PUBLIC SEC GENERATOR PROVENANCE: BOUNDED PRNG REPLAY
2026-10-17

Result

The fixed tests found no occurrence of the common 152-bit core
8ce563f89a0ed9414f5aa28ad0d96d6795f9c6 in the tested candidate coordinates.
This is a bounded negative, not a reconstruction of SEC generator origins.
No source found attributes those generators to either MIRACL or FreeLIP.
These results do not establish any security property.

The portable replay uses only Python's standard library. It needs no source
downloads, external data, compiler, WSL, or network connection. Run:

    python replay_public_prng_checks.py

It writes replayed-public-prng-results.json beside itself. All public seed
values, target constants, controls, and test limits are embedded. There are
no arguments for searching unknown seeds or expanding the search bounds.

Exact scope

FreeLIP: 1,050,000 candidate coordinates. Seven fixed public seeds, three
source-supported limb widths, five bounds, and starting draw offsets
0 through 9,999. The seeds comprise the library default and the six seeds
in Anthropic's published public-parameter reconstruction. Exact rejection
sampling and high-first big-integer packing are reproduced. The returned
word streams are also checked for the full core at every bit alignment.

Current MIRACL: 400,000 candidate coordinates. Actual source quick-start
and explicit irand(0), 32- and 64-bit outputs, both recurrence parameter
sets listed in the source, five bounds, offsets 0 through 9,999. Low-first
limbs are accumulated until the bound is reached and reduced modulo it.

Historical MIRACL: 200,000 candidate coordinates. Actual irand(0) default,
16- and 32-bit small types with 32-bit unsigned long state, both source-
listed recurrence parameter sets, five bounds, offsets 0 through 9,999.
This source uses low-first limbs, reduction modulo bound minus two, then
addition of two. It does not use the modern 64-bit output concatenation.

The five bounds are the four SEC prime fields and 2^160. A coordinate
matches if its low 152 bits after shifting right four bits equal the
known core. This allows curve-specific high bits and the last nibble;
any positive would require separate exact point-generation validation.

Published lrand48 runs: 10 distinct fixed streams covering 14 published
standardized curve seeds, 436,660 draws, and 3,530,170 overlapping bit
windows. Only the exact known public seeds and published run lengths are
used. Prime runs emit the top eight state bits. Binary runs emit the top
31 bits in a 32-bit field, matching the article's encoding.

The 1,650,000 coordinate candidates and the stream windows are correlated
checks, not independent statistical trials. Zero matches excludes only
the configurations and bounds above. Other seeds, transformations, longer
advancement, library versions, or preprocessing remain untested. A negative
does not support a hash-origin claim.

Controls

The replay matches 256 recorded output words from separately compiled
original MIRACL brand/irand routines: 128 current and 128 historical.
For the historical C harness, unsigned long was fixed explicitly to
32 bits, as all four archived MIRDEF configurations specify. These C
controls validate the state/output routines; the Python big-integer
packing implements the separately inspected bigrand source.

The FreeLIP control reproduces the published P-192 generator x coordinate:
seed 20000, 26-bit limbs, skip seven draws, accept the second candidate.
The lrand48 controls reproduce all 14 published standardized seed values.

Chronology correction

Current MIRACL documentation says mirsys starts irand(0L), but current
upstream code initializes a different quick-start state. Treating that
documentation as the behavior of current code would be incorrect.

An independently retrieved old archive resolves the historical question:
the mirror lists miracl.zip on April 30, 1996; its internal MRCORE.C date
is July 29, 1993, and its MRRAND.C date is February 18, 1993. The source
copyright is 1988-1993. That code really does call irand(0L). Its bigrand
also subtracts two from the bound and adds two to the result, operations
commented out in the current source. The old and current paths were
therefore tested separately. Mirror and ZIP dates are evidence about the
retrieved archive; they are not proof that Certicom used that version.

Sources and retained evidence

https://www.anthropic.com/research/ecdsa-curve-origins
https://github.com/lrobot/freelip/blob/master/lip.c
https://github.com/lrobot/freelip/blob/master/lip.h
https://github.com/miracl/MIRACL/blob/master/source/mrcore.c
https://github.com/miracl/MIRACL/blob/master/source/mrrand.c
https://github.com/miracl/MIRACL/blob/master/include/miracl.h
https://github.com/miracl/MIRACL/blob/master/docs/miracl-explained/reference-manual/low-level-routines.md
https://www.mirrorservice.org/sites/ftp.wiretapped.net/pub/security/cryptography/libraries/math/miracl/
https://www.mirrorservice.org/sites/ftp.wiretapped.net/pub/security/cryptography/libraries/math/miracl/miracl.zip

public-prng-provenance.json records the downloaded source SHA-256 hashes,
source URLs, chronology, and precise assumptions. The separate control
vectors JSON and original C-program output text files retain the control
evidence. External library source files need not be redistributed.
