CERTICOM SOURCE SEARCH AND FIPS TRANSFORMATION CHECK
17 October 2026

The original SEC parameter-generation program and seed remain unknown.
This pass recovered period documentation and later-preserved sample code,
then checked a previously untested, source-motivated transformation.
None of the new computations reproduced either shared binary starting value.

WHAT WAS RECOVERED

1. Certicom Security Builder SDK 2.0, captured 7 December 1998.
   Its API list contains sb_rngSeedFIPS186, sb_rngFIPS186Private,
   sb_rngFIPS186Session and separate ordinary SHA-1 functions. It also
   advertises an EC Blum-Blum-Shub generator. The page supplies function
   names, not implementation bodies, defaults or a curve-generation script.
   https://web.archive.org/web/19981207011453id_/http://www.certicom.com:80/cSecure/sdk.htm

2. Certicom/Consensus SSL Plus sample code preserved in Qpopper 4.0.5.
   popper/sslplus_utils.c carries SSL Plus 3.0.2 / July 6, 1999 release
   headers. The archive member itself was modified in 2003; this is a later
   copy of attributed sample code, not an authenticated untouched 1999 SDK.
   Its RNG wrapper calls EZInitRandom, EZSeedRandom and EZGenerateRandom.
   Their underlying implementations are absent from the inspected files.
   No curve-parameter-generation routine was found in this wrapper.
   https://archive.debian.org/debian/pool/main/q/qpopper/qpopper_4.0.5.orig.tar.gz
   Archive SHA256: 03560b6c36695364b84313d213be2dab4462ddcf11be3b6314966131bd9ba183
   Wrapper SHA256: 57d570b0f3d52bf29d6bf8cbab025e77126362f5e47063f0e6daa05f70d94b5e

3. Certicom's VeriSmart EC-card security policy, retained by NIST.
   Printed page 144 describes XOR mixing of a session seed with a persistent
   initial seed before FIPS 186 initialization, and subsequent state mixing.
   This establishes a real Certicom preprocessing mechanism. Its use by the
   SEC parameter-generation program is unproven, and no initial seed for
   that program was recovered. It cannot explain the target values yet.

   Printed page 162 identifies two precise missing documents:
   - Security Builder Programmer's Reference Manual, Release 1.1 (1997),
     document SBPR-9706-0001.
   - ECC Card Project API Definition, revision 1.23, document 037,
     13 November 1997.

   This PDF's creation metadata says 8 July 1999. NIST certificate 55 records
   initial validation 21 June 1999 and a 2002 update; these facts do not establish
   the precise publication date of every statement in the retained PDF.
   https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp55.pdf
   https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/55

THE NEW TRANSFORMATION TEST

FIPS 186-1 Appendix 3 and the 1998 X9.62 draft A.4 define G as one SHA-1
compression of seed || zeroes. Ordinary SHA-1 adds padding and a length;
the earlier ordinary-hash search therefore did not test this construction.
The test reconstructs the specification. It does not execute Certicom code.

Fixed scope:
- The existing 102 distinct public 160-bit seeds, used directly as XKEY.
- Seed width 160; zero optional input; no unknown persistent initial seed.
- Standard SHA-1 initial state and the specified cyclic session variant.
- First G output for 131 bits; first two outputs with X9.62 feedback for 193.
- Big-endian integer, low/high field bits, polynomial reduction, and
  reductions by each pair member's order or order-minus-one plus one.

There are 3264 candidate equalities and no exact starting-value matches.
Coordinate conversions and the two-block cyclic variant are explicitly
hypothetical adaptations. They are not documented SDK behavior.

Controls passed: 11 ordinary SHA-1 comparisons with Python's independent
hash implementation; both FIPS 186-1 Appendix 5 examples; the entire 160-byte
derived-output example in RFC 4186 A.5. RFC 4186 is a later control for the
primitive and feedback rule, not evidence about software used in 1999.

For the earlier ECC2-131 seed b55555555554d696e67687561517586aa17bf3f4:
  ordinary SHA-1: 33255631db221deb61dc208ada4d88885a787969
  first standard G: 1738709d37400061f93424fc2e721c859b1f2b97
  first cyclic G:   29dd06e3adc4bd371585554902810602277a3a4f
Neither gives the 131-bit pair's shared starting number under these checks.

Limits: unknown seeds, preprocessing/mixing, other seed widths, later RNG
calls, DES-based G and EC-BBS remain outside this test. A failure with these
public seeds does not exclude FIPS 186 or prove there was a recoverable seed.

ARCHIVAL COVERAGE AND REJECTED LEADS

The saved Wayback inventories contain 910 distinct www.certicom.com URLs
through 1999 and 475 download.certicom.com URLs through 2002. Those are index
entries, not 910/475 inspected pages, and are not a complete historical web.
The public download portal captured 3 March 2000 describes registration for
most downloads. No account was created and no gated material was accessed.
The ftp.certicom.com inventory returned no entries; ftp.consensus.com had
one root-page entry. Empty indexes do not prove files never existed.

Two 1997 download ZIPs contain Word documents, not C source. A 1999
EncryptMark ZIP contains one EPS graphic. A challenge ZIP contains an RTF
document with 1997 metadata, not the parameter-generation program. Manifests
and fetch hashes are retained. Qpopper 3.0b18 and 3.0b36 lacked the later
sslplus_utils files; Qpopper 4.0.5 supplied the wrapper described above.

Mike Rosing's November 1995 source package has a random-point routine, but
the inspected configuration uses a 148-bit normal-basis field and no link
to Certicom's generation program was established. CRYPTOGRAPH'IC ECCTK is
a different vendor's later toolkit. Neither is evidence of the SEC recipe.

CURRENT RECOVERY TARGET

The strongest named archival targets are SBPR-9706-0001 and the source
behind the SDK 2.0 RNG APIs. The card policy makes initialization and seed
mixing concrete questions to resolve. No public search in this pass located
the manual itself, that implementation, or the original parameter script.

The arithmetic targets remain:
  binary 131 pair: 10134db223421eb623422888a7879682
  binary 193 pair: 23daf8a23206f9c4f299d7b21a9c369137f2c84ae1aa04
They concern binary-field SEC curves. Any shared implementation with
Bitcoin's prime-field curve remains a hypothesis.

Run: python -E -s -S -B run_checks.py
The checks need only Python's standard library and make no network calls.
SOURCE-RECEIPTS.json records primary URLs and fetch hashes. Third-party
SDK/source archives and full manuals are not redistributed in this addendum.
