking the low 131 bits exactly reproduces the challenge's published U.x:

  1db221deb61dc208ada4d88885a787969

This resembles the SEC131 start in several hexadecimal fragments. A ranking
against 286 published challenge fields put it first for that target. Such a
post-selected similarity is an exploratory clue, not evidence sufficient to
claim a common origin. No similarly conspicuous 193-bit candidate emerged.

The exact values differ. Direct byte/word layouts, truncations, and the
tested polynomial reductions do not explain them. More decisively, a short
trace invariant rules out two complete representation-only explanations:

* The published challenge U has absolute field trace 1. Both SEC131
  precursors, x and x+2, have trace 0. A field isomorphism preserves trace,
  so changing the polynomial representation cannot map that U to either.

* The exact U bitstring has 61 set bits. Every vector of a normal basis has
  trace 1, so a normal-basis coordinate string has trace equal to its bit
  parity. This U therefore represents trace 1 in ANY normal basis. It
  cannot represent either trace-zero SEC precursor, even after a permutation
  of its bits. Bit reversal and rotation are included in that statement.

Two independently written squaring implementations confirmed the trace
values. The proof concerns the exact published number. It does not exclude
edited digits, another hash input, or subsequent arithmetic. Calling this
number a deliberately edited challenge point would still be speculation.

TESTING THE PUBLISHED SEEDS AS POSSIBLE INPUTS

The combined corpus contains 102 distinct published seeds, including all
23 seed values in SEC2 v1. Ten seeds exported from OpenSSL were checked
against the same named curves in independently extracted SEC2 text [2].

The ordinary-representation check tested these public seeds and their fixed
offsets -2 through 255, with four additional encodings at offset zero.
It checked SHA-1, SHA-0, MD5 and RIPEMD-160, specified digest byte/word
layouts, full hashes, field-width truncations, polynomial remainders, and
the documented SHA-1 expansion for 193 bits. It also checked the explicitly
specified 152-bit interior hypotheses. There were no matches.

The receipt records 100,808 primary hash evaluations plus 24,794 successor
SHA-1 calls. Its 2,771,404 coordinate comparisons and 5,443,632 interior
comparisons are not independent hypotheses. Counts are reproducibility
details; their size does not support a claim about unknown seeds.

A separate check interpreted the documented SHA-1 expansions in the
X9.62-selected Gaussian normal bases: types 2, 2 and 4 at degrees 113,
131 and 193. It covered every conjugate mapping to the SEC polynomial
basis and both stated bit directions. All 78,948 expansion candidates
missed the specified starting/precursor values. Repeated values from
overlapping seed neighborhoods are included in that candidate count.

The converter has external controls: five published NIST normal/polynomial
basis pairs at degree 163 all match under one common Frobenius exponent,
42, and the published B-163 seed reproduces its normal-basis coefficient
exactly [3]. This is stronger than checking internal round trips. It is not
an exhaustive audit of every converter degree or every possible normal basis.

These are bounded public-input tests. They do not recover or exclude an
unknown seed, arbitrary text, a different normal-basis type, manual edits,
or a different construction. The earlier 48 Certicom expansion controls
and six-curve point reconstruction remain available in the same bundle.

HISTORICAL SOFTWARE AND DOCUMENT TRAIL

The inspected historical MIRACL bigdig(m,2) routine enforces an m-bit
result, so it cannot directly emit these 125/182-bit starts when requested
to generate 131/193 bits. That observation does not exclude other MIRACL
routines or shorter requested lengths. The inspected LiDIA wrappers did
not provide a source-backed fixed seed to test. Their software lineages
are documented in shared-starts/software-findings.txt.

Recovered SECG minutes from 16 September 1999 explicitly record renaming
GEC 1 to SEC 2 and adding the larger NIST curves [4]. Indexed excerpts
identify a September 1999 GEC 1 v0.5 draft and its sect193r1/r2 section.
A contemporary IETF draft cites SEC2 v0.6, October 1999 [5].

The full earlier numerical pages were not recovered: the indexed v0.5 PDF
currently returns 404. The meeting minutes do not document a generator
change or a generation recipe. It would be wrong to claim that the earlier
generators are identical to SEC2 v1 without obtaining their numeric pages.

The original public secg-talk mailing-list interface also survives in an
archive. The checked capture inventory contains 36 distinct URLs, comprising
31 HTML pages and five images. It contains entry/topic/login pages, but no
message bodies. This does not prove that another mirror or private copy
does not exist. No account was created and no message was sent.

THE NEXT EVIDENCE THAT WOULD MATTER

The most useful next acquisition is an original generation record, rather
than a larger arbitrary seed range. Specific targets are:

1. Complete GEC1 v0.4/v0.5 or SEC2 v0.6 numeric pages and generation notes.
   First check whether their published G values equal SEC2 v1.
2. The 1999 secg-talk discussions about GEC1, especially August-October.
3. A source-linked explanation of the two exact intermediate integers.

Precise questions for anyone with those records are saved in
shared-starts/RECORDS-QUESTIONS.txt. They are questions, not a claim that
the draft's contact people generated these constants.

REPRODUCIBILITY

The shared-starts directory contains the input corpus, exact trace proof,
conversion controls, bounded hypothesis checks, independent audit receipts,
and source notes. Its run_checks.py replays the portable checks without
network access or third-party packages. VALIDATION.json records the actual
fresh-copy replay. The root SHA256SUMS.txt and ZIP cover this addition and
both earlier checkpoints.

SOURCES

[1] Certicom challenge curve and point table:
https://www.certicom.com/content/certicom/en/curves-list.html
Generation document:
https://www.certicom.com/content/dam/certicom/images/pdfs/cert_ecc_challenge.pdf
[2] SEC2 v1, 20 September 2000:
https://www.secg.org/SEC2-Ver-1.0.pdf
[3] NIST FIPS186-2, Appendix6, printed pages36-37:
https://nvlpubs.nist.gov/nistpubs/Legacy/FIPS/fipspub186-2.pdf
[4] Primary SECG meeting minutes, 16 September1999:
https://web.archive.org/web/20001102094425id_/http://www.secg.org:80/collateral/Minutes19990916Mtg.pdf
[5] Contemporary SEC2 v0.6 citation:
https://datatracker.ietf.org/doc/html/draft-blake-wilson-xmldsig-ecdsa-00
[6] Indexed GEC1 v0.5 PDF, currently unavailable in full:
https://citeseerx.ist.psu.edu/document?doi=fe42ff586c6b5bd314cee6577221a2675319ed5e&repid=rep1&type=pdf

