Fifth software pass: completion review, NTL source lead, independent Maple audit
=============================================================================

Completed results from the preceding pass
----------------------------------------
1. PARI:36 fixed target/adjacent-value and packing cases excluded under the
   specified all-state model.96 original-C values,43 positive C windows and
   two contemporary published controls passed. Precise assumptions and source
   dates are in ../secp-fourth-software/FINDINGS.txt.
2. Archived MIRACL:80,000 binary-coordinate candidates from the documented
   default and stated configurations/offsets, no match.128 original-C values
   passed. This is a bounded default-state result, not an all-state exclusion.
3. Maple193:the prior FINDINGS.txt section calling Maple untested became stale
   after the root agent's subsequent experiment. That experiment is complete:
   all80 possible lifts of the shared193 coordinate fail the very first
   recurrence transition. An independent audit passed the10 scalar controls,
   all23 preceding NewGenerator calls, the large-integer example and8
   synthetic cases. Receipt:../secp-fourth-software/maple193-independent-audit.json.
   This does not establish pre1999 large-bound implementation continuity.

New source lead: original NTL code, handed off for controlled replay
-----------------------------------------------------------------
The NTL1.5 archive on FUNET is listed7 July1997:
https://ftp.funet.fi/pub/sci/math/misc/programs/ntl/
https://ftp.funet.fi/pub/sci/math/misc/programs/ntl/ntl-1.5.tar.gz
Its ZZ.h wraps the FreeLIP zrstart/zrandomb/zrandoml routines. The included
lip.c has the already studied modulus2^107-1, multiplier3^121 and default
7157891. This is corroboration, not a new generator; no duplicate run was made.

The author's changelog says that3.5a introduced a new PRNG:
https://libntl.org/doc/tour-changes.html
An original archived homepage explicitly lists NTL3.7a on2 September1999:
https://web.archive.org/web/19990902050452id_/http://www.shoup.net:80/ntl/
This proves that version's availability by that date, but does not expose its
complete RNG source.

Recovered original NTL3.8b archive:
https://web.archive.org/web/20000819143620id_/http://www.shoup.net:80/ntl/ntl-3.8b.tar.gz
The included src/ZZ.c has a tar modification date15 February2000. It contains
a genuinely different deterministic default:
  - first use calls SetSeed(0);
  - zero seed serializes to an empty byte prefix;
  - a fixed64-byte table is repeatedly passed through MD5 compression,
    with the chaining state retained, producing256 key bytes;
  - those bytes initialize ARC4;
  - successive64-byte ARC4 blocks go through MD5 compression with chaining;
  - the resulting four32-bit words form the output stream.
This is raw MD5 compression, not hashlib.md5(message) with normal padding.
No initial ARC4-byte discard occurs in this source. The changelog places a
later256-byte discard in NTL5.1; that later behavior must not be imported here.

For IEEE53-bit double arithmetic, MakeDesc.c chooses30-bit limbs on a32-bit
long platform and50-bit limbs on a64-bit long platform. The documented
NTL_SINGLE_MUL configuration uses26-bit limbs. RandomWord on a64-bit platform
joins two32-bit output words high-first. RandomBits fills limbs low-first and
masks the highest limb. RandomBnd(2^m) calls RandomBits(m) directly. For a
non-power bound, RandomBnd draws bitlength(bound)+8 bits, reduces modulo the
bound and applies its source rejection condition.

The exact3.7a source was not recovered. Therefore the3.8b recipe can be tested
as an explicitly dated2000 source model; identity with the preSeptember1999
implementation remains unverified. No attribution to SEC authors follows.
This source and its precise packing were handed to the curve_followups agent
for original-source controls and bounded default-state replay. That replay is
now complete and independently audited below.

Completed independent NTL replay audit
-------------------------------------
The producer's final 50 distinct API contexts, each at raw-32 starting offsets
0 through 4095, give 204,800 checked calls and no match. The contexts cover
the six stated binary starts/precursors, all four prime first-valid-x
intervals, the separate common-160-bit prime hypothesis, and both ZZ and
GF2X packing. The common-160-bit union includes the secp160k1 field-width case,
so that identical API call is not counted twice. Power-of-two RandomBnd calls
are exactly RandomBits and likewise are not counted separately.

The independent auditor imports no producer implementation. It uses its own
MD5 round-loop implementation, checked against hashlib for five messages,
bit-string assembly of limbs, and a quotient-derived acceptance threshold.
Every first-call value, rejection count, maximum consumed-word count, target
set and match result agrees across all 204,800 calls.

Original-source positive controls independently checked:
  - 1,024 raw 32-bit outputs across four configurations;
  - 672 API outputs, covering RandomBits, GF2X random, and both RandomBnd paths;
  - four forced-rejection calls and the following twelve raw words.
For bound 2^32+1, the first rejecting raw32 offsets are 761 (32/26), 65
(32/30), 759 (64/26), and 6 (64/50). The auditor verified that no preceding
offset rejects, each specified call rejects once, and the accepted output
and subsequent stream positions agree with the compiled original bodies.

The rejection derivation is exact. Write l=bitlength(N)+8. Source adjusts
raw t to t+N-(t mod N) and accepts iff that number is below 2^l. This equals
accepting t < floor((2^l-1)/N)*N. GF2E.h delegates random generation to
random(GF2X), whose whole-word packing differs from ZZ limb packing.

The C++ control harness retains original RNG/API bodies apart from C word-type
substitutions. A positive-only 512-bit arithmetic/storage shim supplies the
needed contracts; this is not a full historical NTL build. The source-derived
configurations assume IEEE 53-bit double precision, or NTL_SINGLE_MUL. Other
precisions and arbitrary seed/call histories are outside the experiment.

Portable audit files:
  independent_ntl_reference.py
  audit_fixed_ntl.py
  fixed-ntl-independent-audit.json
  ntl-forced-rejection-controls.json
The auditor reads the sibling secp-fifth-ntl controls, results and provenance;
packaging can adjust that path alone. No source download or compilation is
required. This is a finite default-stream result, not an all-state exclusion,
an identified historical recipe, or a conclusion about curve security.

Other source inspection, no experimental claim
----------------------------------------------
Original GNU GMP2.0.2 source was recovered from the official project archive:
https://gmplib.org/download/gmp/archive/gmp-2.0.2.tar.xz
https://gmplib.org/download/gmp/archive/
It is listed6 June1996. mpz_random fills little-endian limbs via urandom.h,
which selects platform-specific mrand48 or combinations of random() calls.
The generic32-bit form is random() XOR (random()<<1); the generic64-bit form
combines shifts0,31,62. This differs from directly concatenating rand outputs.
It requires a separately sourced platform RNG and evaluation-order model.
This lead was handed to the archive agent, who now owns a separate documented
32-bit default-stream experiment. No generic-GMP exclusion is claimed here.

That separate experiment is now independently audited: PASS. The auditor
uses queue-based state updates and explicit bit-flag/byte-string packing,
without importing producer code. It reproduces all 896 whole-number draw
positions and 164,656 candidate values counted separately by reduction,
with no match. All 256 raw C controls and 256 GMP limb C controls agree.
Original literal tables, initial pointers, step bodies, GMP little-endian
limb placement and the harness extraction were inspected directly.

Scope: generic 32-bit GMP 2.0.2, each of two literal GNU libc defaults, the
first 64 consecutive calls from reset at each field width, all per-limb
choices of the two operand evaluation orders. Signed arithmetic follows the
stated 32-bit GNU machine model, controlled at O0/O2. Low-bit masking and
modulo-p reductions are explicit caller hypotheses. Other platforms, seeds,
states, 64-bit builds and prior calls are outside the result.
Files: audit_gmp_defaults.py and gmp-defaults-independent-audit.json.

One separate source observation was passed to the mrand48 investigator:
glibc 2.0.6 jrand48_r.c literally ORs (xsubi[2] & 0x7fff) with xsubi[1],
without a 16-bit shift, then changes sign according to xsubi[2]'s high bit.
On 16-bit-short platforms this is a signed value with at most 16-bit
magnitude, unlike conventional top-32-bit mrand48 output. mrand48.c delegates
to that routine. This source version must not serve as a positive control for
conventional extraction. Exact original sources and hashes are retained;
the archive agent owns the compiled control and historical follow-up.

Final independent mrand48 certificate audit
-------------------------------------------
PASS: all 68 supplied integer identity rows and all 2,352 fixed-target layout
certificates were independently verified. The auditor imports no producer
implementation. It re-extracts chunks by shifts and masks, decodes unsigned
words to signed values before inverting the 1999 sign-magnitude mapping,
evaluates identities by Horner's rule, derives affine state offsets in closed
form, and checks the nearest required residue against each closed interval.

Coverage agrees exactly: 384 raw-top32 full-word layouts, 384 literal GNU
libc 2.1.1 full-word layouts, 384 literal GNU libc 2.0.6 range contradictions,
and 1,200 raw-top32 byte windows. Of the byte cases, 1,152 were already covered
and 48 add shift 16. All 256 original-C state/output mappings and 816 positive
synthetic windows pass. All nine prime curve/candidate instances retain the
same 152-bit core, and their first-valid-x intervals were independently checked.

Separately checked the recorded original C output files against the portable
control JSON: all 256 state rows and 512 result bit patterns agree, and O0/O2
output recordings are byte-identical for each historical release. This export
audit does not rebuild or rerun C. It records hashes of the actual recordings
and harnesses in mrand-control-export-audit.json.

The proof covers every possible initial 48-bit state only within the named
consecutive direct-output layouts of these exact public constants. It covers
no modular-coordinate reduction, hashes, skipped calls, other binary preimages,
historical byte-only transformations, or sign-extended 64-bit limb packing.
Raw-top32 remains conditional and is not either tested old GNU implementation.
This is an exclusion of stated models, not an identification of the recipe.

Files: audit_fixed_mrand.py, fixed-mrand-independent-audit.json, and
mrand-control-export-audit.json. The portable auditor reads the sibling
secp-fifth-mrand folder and needs no source download or compilation.

New independent Maple assembly audit
-----------------------------------
Input:../secp-fifth-structure/check_fixed_maple_assembly.py, PROOF.md and
fixed-maple-assembly-results.json. PASS.

The producer considers24 fixed public target/bound combinations under a
minimal-chunk extension of the documented base10^12 assembly. Its modular
identity converts the finite lift set to a residue window, counted exactly
with floor sums. The independent auditor imports none of the producer code:
  - recursive lattice-point reciprocity with last index n-1 for floor sums;
  - alternative count identity F(b)-F(b-D);
  - Horner evaluation of K;
  - decimal text slicing for exact surviving digit strings.
All24 full certificates agree.22 have zero necessary-condition survivors.
The other two each have one survivor; both fail the actual recurrence.

Independent controls:22,440 signed floor cases;88,176 residue windows;
609 toy targets comprising2,882 lifts;10 published scalar values and the
published large-range example;88 genuine large-bound positive outputs.
The four prime first-valid-x intervals were separately verified using
quadratic-residuosity checks.

A subtlety was checked:because the conservative lift bound permits radix
digits up to B-1 and B=M+11, the modular window can admit a leading digit
at least M. This is only a false positive; it cannot omit a valid stream.
The producer checks all surviving digits and transitions, removing it.

The conclusion is limited to the stated assembly model. Official documentation
prints its10^32 example, not generated procedures for every SEC-sized bound.
Minimal chunk counts and pre1999 continuity are not independently recovered
historical facts. The source proof and report state this limitation correctly.

Audit files:
  audit_fixed_maple_assembly.py
  fixed-maple-assembly-independent-audit.json
The replay reads the sibling secp-fifth-structure directory; packaging may
adjust that path alone. No external source files are required for this audit.
