Independent audit: PASS

Audited on 2026-10-17 against the immutable hashes recorded in
freelip-rejection-independent-audit.json. The replay script is
audit_freelip_rejections.py. No initial state was searched or recovered.

The reviewed recurrence is X_next = A*X mod M, where M=2^107-1 and
A=3^121 mod M. The inspected lip.c source computes this recurrence in
zrandom, rejects X >= M-(M mod 2^w), and returns X mod 2^w. zrandomb
collects ceil(bitlength(bound)/w)+1 accepted words in high-first order,
then returns the assembled integer modulo bound. Source SHA-256:
46dc20471651d4fe78db17857224e34b2eb6bcfa8be87ce97e59e418907d206d.

Rejection count and timing

Let r=2^w-1. A rejected residue has the form M-j for 1<=j<=r.
After lag t the residue is M-(A^t*j mod M). Since gcd(A,M)=1 and
j<M, the inner residue is nonzero. Therefore both states are rejected
exactly when 1<=A^t*j mod M<=r. For a=A^t mod M, the indicator for each
j is 1+floor(a*j/M)-floor((a*j+M-r-1)/M). Summing j=1..r gives the
reviewed floor-sum formula, including both endpoints.

I independently evaluated the sums by counting horizontal threshold
crossings, using a different recursion from the reviewed implementation.
Both agree with brute-force evaluation on 264,316 small floor-sum
instances and 35,930 small rejected-pair instances. The actual counts
are zero for all 32 combinations: w in {26,30}, lag in {1,...,16}.

Lag-one exclusion prohibits consecutive rejected states. Thus every
accepted-to-next-accepted interval is one or two updates. Six consecutive
accepted observations span at most ten updates. Any two rejected states
strictly inside that interval would be separated by at most eight
updates, contradicting the exact lag counts. Consequently zero skips
or one skip at one listed gap exhausts all patterns for these windows.
Rejections before the first or after the last observation are immaterial;
arbitrary advancement before the first is absorbed into arbitrary X0.

Certificate algebra

For observation i, X_i=r_i+2^k_i*z_i, with
0<=z_i<=floor((M-1-r_i)/2^k_i). At update exponent e_i,
z_i = A^e_i*2^(-k_i)*X0 - r_i*2^(-k_i) modulo M.
Each integer coefficient row b satisfies
sum b_i*A^e_i*2^(-k_i)=0 modulo M, eliminating X0 exactly.
The resulting dot product must lie in an explicitly bounded closed
integer interval and a specified residue class. I independently checked
the interval via the integer quotient range, rather than reusing the
reviewed first-congruent-integer calculation. All intervals are empty.

Verified counts: 252 identities across 50 bases; all 506 direct accepted
output timing cases covering 112 layouts; all 22 modulo-p timing cases
(11 unique cases repeated for the two neighboring targets). No inconclusive
cases remain. Direct layout coverage includes every phase, both word
directions, the low-bit partial first words at 26-bit phases 23..25, and
the additional fifth complete 30-bit word at phases 0..2.

Modulus reduction

Let p=2^256-d, d=2^32+977, and target be H or H-1, where
H=0x3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63.
If raw B mod p equals target, then
B=q*p+target=q*2^256+(target-q*d).
For N raw words, q<=floor((2^(N*w)-1)/p). This quoted bound is
conservative: the maximum feasible quotient for these targets is one
smaller, because the bound omits target. Keeping the larger bound is safe.
If target mod 2^k >= qmax*d, subtraction cannot borrow into bit k.
Therefore all raw bits from k through 255 equal the target bits, for
every feasible q. No uniformity assumption is used.

w=26: N=11, qmax=2^30, qmax*d=4611687067473149952, k=64.
Complete fixed limb indices in chronological high-first order: 8,7,6,5,4,3.
Their values: 0,0,951,36935055,59351277,38818774.

w=30: N=10, qmax=2^44, qmax*d=75557880913480088813568, k=78.
Complete fixed limb indices in chronological high-first order: 7,6,5,4,3.
Their values: 0,0,60899,240533385,674981125.

These values are identical for H and H-1. They are consecutive accepted
outputs under the inspected source packing, so the rejection-spacing
proof and the exact certificate identities apply directly.

Positive controls and limits

All 560 genuine accepted-output windows passed the reviewed extraction
and interval checks, including 112 windows containing a deliberately
placed internal rejection. The published P-192 FreeLIP recipe reproduced
its exact generator x coordinate. These controls supplement the exact
proof; they are not the reason that all initial states are covered.

The exclusion covers the specified source recurrence, 26/30-bit limbs,
and all internal rejections with no intervening external calls. It does
not cover 62-bit limbs, other bounds, altered packing, hashes, or arbitrary
transformations. H-1 is only the stated one-step neighboring target.
This does not identify the real historical recipe or imply a weakness
in the security of the published curve.
