Second archival pass, 17 October 2026

Outcome: original 2019 transcript and 1999 GLV slides recovered; no SEC generator construction recipe or original generation code found. Additional sources_reviewed: 116 requested search results, plus direct fetches. No contacts.

1. Original 2019 rump talk
https://www.youtube.com/watch?v=NGLR2N4EK58
Artifact: crypto2019-transcript.txt, exported through the browser's public transcript function. English captions are automatically generated, with some incorrect names; this is not an edited author transcript.
At 3:03-3:51, Heninger hypothesizes SHA-1, edits to the top and bottom four bits, and extra prefixes. She questions the number of edits and final doubling.
At 4:38-4:46, she states that the authors talked to Dan Brown, who did not know this property.
At 4:50-5:14, she describes 256 potential hash values under the four-bit-edit hypothesis, historical attempts with John the Ripper, and an ASCII-seed hypothesis. Those approaches are therefore 2019 prior art. None of that software was executed here.
The exact talk PDF was not located. Earlier WAC 2019 slides show the small half-point but are not the rump talk.

2. Original Gallant ECC99 slides
Index: https://cacr.uwaterloo.ca/conferences/1999/ecc99/slides.html
Direct source: https://cacr.uwaterloo.ca/conferences/1999/ecc99/gallant.ps
Program: https://cacr.uwaterloo.ca/conferences/1999/ecc99/ecc99-announce.html
Artifacts: gallant-ecc99.ps, converted PDF, and extracted text.
PostScript metadata records 30 pages and TeX output 1999.11.03:0848. The title identifies Gallant, Lambert, Vanstone, and Certicom Corporation. The official program dates the talk to 3 November 1999.
Content explains GLV scalar multiplication and prime CM curve families. No concrete SEC constants, generator coordinates, seed, or PRNG construction appeared. Slide 27 references IEEE P1363's CM appendix and the WAP standard as earlier examples. This document does not identify the generator authors.

3. Actual pre-2000 point-selection guidance
https://safecurves.cr.yp.to/grouper.ieee.org/groups/1363/private/x9-62-09-20-98.pdf
Artifacts: x962-draft-1998.pdf and extracted text. The document identifies itself as a 20 September 1998 working draft, not the final ratified standard.
A.3.1, printed page 30 / physical page 39: generate a random R, then G=hR, and check the order.
D.3.1, printed page 71 / physical page 80: choose a fresh random x, solve for a point, and draw another random x if solving fails. This applies in both prime and binary cases.
The draft does not mandate a hashed point seed or shared hash-and-increment point recipe. Hash-based verifiability applies to curve coefficients. Consequently, the specified binary procedure does not explain the secp common core; undocumented implementation reuse remains possible.
D.1.4, printed page 66 / physical page 75: the p=3 mod 4 root uses direct exponentiation. Against the parent's verified public half-points, this returns H.y for secp192k1 and -H.y for secp160k1/secp256k1. Explicit even-y normalization would be an extra step; this does not identify the historical implementation.

4. Additional public seed corpus
public-standard-seeds.json contains 27 records: 21 unique X9.62 draft seeds (14 binary, 7 prime) plus six SEC2 name-bearing seeds. All 40-digit hexadecimal strings retain leading zeros. Records include implementation name, seed_hex, source URL, PDF page, and context.
X9.62 pages are exact first occurrences. SEC page fields explicitly give the section's starting page: font encoding garbled pypdf's extraction, so clean seed strings came from Exa's extraction of the same PDF. extract_public_seeds.py records that distinction.
The parent owns hash experiments; this pass performed none.

5. Contemporary contrast
https://www.wapforum.org/tech/documents/WAP-199-WTLS-20000218-a.pdf
WTLS, 18 February 2000, Table 8: assigned curves 8 and 9 have a=0, b=3, 112/160-bit prime fields, G=(1,2), and cofactor 1. Thus very small base points were sometimes published directly at the time. This does not establish the same authors or explain SEC doubling. Fetched text is in wtls-and-note.txt.

6. Limits and dead ends
Inspected patents WO1999049386A1 and US20020044649A1 and the GLV paper concern efficient arithmetic; no generator provenance was found. No historical connection between Certicom generation code and MIRACL, FreeLIP, LiDIA, or NTL was established.
No pre-2000 SEC2 draft was located. A Wayback CDX query for secg.org PDF captures in 1999 returned an empty list; this single query is not an exhaustive archive search.
The 2013 reposted Brown email was not independently authenticated. The original 2019 talk independently supports only that Brown was asked and did not know the property, not the email's claim about two former employees.
Do not attribute the generators to Qu, Gallant, Lambert, Vanstone, or a pair of them based solely on employment or coauthorship.

Best remaining archival targets: pre-2000 SECG working drafts, original generation notes, and an authenticated software lineage. These could justify more discriminating controls than generic candidate word lists.
