ORIGINAL PROGRAM / SEED SEARCH -- 17 OCTOBER 2026

The original program and seed have not been recovered.

The two already established shared binary-curve starts remain:
  131-bit pair: 0x10134db223421eb623422888a7879682
  193-bit pair: 0x23daf8a23206f9c4f299d7b21a9c369137f2c84ae1aa04
These are the starts in the previously verified forward-increment and
cofactor-clearing reconstruction. Their relationship to the published
points is established; their upstream seed-to-integer derivation is not.
They concern related SEC binary curves, not Bitcoin's prime-field curve.
Shared provenance across those families remains a hypothesis.

1. An actual 1995 source release was recovered and checked

The LiDIA 1.1 archive contains FreeLIP V1.0, identified in its README as
May 1, 1995. This predates the 1999 SEC parameter documents. Its source
contains the expected 26/30-bit configurations and 62-bit ALPHA/ALPHA50
branches. Availability in 1995 does not establish use by Certicom.

Source archive:
https://ftp.mizar.org/pub/security/replay/crypto/LIBS/math/LiDIA-1.1.tar.gz
Archive SHA-256:
cdae808e9ab21e37cfb08b622bb6e286823864f2ad0feb2316d8e54a4d3bddde

The entire original lip.c and lip.h were compiled unchanged, with supplied
configuration and ordinary standard-header includes. Eight builds checked
four arithmetic configurations at two optimization levels. All recorded
3072 word comparisons, 1536 whole-integer call comparisons, and 32 special
control calls match exact arithmetic. These totals include repeated outputs
across configurations and optimization levels; they are validation counts,
not independent search trials. The special 62-bit controls exercise two
consecutive rejected states and the subsequent accepted output.

Host limitation: these are modern GCC/x86-64 builds of the original C
branches, not emulated 1995 hardware. The 26-bit control uses the source's
generic PLAIN arithmetic with NBITS=26. SINGLE_MUL assumes 32-bit word
splitting; its attempted 64-bit build stalled, and a correct -m32 build
could not compile because 32-bit system headers are unavailable. We do not
claim a successful native SINGLE_MUL control. The higher-level generator
and packing functions are identical in those source configurations.

2. A specific direct-generation hypothesis is now excluded for every seed

Under zrandomb(2^131) or zrandomb(2^193), neither fixed shared start can be
the direct output of the documented recurrence with 26-, 30-, or 62-bit
limbs. This covers six target/configuration models and every initial state,
including arbitrary advancement before the call. Internal rejected draws
are included. There is no finite seed-window assumption.

The 26/30-bit check excludes all 20 possible source-order timing cases.
The 62-bit check excludes all 12 possible source-order timing cases.
Separate reversed-chronology hypotheses contribute another 20 and 12
excluded cases. Thus the reports contain 40 and 24 cases, respectively;
half model the source's actual ordering and half the extra hypothesis.

The proofs use fixed modular identities and exact bounds. For 62-bit limbs,
a new lattice certificate proves at most two consecutive rejected states;
both rational Gram-Schmidt and inverse-basis bounds verify this certificate.
Verification uses Python's standard library. The certificates were discovered
with lattice reduction, but verification does not trust that computation.

This does not exclude other bounds, different field conversions, hashing,
interleaved calls, altered routines, arbitrary extra processing, or broken
machine arithmetic. It is not a proof that Certicom never used FreeLIP.

3. An earlier standards draft supplies context, not the missing recipe

The recovered 52-page IEEE P1363 Part 4 Draft 6 is dated November 6, 1995,
with a cover memorandum from Alfred Menezes, Minghua Qu and Scott Vanstone.
The cover still lists inclusion of test vectors as unfinished work.
The inspected parameter-selection appendix gives general random-curve and
order-selection procedures, rather than a seed/program producing our starts.

Archived original PostScript:
https://ftp.arnes.si/security/crypto-tools/ftp.funet.fi-crypto/cryptography/papers/elliptic/p1363-draft.ps.gz

The PostScript's TeX timestamp agrees with the printed document date.
The mirror's listing date is later and is not treated as the creation date.
Text extraction has custom-font glyph loss, so this is a reading of the
cover and procedures, not an exhaustive normalized numerical nonexistence
proof. The document itself is not redistributed in this addendum.

Search coverage: 15 targeted source searches requested five results each,
with substantial duplication and unrelated hits. That is 75 requested
result slots, not 75 unique sources read. The source-release literal scan
checked 1140 file members for the two exact hexadecimal and decimal target
strings and found none. It did not check every possible split or encoding.

What remains unresolved

No recovered public source specifies the unknown seed-to-integer step.
The resemblance to a published ECC2-131 challenge value still has no exact
construction, and the earlier checks must not be presented as recovery.
More default-seed guessing would not resolve this gap. Useful new evidence
would be the original parameter-generation code, a contemporaneous seed
record, or a transformation independently motivated by an actual source
that predicts both starts. No contact with authors or organizations was made.

Reproducibility

Run origin-followup/run_checks.py with Python 3. It verifies the new fixed
proofs and rechecks the recorded original-C outputs without network access
or third-party packages. It does not compile the undistributed old library.
Source hashes, build settings, controls, and the fresh replay receipt are
included. The full historical investigation remains in sibling folders.
