Portable check of six SEC binary-curve generators
================================================

This package verifies six public curves in three pairs: sect113r1/r2,
sect131r1/r2, and sect193r1/r2. It records arithmetic observations and a
compatible deterministic reconstruction. It does not recover or identify the
historical generation procedure, explain the two larger starting integers,
or establish a new result.

Run with Python 3:
    python verify_binary.py

Keep verify_binary.py and numeric-fixture.json together. The verifier uses only
Python's standard library, makes no network requests, and writes result.json
beside itself. No OpenSSL, SymPy, Sage, or downloaded dependencies are needed.

Verified facts
--------------
* Every published G is on its curve and nG is the point at infinity.
* For cofactor two, T=(0,sqrt(b)) is on the curve and 2T=O.
  Both H=((n+1)/2)G and H+T are on the curve and double to published G.
  H satisfies nH=O; H+T satisfies n(H+T)=T. Both preimages are recorded.
* The smaller-x preimage is selected. Only sect113r1's selected preimage is
  in the odd-order subgroup. The other five satisfy nP=T.
* For both preimages on every curve, a separate formula gives the published
  generator's x-coordinate: x(2P)=x(P)^2+b/x(P)^2. Here + denotes field XOR,
  not ordinary integer addition. This formula shares the finite-field
  arithmetic implementation with the point operations.
* A forward scan over positive polynomial-basis integer x values, increasing
  by one and accepting the first point with nonzero double, reproduces the
  smaller-x preimages from the starts below.
* Choosing the numerically smaller y works for all six. Choosing the
  unadjusted half-trace solution also works for all six. These observations
  cannot distinguish the two rules as historical explanations.

Pair       Tested common start                            First accepted x
113-bit    1                                              r1:3, r2:2
131-bit    0x10134db223421eb623422888a7879682                r1:start, r2:start+2
193-bit    0x23daf8a23206f9c4f299d7b21a9c369137f2c84ae1aa04 both:start

The result includes the predecessor point and its nonzero double, plus every
intervening rejected x. This proves the compatible interval of starting
integers within this scan model:
* 113-bit pair: either positive common start 1 or 2 works.
* 131-bit pair: the displayed common start is the only one.
* 193-bit pair: the displayed common start is the only one.
This uniqueness is conditional on the stated scan model, not historical
uniqueness. The source of either larger start remains unexplained.

Source consistency and scope
----------------------------
numeric-fixture.json includes exact a, b, n, h, and uncompressed G values
exported from an independently extracted primary SEC2 v1 PDF text, alongside
the existing numeric audit's input values. The verifier compares them exactly.
Reduction polynomial exponents were manually transcribed from the standard
and are checked against the numeric field polynomial and degree. The previous
30 successful primary comparisons are retained as provenance evidence.

The verifier does not fetch or parse the original PDF at runtime. The fixture
is the portable source evidence, not a cryptographic attestation by SECG. It
also includes the earlier audit's two preimages, which are independently
recomputed and compared. The output records the fixture's SHA-256 digest.

The published n and field polynomials are trusted standard parameters. This
program does not independently prove n prime, polynomial irreducibility, or
the full curve order. Under those standard parameters, the order-two kernel
is {O,T}, so the two displayed points are precisely the two doubling preimages.

All input data are public standard parameters. These checks make no claim
about secret keys, exploitable weaknesses, or the Bitcoin generator recipe.

Sources
-------
SEC 2 v1.0 (September 20, 2000), sections 3.2, 3.3, 3.5:
https://www.secg.org/SEC2-Ver-1.0.pdf

SEC 1 v1.0, binary-field curve and point arithmetic:
https://www.secg.org/SEC1-Ver-1.0.pdf

1998 ANSI X9.62 working draft, half-trace and point selection (D.1.6/D.3.1):
https://safecurves.cr.yp.to/grouper.ieee.org/groups/1363/private/x9-62-09-20-98.pdf

Prior public discussion already notes the sect113r1 small preimage x=3;
the present package makes no novelty claim for it or the other observations:
https://bitcointalk.org/index.php?topic=5469657.0

Files for distribution
----------------------
verify_binary.py       Portable arithmetic verifier.
numeric-fixture.json   Public input constants and exported source evidence.
result.json            Complete generated check results and limitations.
README.txt             This explanation.

prepare_fixture.py is an optional local export record. It relies on research
workspace files and is not needed or intended for the portable distribution.
