Dan Shumow, with Claude. 2026-10-17. Part A is the results map; Part B is the detailed record, with section numbers kept stable for cross-reference; Part C covers the base points; Part D reproducibility and sources.
This is a negative result. Anthropic’s lrand48 discovery explains every NIST/ANSI prime-curve seed but leaves eleven candidates unexplained: seeds in the same runs that give prime-order curves of the right size, passing every documented criterion, which the 1997 program nonetheless passed over. We tested roughly fifty properties of those curves and a dozen models of the generating program. Nothing separates the eleven skipped curves from the eight published ones — not any invariant of the curve, not any consistent bug in a simulated point counter, and not any union of a few small defects (a set-cover search finds the skipped set no easier to cover than random relabellings). The skips should be regarded as unexplained and, on this evidence, unrelated to any property of the curves themselves. Two positive facts about the seed program did come out: it computed b with the textbook (p+1)/4 square root, and it drew exactly 20 bytes of lrand48 output per candidate. And one positive fact about a base point: on K-163, the half of the published generator has a 126-bit x-coordinate — a 2⁻³⁷ coincidence or a 128-bit value (a hash?) that was doubled into the prime-order subgroup (§7.1).
Reproducing the four prime-field runs (P-256, P-224, prime192, prime239) with that square-root convention and Filippo Valsorda’s size rule gives 8 published curves and 11 skipped-but-viable ones — the same lists both Anthropic and Valsorda report.
Curve invariants — fifteen families tested, none separates published from skipped. Everything a 1997 program could cheaply compute from (p, b, n, t) has been checked: the arithmetic of n and t, the CM discriminant and class number (either direction), isogeny structure over F_p and over extensions, extension-field group orders, embedding degree, gcds of p ± 1 with n ± 1, Legendre symbols and residue classes, and the small-x point structure. In each family the published values interleave with the skipped ones, and in the two runs that published three curves each (prime192, prime239) the published curves disagree with each other on most of the binary properties.
Generation process — two positive facts, one constraint, no explanation. The program used b = (−27/c)^((p+1)/4) for p ≡ 3 (mod 4), seven for seven. The published seed is the last viable candidate of every run (not a selection rule, just where runs stopped). The per-candidate RNG stride is exactly 20 draws, so any extra consumption came in whole 20-byte blocks; no simple event-triggered skip rule fits.
Program models — six tested (Part A.3), plus a union-of-bugs search (§6.21); none fits. Simulated early-abort bugs, a time limit, index-dependent bugs, mangled seed bytes, a failing base-point step, and sorted human choice are all excluded as consistent rules. What remains is, by construction, invisible in the published parameters: a bug that depended on run-time state, or a person choosing for reasons that leave no numerical trace.
| Family | What was tested | Where | Result | ||
|---|---|---|---|---|---|
| Arithmetic of n and t | twist order n’ = 2p + 2 − n (smoothness, cofactor primality); n ± 1 full factorizations and largest prime factors; congruences on t, n, b mod 2, 3, 4, 5, 8; b < p/2; (n−1)/2 prime | §6.1–6.3, §6.6, §6.9 | interleave | ||
| CM structure | D = t² − 4p; conductor s (largest square divisor); fundamental discriminant f; class number via √ | f | ·L(1,χ)/π with L(1,χ) from the Euler product to 10⁶ | §2–3 (theory), §6.1–6.2, §6.5, §6.9 | floor refuted by P-224 (published has smallest h); ceiling refuted by P-256 (published has larger h); interleave on 19 |
| Isogeny structure over F_p | End(E) vs Z[π]; position on the ℓ-volcano (only P-224 has s > 1: crater of a height-1 3-volcano); rational ℓ-isogeny counts from Φ_ℓ(j, X) for ℓ ≤ 43 | §6.7, battery*.txt |
random; the one curve with volcano structure is published | ||
| Isogeny structure over F_{p^k} | conductor s·U_k and ℓ-volcano depths for ℓ ≤ 47, k ∈ {2,3,4,6,12} | §6.12 | interleave | ||
| Extension-field group orders | #E(F_{p^k})/n for k ≤ 12: 10⁶-smooth part, cofactor size and primality | §6.17 | random-integer behaviour, interleave | ||
| Embedding degree | ord_n(p) (exact where n−1 factored, else > 20000) | §6.1–6.2, §6.9 | ≥ 2²²² or > 2·10⁴ everywhere | ||
| gcds | gcd(p±1, n±1), gcd(p²−1, n²−1), odd parts, largest prime factors; per-run ranking | §6.16 | no consistent direction across runs | ||
| Symbols and residues | (n/p), (p/n), (t/p), (t/n), (b/p), (−3/n), (f/n), (−1/n), (2/n); n, p, t mod 4 and 8 | §6.18 | published curves disagree among themselves in the 3-curve runs | ||
| Point structure | smallest on-curve x and its y (with the (p+1)/4 root); full x = 0…255 on-curve bitmaps; small-scalar relations (k ≤ 2²⁰) among small-x points and with published G | §6.13–6.15 | coin-flip statistics; no relations |
| Property | Where | Result |
|---|---|---|
| Square-root convention for b | §6.10 | positive: b = (−27/c)^((p+1)/4) for all seven published curves over p ≡ 3 (mod 4); the twist root is prime for 4 + 10 + 9 further candidates the program never saw |
| Size rule | §1.2, §6.9 | Valsorda’s bitlen(n) ≤ bitlen(p) rejects 7 prime-order P-224 and 7 prime192 candidates; reproduced |
| Published = last viable of the run | §6.3, §6.9 | holds in all four runs (1842, 7026, 6013, 3048) but earlier published curves (139, 5228; 2185, 2320) have later skipped ones, so it is not a rule |
| RNG stride | §6.11 | exactly 20 draws per candidate (coprime published indices); extra consumption, if any, in whole 20-byte blocks |
| Event-triggered skip rules | §6.11 | none of the “after property X, skip k blocks” rules (X from 6 candidate properties, k ≤ 7) fits; best 13/19 vs. random ≈ 9.5 |
| Candidate-index patterns | §6.11 | skips not periodic, not parity-based |
Anthropic’s Frontier Red Team post “Claude reveals ECDSA curve origins” (2026-10-16) showed that the SEED values in FIPS 186-2 / ANSI X9.62 are not hashes of anything. Each prime-field seed is 20 consecutive bytes of lrand48() >> 23 after srand48(t), where t is a Unix timestamp between May 1997 and April 1998. A “run” draws 20-byte candidates one after another; the published seed is candidate number n of its run. The runs relevant here:
| Curve | srand48 time (UTC) |
Published candidate |
|---|---|---|
| P-256 | 1997-08-16 01:52:34 | 1842 |
| P-224 | 1998-04-03 12:52:07 | 7026 |
| P-192, prime192v2/v3 | 1997-05-18 14:45:34 | 139 / 6013 / 5228 |
| prime239v1/v2/v3 | 1997-05-15 15:49:03 | 2185 / 2320 / 3048 |
Each seed determines the coefficient b through the X9.62 / FIPS 186-2 procedure: SHA-1 expansion of the seed gives c, and b is a square root of −27/c mod p (with a = −3). About half of all candidates have no such root and are discarded by the standard itself.
Anthropic observed that the runs passed over candidates that look viable:
Filippo Valsorda’s follow-up (“The NIST Elliptic Curves Seeds Bounty Has Been Claimed”, 2026-10-16) adds two things. First, there is one understood undocumented criterion beyond X9.62: a seed is rejected if the bit length of the order n exceeds the bit length of p (not the stricter n < p, because prime239v2 has p < n < 2²³⁹). Second, after applying that, “roughly twice as many valid seeds as were published” remain — i.e. a second criterion, or an artifact, rejects on the order of half of the otherwise-valid candidates. Neither post mentions class numbers, CM discriminants, embedding degree, or twist order.
That “half” calibrates every hypothesis below: the unknown criterion did not reject one candidate in several hundred of all candidates; it rejected roughly one in two of the candidates that already had prime order and the right size.
This section and the next record the hypothesis the investigation began with. It was refuted by the data in §6.1–6.5, but the statistical argument in §3 is correct and worth keeping: it says why the hypothesis was admissible before testing.
For an ordinary curve E/F_p with trace t = p + 1 − #E, the Frobenius endomorphism satisfies π² − tπ + p = 0, so Z[π] sits inside an imaginary quadratic order of discriminant
D = t² − 4p < 0.
| Write D = f · s² with f a fundamental discriminant (so f is square-free apart from a possible factor of 4). The endomorphism ring End(E) lies between Z[π] and the maximal order O_K of K = Q(√D); its discriminant is f · s’² for some s’ | s. The class number of the maximal order is, by the class number formula, |
| h(f) = (√ | f | / π) · L(1, χ_f) (for | f | > 4), |
| and L(1, χ_f) is a slowly varying factor (bounded by O(log | f | ) above and ≫ 1/log | f | below), so to first approximation |
| h ≈ √ | f | . |
| For a random curve of a 256-bit p, | D | ≈ 4p ≈ 2²⁵⁸, and if D were square-free then h ≈ 2¹²⁹. A small class number is what makes CM constructions possible and is the property SafeCurves checks under “CM field discriminant”; a curve with tiny f (such as −3 or −4) has an endomorphism ring that is “special” in a way a cautious designer in 1997 might have wanted to avoid. The hypothesis was that such a floor, set near the generic size, was the undocumented criterion. |
A first instinct is that a random D is essentially never a small multiple of a square: the probability that t² − 4p is within a constant factor of a perfect square is on the order of 1/√p, which at 224–256 bits is zero for all practical purposes. If that were the relevant statistic, a class number floor could never explain any skips.
But that is the wrong statistic. What determines how much the class number drops below its generic size is the largest square divisor s² of D, and its distribution is heavy-tailed:
| For a fixed s, the probability that s² | D for a random D is about 1/s². |
| If s ≥ X then | f | = | D | /s² is reduced by a factor of at least X², and h ≈ √ | f | is reduced by a factor of at least X. |
So: P( h ≤ h_generic / R ) ≈ 1/R, polynomially — not exponentially — small in the reduction factor. A floor of the form “h must exceed √p / 2^k” is failed by roughly one candidate in 2^k. This is a completely different regime from the 1/√p near-squareness estimate, and it is why a class number floor is a statistically admissible candidate for an undocumented criterion.
Two further consequences of the heavy tail:
Stricter embedding degree bound. X9.62 already requires the MOV condition with B = 20 (n ∤ p^k − 1 for k ≤ 20). For a prime-order 224/256-bit curve the embedding degree k = ord_n(p) is a divisor of n − 1 and is astronomically large for a random curve; P(k ≤ K) is on the order of K/n. No embedding-degree bound, however strict, can reject even one candidate in a thousand, let alone one in two. This alternative was effectively dead on statistical grounds before computing anything; §6 confirms it with enormous k for every candidate.
Twist order. The quadratic twist has order n’ = 2p + 2 − n = p + 1 + t. A requirement that n’ be prime would reject ~99% of candidates; a requirement that n’ have no small prime factors below some bound, or a large prime factor above some bound, rejects a tunable fraction and could sit near 50%. This was the strongest conventional competitor, since twist security was understood in the 1990s and is cheap to check. Result in §6.3: no clean separation.
Square-root choice (an artifact hypothesis). The standard says only that b² c ≡ −27 (mod p); both square roots of −27/c satisfy it, and for p ≡ 3 (mod 4) the two roots give the curve and its quadratic twist. If the 1997 program computed one particular root (say, by one particular algorithm) and tested that curve for prime order, while a modern reproduction accepts a candidate if either root gives a prime-order curve, the reproduction will find roughly twice as many “valid” seeds as were published — exactly Filippo’s ratio. The root convention was settled in §6.10: for every p ≡ 3 (mod 4) curve the published b is (−27/c)^((p+1)/4), so the program tested one root only. (For P-224, p ≡ 1 mod 4, the two roots give isomorphic curves and the question does not arise.) This does matter for counting valid seeds — a reproduction accepting either root overcounts badly — but it does not explain the skips, because Valsorda’s accepted lists already use the published root and still contain the unpublished seeds.
Buggy order computation. Filippo mentions the possibility of a point-counting bug that returned the wrong answer half the time. Testable only in its consistent forms — §6.19 simulates eleven of them and none fits — and otherwise only negatively: no clean property separating accepted from rejected was found, so a bug is not displaced by anything more parsimonious.
For each run (P-256, 1842 candidates; P-224, 7026; prime192, 6013; prime239, 3048):
srand48 timestamp with the CC0 reproducer.| For each viable candidate and the published curve compute: t; D = t² − 4p; the square part s² of D (trial division to 10⁶ plus a perfect-square test on the cofactor); the fundamental discriminant f = D/s² (with the factor-of-4 adjustment); log₂ of the class number proxy √ | f | ; the embedding degree (order of p in (Z/nZ)*, computed from the factorization of n − 1 as far as it is feasible, otherwise bounded below); and the twist order n’ with its small-factor structure. |
Later sections add n ± 1 factorizations, isogeny and extension-field structure, gcds, symbols, point structure, simulated abort rules, and the set-cover search; each names its script. Full inventory in §8.
Point counting: PARI/GP 2.10-dev (built from a GitHub mirror; no seadata, so modular polynomials were computed on the fly and cached). Every reported order was independently verified by checking n·P = O for random points P, which for a prime n in the Hasse interval determines #E exactly. A first pass using SEA’s early-abort mode produced several trace-sign errors (twist order returned instead of the curve’s); those results were discarded and everything below comes from the full, verified recount. Candidates whose cubic x³ − 3x + b has a root mod p (even order) were excluded without counting.
The reproduction agrees exactly with the accepted lists in Filippo’s transcript — P-256 run {876, 1842}, P-224 run {777, 1485, 5736, 7026} — once (a) for P-256 only the same square root of −27/c as the published b is considered, and (b) Filippo’s size criterion (bitlen n ≤ bitlen p) is applied. The P-224 size criterion is doing real work: eight of the twelve prime-order P-224 candidates have negative trace and a 225-bit order, and are rejected by it.
Note on class-number columns: the tables in §6.1–6.2 and §6.9 report log2 h~ = log₂√ |
f | , the leading-order class-number proxy with no L(1, χ) factor; §6.5 onward reports the corrected estimate log₂(√ | f | ·L(1,χ)/π), which differs by 2–3 bits. Comparisons within a table are consistent; compare across tables only via §6.5 and §6.9. |
Notation: s is the largest square divisor extracted from D = t² − 4p (trial division to 10⁶ plus a perfect-square test); log2 h~ is log₂√ |
f | for the fundamental discriminant f = D/s² (generic value log₂√(4p): 129.0 for P-256, 113.0 for P-224); emb deg is the embedding degree ord_n(p) where n − 1 could be factored, else a lower bound; twist columns give the small prime factors of n’ = 2p + 2 − n and the size of the remaining cofactor. |
Prime-order curves, counting both square roots of −27/c (for p ≡ 3 mod 4 the two roots are quadratic twists of each other; b_pub = same root as the published b, -b = the other root):
cand curve pub size t s log2h~ D%4 D%9 D%25 emb deg twist small factors cofbit cofpr
81 -b ok - 1 129.0 1 6 21 > 20000 [3, 11, 17, 197] 240 False
276 -b ok + 1 129.0 1 3 5 > 20000 [3, 5, 127] 246 False
876 b_pub ok + 1 129.0 1 3 2 2^254.4 [3, 11, 37, 8081] 233 False
1049 -b ok + 1 128.9 1 6 10 > 20000 [3, 5, 41] 247 False
1383 -b ok + 1 128.7 1 2 21 > 20000 [13, 17, 71] 243 False
1842 b_pub * ok + 1 129.0 1 6 10 > 20000 [3, 5, 13, 179] 241 True
Both b_pub curves — the skipped 876 and the published 1842 — have square-free discriminants and class-number proxy at the generic maximum; the discriminant does not separate them. The four -b curves are not counted by Anthropic or Filippo: “parameters chosen the same way” means “same square root,” and a reproduction that accepts either root roughly triples the apparent number of valid seeds in this run.
Across all 348 counted candidates, 39.7% have s ≥ 3, consistent with the heavy-tail estimate in §3 (D ≡ 0 mod ℓ² with probability ≈ 2/ℓ², summed over odd primes ≈ 0.4).
For p ≡ 1 (mod 4) the two roots give isomorphic curves, so there is one curve per candidate:
cand curve pub size t s log2h~ D%4 D%9 D%25 emb deg twist small factors cofbit cofpr
77 b BIG - 1 111.3 1 6 12 2^224.0 [3, 233] 215 False
777 b ok + 1 112.9 1 3 5 > 20000 [3, 5, 683] 211 False
1485 b ok + 1 113.0 1 6 22 > 20000 [3, 31] 218 False
2232 b BIG - 1 112.8 1 3 1 > 20000 [3, 11, 31] 215 False
2328 b BIG - 1 112.8 1 6 12 > 20000 [3] 223 False
2938 b BIG - 1 113.0 1 2 1 > 20000 [7, 1697, 2417, 509939, 887449] 161 False
2954 b BIG - 3 111.4 1 0 5 > 20000 [3, 3, 5, 7, 11] 213 False
3191 b BIG - 1 112.5 1 2 7 > 20000 [] 224 False
3199 b BIG - 21 108.6 1 0 17 > 20000 [3, 3, 53, 173] 208 False
5736 b ok + 1 112.9 1 3 17 2^222.4 [3, 1607, 3371, 17539, 20347] 172 False
5861 b BIG - 1 112.2 1 2 7 > 20000 [] 224 False
7026 b * ok + 3 111.2 1 0 17 2^222.4 [3, 3, 11, 47] 212 False
| This run refuted the class-number hypothesis. The published P-224 curve has D divisible by 9 (s = 3), so its fundamental discriminant and class number are smaller than generic by a factor ≈ 3 (log₂√ | f | ≈ 111.4 versus 113.0), while all three skipped-but-valid candidates (777, 1485, 5736) have square-free D and the generic class number. A class-number floor set anywhere would have rejected the published curve before any of the skipped ones. |
Among all 1161 counted candidates, 43.3% have s ≥ 3.
What the skipped candidates look like, concretely: prime-order, generic-discriminant, large-embedding-degree curves that pass every documented criterion and every undocumented one tested here. The sections that follow extend the sweep to the ANSI runs and to every further family of invariants, then to models of the program itself.
The square-free parts in §6.1–6.2 ignore L(1, χ). Estimating L(1, χ_f) by the Euler product over primes to 10⁶ (stable to the second decimal between 10⁵ and 10⁶; exact quadclassunit on these 68–78-digit discriminants did not finish in this environment):
| Run | cand | L(1,χ) | log₂ h (est.) | log₂√|f| |
|---|---|---|---|---|
| P-256 | 876 (skipped) | 0.530 | 126.4 | 129.0 |
| P-256 | 1842 (published) | 0.723 | 126.9 | 129.0 |
| P-224 | 777 (skipped) | 0.607 | 110.5 | 112.9 |
| P-224 | 1485 (skipped) | 0.495 | 110.3 | 113.0 |
| P-224 | 5736 (skipped) | 0.540 | 110.4 | 112.9 |
| P-224 | 7026 (published) | 0.359 | 108.1 | 111.3 |
The published P-224 curve has the smallest class number of its run by a factor ≈ 4.5–5 (from both the 3² in D and an unusually small L(1,χ)); the published P-256 curve has a class number ≈ 1.4× larger than its skipped competitor. Neither a floor (“reject small h”) nor the flipped rule (“prefer small h”) is consistent with both runs, and §6.9 extends this to all nineteen curves. Two runs splitting one each way is what an irrelevant statistic looks like.
All twelve numbers were factored completely (trial division, then PARI’s ECM/MPQS; every cofactor fell within seconds). Largest prime factors:
| Run | cand | n − 1 | LPF(n−1) | LPF(n+1) |
|---|---|---|---|---|
| P-256 | 876 (skipped) | 2·3·7·11·43·P242 | 242 bits | 232 bits |
| P-256 | 1842 (published) | 2⁴·3·71·131·373·3407·17449·38189·P28·P30·P40·P92 | 92 bits | 215 bits |
| P-224 | 777 (skipped) | 2·3·743·54277·P53·P145 | 145 bits | 182 bits |
| P-224 | 1485 (skipped) | 2³·3·5·31·131·211·6421·7591·P39·P60·P74 | 74 bits | 102 bits |
| P-224 | 5736 (skipped) | 2³·3·19·2791·P204 | 204 bits | 142 bits |
| P-224 | 7026 (published) | 2²·3⁶·5·17·2153·P196 | 196 bits | 177 bits |
A “large prime factor of n − 1” (strong-prime style) criterion is excluded: the published P-256 has the smoothest n − 1 of all six (every factor ≤ 92 bits), while the candidate it displaced has n − 1 = 2·3·7·11·43 × a 242-bit prime. n + 1 and n² − 1 do not separate the groups either; the published values sit inside the range of the skipped ones.
For an ordinary curve with trace t, End(E) is an order between Z[π] (discriminant D = t² − 4p) and the maximal order O_K (discriminant f). The index [O_K : Z[π]] is the conductor s from §6.1–6.2.
Rational ℓ-isogeny counts (roots of the classical modular polynomial Φ_ℓ(j(E), X) mod p, verified against the Kronecker symbols (f/ℓ)):
ℓ= 2 3 5 7 11 13 17 19 23 29 31 37 41 43
P-256 876 0 1 0 0 2 0 2 2 0 2 2 2 0 2
P-256 1842 * 0 1 1 0 2 2 2 0 2 2 0 2 2 2
P-224 777 0 1 1 0 2 0 2 0 2 1 0 0 2 0
P-224 1485 0 1 0 0 2 0 0 0 2 2 2 0 1 2
P-224 5736 0 1 0 0 2 1 2 2 2 2 0 0 0 2
P-224 7026 * 0 4 0 0 2 0 0 0 0 1 0 0 0 0
Observations: ℓ = 2 is inert for every prime-order candidate (forced: n odd ⇒ t odd ⇒ D ≡ 5 mod 8), so none has a rational 2-isogeny. ℓ = 3 divides D for all six (so each has exactly one rational 3-isogeny, and in fact every one of these curves has a quadratic twist with a 3-torsion point) — but this is not forced; several of the other prime-order candidates in the runs have 3 inert. ℓ = 11 splits in all six, a ≈1.5 % coincidence that also fails on the broader candidate set. Beyond that the splitting patterns look random: the published P-256 has many split primes and the published P-224 has almost none (which is just the L(1,χ) difference in §6.5 seen prime by prime). Nothing in the isogeny structure — conductor, position on the volcano, or the pattern of rational small-degree isogenies — separates published from skipped. The one curve with any volcano structure at all is a published one, which is the opposite of what a “reject curves with non-maximal Frobenius order” rule would produce.
Same pipeline (published root, 2-torsion filter, verified SEA count; no sign errors in either run).
prime192 run (srand48 1997-05-18 14:45:34; 6013 candidates, 3061 with valid b, 1057 counted). Viable: 139*, 2198, 5228*, 5405, 6013* — two skipped. Seven prime-order candidates were rejected by the size rule and ten are prime only on the twist root.
prime239 run (srand48 1997-05-15 15:49:03; 3048 candidates, 1555 with valid b, 506 counted). Viable: 36, 1562, 2185*, 2320*, 2491, 2682, 2863, 3048* — five skipped. None rejected by the size rule; nine prime only on the twist root.
Two plus five is exactly the “seven more” Anthropic reported for the ANSI runs, so the reproduction agrees with theirs here too. Across all four runs: 8 published, 11 skipped-but-viable.
| Run | cand | s | L(1,χ) | log₂ h | LPF(n−1) bits | LPF(n+1) bits |
|---|---|---|---|---|---|---|
| 192 | 139 * | 1 | 0.411 | 94.0 | 92 | 108 |
| 192 | 2198 | 1 | 0.498 | 93.6 | 176 | 149 |
| 192 | 5228 * | 1 | 0.352 | 93.8 | 157 | 161 |
| 192 | 5405 | 1 | 0.434 | 94.0 | 132 | 177 |
| 192 | 6013 * | 1 | 0.529 | 93.6 | 64 | 145 |
| 239 | 36 | 1 | 0.436 | 117.1 | 105 | 153 |
| 239 | 1562 | 1 | 0.590 | 118.1 | 219 | 136 |
| 239 | 2185 * | 1 | 0.246 | 116.8 | 69 | 136 |
| 239 | 2320 * | 5 | 0.476 | 115.2 | 128 | 123 |
| 239 | 2491 | 1 | 0.415 | 117.6 | 76 | 131 |
| 239 | 2682 | 5 | 0.558 | 115.7 | 170 | 227 |
| 239 | 2863 | 1 | 0.505 | 117.7 | 183 | 72 |
| 239 | 3048 * | 1 | 0.410 | 117.5 | 110 | 151 |
(generic log₂ h: 97.0 for 192, 120.5 for 239)
Class number, in either direction, is now dead on 19 curves: published and skipped values interleave in both ANSI runs, and the prime239 run has one published (2320) and one skipped (2682) curve with conductor s = 5. n ± 1 smoothness interleaves likewise. The embedding degrees are all astronomically large; the isogeny patterns (rational ℓ-isogeny counts, full tables in battery192.txt / battery239.txt) are random-looking, and 3 is inert for every curve in both runs because p ≡ 2 (mod 3) for both ANSI primes.
“Published = last viable candidate of the run” holds in all four runs (1842, 7026, 6013, 3048), but as a selection rule it is empty: 139 and 5228 were published with later viable candidates (2198, 5405) skipped in between, and likewise 2185 and 2320 before 2491/2682/2863. It only says the runs stopped when a curve was taken.
For every published curve over a field with p ≡ 3 (mod 4) — P-256, P-192, prime192v2, prime192v3, prime239v1, v2, v3 — the published b equals (−27/c)^((p+1)/4) mod p, the textbook square root for such p, never the other root (seven of seven). So the 1997 program computed that one root and tested only that curve; the other root is its quadratic twist and is prime for 4 + 10 + 9 further candidates across the three p ≡ 3 (mod 4) runs, none of which the program would have seen. Any reproduction that accepts either root will overcount valid seeds by a wide margin. For P-224 (p ≡ 1 mod 4) the two roots give isomorphic curves and the question does not arise.
A different kind of explanation for the skips: perhaps the program did not consume exactly 20 bytes of lrand48 output per candidate. If it drew extra output after certain events (random bases for a primality test of the order, a random point, a second seed), then the 20-byte windows it actually tested would not be the 20-byte-aligned “candidates” of the reproduction, and a “skipped viable candidate” could simply be a window the program never looked at.
Two constraints from the data:
So the hypothesis survives only in forms where the extra consumption is in 20-byte units and triggered by something not in that list. A natural such form — the program drew another seed-sized block for some auxiliary purpose — is not excluded, but there is no positive evidence for it either.
| Over F_{p^k} the Frobenius is π^k, with trace t_k given by t_0 = 2, t_1 = t, t_k = t·t_{k−1} − p·t_{k−2}, and discriminant t_k² − 4p^k = D · U_k² where U_k = (π^k − π̄^k)/(π − π̄) is the Lucas sequence U_0 = 0, U_1 = 1, U_k = t·U_{k−1} − p·U_{k−2}. The CM field does not change, so a prime ℓ that is inert over F_p stays inert — what changes is the conductor of Z[π^k], which is s·U_k, so an ℓ-volcano of depth v_ℓ(s·U_k) appears whenever ℓ | U_k (for ℓ ∤ s). For an ordinary curve every endomorphism is already F_p-rational, so End(E) = O_K for all our curves (§6.7) and E sits on the crater of every one of these volcanoes at every level; the only invariants are the depths. |
| Depths v_ℓ(s·U_k) for ℓ ≤ 47, k ∈ {2, 3, 4, 6, 12} (full table in the transcript; summary): ℓ = 2 appears at k = 3 for every curve (forced: 2 is inert for all, so its rank of apparition is 3) with depth varying from 1 to 7; ℓ = 3 at k = 4 (or k = 3 where 3 | D); and otherwise a scattering of small primes whose rank of apparition divides k. Published and skipped curves are indistinguishable: e.g. in the prime239 run the published 2185 has a 5-volcano of depth 5 over F_{p³} while the skipped 36 has depth 2 and the published 3048 depth 0; in P-224 the skipped 777 has a 2-volcano of depth 7 over F_{p³} against depth 3 for the published 7026. No level k ≤ 12 and no ℓ ≤ 47 separates the groups. |
For each viable curve, the smallest x ≥ 0 with a point (x³ − 3x + b a square mod p), the first eight such x, and the y at the smallest one:
run cand first x with a point y at smallest x b
P-256 876 0 4 7 8 10 12 13 14 256 bits, odd 256 bits, odd
P-256 1842 * 0 5 6 8 9 12 13 17 255 bits, even 255 bits, odd
P-224 777 0 3 8 10 11 12 17 18 222 bits, even 223 bits, even
P-224 1485 1 2 3 5 10 12 15 16 224 bits, odd 224 bits, even
P-224 5736 1 2 9 14 15 17 18 23 224 bits, even 223 bits, even
P-224 7026 * 3 4 5 6 7 8 10 13 224 bits, odd 223 bits, odd
192 139 * 0 2 3 5 6 8 12 13 192 bits, odd 191 bits, odd
192 2198 0 2 3 6 9 15 16 18 192 bits, odd 192 bits, even
192 5228 * 0 1 4 5 6 7 8 9 192 bits, odd 190 bits, even
192 5405 0 1 6 10 11 12 13 16 190 bits, even 192 bits, odd
192 6013 * 0 2 3 5 14 15 18 19 187 bits, even 192 bits, odd
239 36 0 1 3 6 7 9 11 13 237 bits, odd 236 bits, even
239 1562 0 1 3 6 10 11 12 14 239 bits, even 239 bits, even
239 2185 * 0 1 6 7 8 9 10 11 238 bits, odd 239 bits, even
239 2320 * 0 2 3 4 6 8 10 11 238 bits, even 239 bits, even
239 2491 0 1 3 4 5 8 9 10 239 bits, even 236 bits, even
239 2682 0 1 3 4 7 9 12 14 239 bits, odd 235 bits, odd
239 2863 0 1 5 8 12 13 17 19 237 bits, odd 239 bits, odd
239 3048 * 0 2 5 8 13 14 16 19 234 bits, odd 238 bits, odd
x = 0 carries a point exactly when b is a square mod p (a coin flip); it does for 16 of 19 curves, and the three exceptions (1485, 5736, 7026) include a published one. The first few x with points are the small integers you would expect from a half-density set; the corresponding y values are full-size and random in parity; the bit length and parity of b itself are likewise unremarkable on both sides. Nothing about the small-x points, or about short coordinates generally, separates published from skipped curves. (The published P-224 through P-521 base points are not at small x in any case; the ANSI/P-192 base points come from FreeLIP’s generator as Anthropic showed.)
For each viable curve, the on-curve indicator for every x in 0…255 (1 if x³ − 3x + b is a square mod p), packed as 32 hex bytes with x = 0 the most significant bit of the first byte; count of on-curve x, first on-curve x, longest run of consecutive off-curve x, longest run of on-curve x, on-curve count among x < 16 and x < 64:
run cand pub #on 1st off-run on-run on<16 on<64 pattern
P-256 876 118 0 6 6 9 31 89af5b19263109e7b0471a887c88d02593858ea4ec44903f6be97b761e21c116
P-256 1842 * 125 0 5 6 7 31 86cc41e5350cbeda17221e7374d72913d2526b4f42a6a86723591cc9b184fd75
P-224 777 130 0 9 7 6 32 90b86bbd33bd6d008befe637767664c01b7194143afb50c27509e2ee2be8ccb4
P-224 1485 139 1 7 11 7 35 7429b07c7ff299d10fb4067d8d38e0ab227b687b46b81f6df4d37d34b3e59caf
P-224 5736 133 1 6 6 5 29 604361259c8b2e6f8e8b761357122ac6fbf7ddb8489486f7c37da5d929a617ba
P-224 7026 * 120 3 9 8 10 32 1fa79a680bebca30191b09fbbef70b005db0d0613c902310d4d93793fd4431c0
192 139 * 121 0 6 7 9 28 b68d6232a14bd841c5384d9aa050d20e87d4543dacb8d6de4bf8766a14adaea0
192 2198 126 0 10 7 6 25 b241ac51a21c640795bf8785002abccf2dc36fc8d15aaabdd45efced8d80a837
192 5228 * 131 0 6 6 11 38 cfceb9c66ed913d62e5a8a9b850cc2b3689d75af5931e2a454aa05676be7c921
192 5405 138 0 5 7 7 29 c23ca1eb85a12335f57482b5dda09b6462f47f24f4cf6be48f1bbdef5d22bd2e
192 6013 * 133 0 8 6 6 28 b4033685879a8f416cf0535a74991db6bdb7b2c54f88c1db6fa351c1a5fb953d
239 36 127 0 9 10 9 31 d3557d132c2b3d011c8cda52b690f88b5fc5068ef93006f261e93c25affdf032
239 1562 131 0 6 7 9 32 d23be7905ac8c99c6390773e19fcf27839d27758e19e7902dd6266a6ab6418ce
239 2185 * 148 0 4 9 11 41 c3f74b7e565e57f3777cfb73cff968c64b52527861778e9e85531eb956b27696
239 2320 * 124 0 5 5 10 33 baba458d687b6117a0b5f19b043e6597ba499bb2392f4b046318b32e30c3890f
239 2491 131 0 5 4 10 31 dce32d0d64a6454ea8db520baaf28c220a6c9c96f32e4cb672adc35d8e777b6b
239 2682 129 0 7 10 8 34 d94a43c8379acedddb69e691a8ec358b3ff40b34db154044b19781b10d1a7c5f
239 2863 124 0 7 5 6 32 c48c5ae7a5e65e28a9da53e2c040d8f7ae5c713911180b7a2e295155add961f2
239 3048 * 124 0 7 8 6 29 a486903951688bfd7358f24dea24d5d5360296dea17e9734f1810d1176cc45dc
Every row looks like 256 fair coin flips: on-curve counts 118–148 against a Binomial(256, ½) mean of 128 and s.d. 8 (published mean 128.2, skipped 129.6), longest off-curve runs 4–10 and on-curve runs 4–11, as expected for runs in a random 256-bit string. The only ±2.5σ value (148, candidate 2185) is a published curve. Nothing in the low-byte x patterns separates published from skipped candidates.
Recomputed the small-x points taking y = (x³ − 3x + b)^((p+1)/4) as the primary root for the p ≡ 3 (mod 4) fields (the convention pinned down for b in §6.10) and Tonelli–Shanks with both roots for P-224. Full x, y, p − y for the first eight on-curve x of every viable curve are in pts.out. On a prime-order curve every non-identity point has order n, so there is no “special-order” small-x point to look for; the only possible structure is relational. Checked, for each curve: whether any of the first eight small-x points is a scalar multiple k·P₀ (k ≤ 2²⁰, up to sign) of the point at the smallest x, and for the eight published curves whether the published generator G is such a multiple, or P₀ a multiple of G. Result: no relation anywhere beyond k = 1; no published generator sits at a small x, and none is within 2²⁰ of the smallest-x point in either direction.
| Distinct from the MOV condition (which asks whether n | p^k − 1): here the question is whether p ± 1 and n ± 1 share any unusually large common factor, which a 1997 program might have looped over as a cheap “independence” check. |
run cand pub (p-1,n-1) (p+1,n+1) (p-1,n+1) (p+1,n-1) (p^2-1,n^2-1) (p-1,n) (n-1,t) (n+1,t)
P-256 876 6 16 2 14 672 1 1 1
P-256 1842 * 6 2 10 16 480 1 1 1
P-224 777 6 2 20 2 120 1 1 1
P-224 1485 120 2 2 2 240 1 1 1
P-224 5736 24 2 2 2 48 1 1 1
P-224 7026 * 1020 2 2 2 2040 1 1 1
192 139 * 2 6 2 80 480 1 1 1
192 2198 2 2 2 24 48 1 1 7
192 5228 * 2 20 2 6 120 1 1 1
192 5405 2 2 2 96 192 1 1 1
192 6013 * 2 10 2 48 480 1 1 1
239 36 2 4 2 42 168 1 1 1
239 1562 2 160 2 126 20160 1 1 1
239 2185 * 2 4 2 18 72 1 1 1
239 2320 * 2 68 2 630 42840 1 1 1
239 2491 2 2 2 36 72 1 1 1
239 2682 2 5784 2 70 404880 1 1 1
239 2863 2 13192 2 30 395760 1 1 1
239 3048 * 2 42 2 80 3360 1 1 1
All gcds are tiny (products of small primes, as expected for two random numbers that are both ≡ 1 or ≡ 3 mod small moduli for structural reasons — e.g. 2 always divides every entry since p and n are both odd). The largest, gcd(p² − 1, n² − 1) = 404880 and 395760, belong to two skipped prime239 curves, but the published prime239v2 is next at 42840 and the published P-224 has the largest gcd(p − 1, n − 1) of its run (1020). gcd(p − 1, n) = 1 everywhere (trivially, n prime and n ≠ p), and t is coprime to n ± 1 everywhere except one skipped curve (2198, gcd 7). No threshold or specific factor separates published from skipped.
Per-run ranking. For each gcd, and for its odd part and its largest prime factor, whether every published curve in the run is above every skipped one, below every skipped one, or neither. A threshold criterion needs the same direction in all four runs:
gcd stat P-256 P-224 192 239 consistent?
(p-1,n-1) value mixed pub ABOVE mixed mixed no
(p-1,n-1) odd part mixed pub ABOVE mixed mixed no
(p-1,n-1) LPF mixed pub ABOVE mixed mixed no
(p+1,n+1) value pub BELOW mixed pub ABOVE mixed no
(p+1,n+1) odd part mixed mixed pub ABOVE mixed no
(p+1,n+1) LPF mixed mixed pub ABOVE mixed no
(p-1,n+1) value pub ABOVE mixed mixed mixed no
(p-1,n+1) odd part pub ABOVE mixed mixed mixed no
(p-1,n+1) LPF pub ABOVE mixed mixed mixed no
(p+1,n-1) value pub ABOVE mixed mixed mixed no
(p+1,n-1) odd part pub BELOW mixed mixed mixed no
(p+1,n-1) LPF pub BELOW mixed mixed mixed no
(p^2-1,n^2-1) value pub BELOW pub ABOVE mixed mixed no
(p^2-1,n^2-1) odd part pub BELOW pub ABOVE pub ABOVE mixed no
(p^2-1,n^2-1) LPF pub BELOW pub ABOVE pub ABOVE mixed no
No gcd statistic has a consistent direction. gcd(p − 1, n − 1) puts the published curve on top in P-224 only; the odd part of gcd(p² − 1, n² − 1) has the published curves above the skipped in P-224 and prime192 but below in P-256 and mixed in prime239. A threshold on any of these is excluded.
Group orders over the extension fields from the trace recurrence (t_k = t·t_{k−1} − p·t_{k−2}), divided by n, cofactor trial-divided to 10⁶. Each cell is (bits of the 10⁶-smooth part) / (bits of the remaining cofactor) followed by P if that cofactor is a probable prime, C if composite, 1 if fully factored. k = 1 is trivial (n prime) and omitted.
run cand pub k=2 k=3 k=4 k=5 k=6 k=7 k=8 k=9 k=10 k=11 k=12
P-256 876 24/233 C 24/489 C 34/735 C 5/1020C 52/1229C 1/1536C 72/1721C 28/2021C 49/2256C 1/2560C 65/2752C
P-256 1842 * 16/241 P 3/510 C 51/718 C 16/1009C 46/1235C 21/1516C 69/1724C 8/2041C 82/2223C 10/2551C 92/2725C
P-224 777 14/211 C 19/430 C 31/642 C 25/872 C 38/1083C 27/1318C 47/1522C 51/1742C 47/1970C 26/2215C 77/2388C
P-224 1485 7/218 C 26/423 C 32/641 C 23/874 C 48/1073C 16/1329C 51/1518C 39/1754C 39/1978C 5/2236C 75/2390C
P-224 5736 53/172 C 17/432 C 66/607 C 12/885 C 90/1031C 55/1290C 74/1495C 47/1746C 68/1949C 13/2228C 147/2318C
P-224 7026 * 13/212 C 3/447 C 13/660 C 40/857 P 44/1077C 5/1340C 27/1542C 20/1773C 87/1930C 1/2241C 46/2419C
192 139 * 5/188 C 16/369 C 11/566 C 12/757 C 38/923 C 22/1131C 22/1323C 32/1505C 51/1678C 41/1880C 49/2064C
192 2198 23/170 P 5/380 P 49/528 C 5/764 C 36/925 C 1/1153C 52/1293C 5/1532C 44/1685C 17/1904C 94/2019C
192 5228 * 8/185 C 10/375 C 31/546 C 20/749 C 60/901 C 1/1153C 68/1277C 35/1502C 34/1695C 52/1869C 141/1972C
192 5405 12/181 P 15/370 C 16/561 C 40/729 C 48/913 C 21/1132C 49/1296C 34/1503C 59/1670C 7/1914C 85/2028C
192 6013 * 24/169 C 16/369 C 26/551 C 15/754 C 60/901 C 6/1147C 43/1302C 24/1513C 58/1671C 20/1901C 88/2025C
239 36 23/217 C 22/457 C 36/682 C 35/922 C 51/1145C 37/1398C 66/1608C 37/1876C 58/2094C 36/2355C 89/2541C
239 1562 26/214 C 15/464 C 28/690 C 1/956 C 42/1154C 5/1430C 41/1633C 45/1868C 35/2117C 23/2368C 67/2563C
239 2185 * 49/191 C 46/433 C 66/652 C 1/956 C 104/1092C 1/1434C 86/1588C 80/1833C 78/2074C 17/2374C 153/2477C
239 2320 * 11/229 C 3/476 C 31/687 C 15/942 C 67/1129C 1/1434C 50/1624C 3/1910C 45/2107C 26/2365C 100/2530C
239 2491 32/208 C 7/472 C 42/676 C 17/940 P 45/1151C 7/1428C 52/1622C 24/1889C 55/2097C 19/2372C 78/2552C
239 2682 5/235 C 49/430 C 36/682 C 11/946 C 80/1116C 17/1418C 42/1632C 56/1857C 38/2114C 18/2373C 113/2517C
239 2863 1/239 C 14/465 C 16/702 C 26/931 C 16/1180C 1/1434C 33/1641C 19/1894C 37/2115C 1/2390C 41/2589C
239 3048 * 14/226 C 49/430 C 27/691 C 1/956 C 111/1085C 1/1434P 68/1606C 68/1845C 14/2138C 17/2374C 132/2498C
The smooth parts are what random integers of these sizes give — typically 1–100 bits of small factors, occasionally more (e.g. 147 bits at k = 12 for the skipped 5736, 153 for the published 2185). Published and skipped values interleave at every k; no level shows the published curves systematically smoother or rougher than the skipped ones. The k = 2 cofactor (the twist order, up to the factor already covered in §6.2) is prime for one published (P-256) and three skipped curves (2198, 5405 at 192; none at 239) — no pattern. Nothing in the extension-field group structure separates the groups.
For each viable curve: (n/p), (p/n), (t/p), (t/n), (b/p), (−3/n), (f/n) with f the fundamental CM discriminant, (−1/n), (2/n), and n, p, t mod 4 / 8. ((f/n) = 1 always, since n = p + 1 − t and 4p = t² − D makes D a square mod n; (b/p) is just whether x = 0 carries a point.)
run cand pub (n/p) (p/n) (t/p) (t/n) (b/p) (-3/n) (f/n) (-1/n) (2/n) n%4 n%8 p%4 p%8 t%4
P-256 876 1 -1 1 -1 1 1 1 -1 1 3 7 3 7 1
P-256 1842 * -1 -1 1 -1 1 1 1 1 1 1 1 3 7 3
P-224 777 1 1 -1 1 1 1 1 -1 -1 3 3 1 1 3
P-224 1485 -1 -1 1 -1 -1 1 1 1 1 1 1 1 1 1
P-224 5736 -1 -1 1 -1 -1 1 1 1 1 1 1 1 1 1
P-224 7026 * -1 -1 1 -1 -1 1 1 1 -1 1 5 1 1 1
192 139 * 1 1 1 1 1 -1 1 1 1 1 1 3 7 3
192 2198 1 1 1 1 1 1 1 1 1 1 1 3 7 3
192 5228 * -1 1 1 -1 1 1 1 -1 -1 3 3 3 7 1
192 5405 1 1 -1 1 1 1 1 1 1 1 1 3 7 3
192 6013 * 1 1 1 1 1 1 1 1 1 1 1 3 7 3
239 36 1 -1 1 -1 1 1 1 -1 -1 3 3 3 7 1
239 1562 -1 1 -1 1 1 1 1 -1 1 3 7 3 7 1
239 2185 * -1 1 -1 1 1 1 1 -1 -1 3 3 3 7 1
239 2320 * -1 1 1 1 1 1 1 -1 -1 3 3 3 7 1
239 2491 1 1 -1 1 1 1 1 1 -1 1 5 3 7 3
239 2682 1 -1 1 -1 1 -1 1 -1 1 3 7 3 7 1
239 2863 1 -1 1 -1 1 -1 1 -1 1 3 7 3 7 1
239 3048 * 1 1 1 1 1 -1 1 1 1 1 1 3 7 3
Quadratic reciprocity ties (n/p) and (p/n) together through n mod 4 and p mod 4 (equal unless both ≡ 3 mod 4), so there are fewer independent bits here than columns. Within a single run several columns happen to be constant on the published curves and differ on a skipped one — in P-256 (two curves) that is almost inevitable, and in P-224 the published curve is the only one with n ≡ 5 (mod 8). But no column takes the same published-constant value in all four runs: e.g. n mod 4 is 1 for the published P-256 and P-224 curves but the three published prime239 curves have n ≡ 3, 3, 1; (n/p) is −1 for published P-256/P-224 but +1 for published P-192, prime192v2, prime239v3. In the prime192 and prime239 runs, where three curves are published each, the published curves themselves disagree on nearly every symbol. No Legendre symbol or small residue class is a selection criterion.
Hypothesis A.3(1): the 1997 point counter rejected good curves through a buggy early abort. For each of the 19 curves the true t and n are known, so any abort rule of the form “reject if some statistic ≡ 0 (mod ℓ) for some prime ℓ ≤ 100” can be simulated exactly. Rules tried, with what they reject:
rule skipped rejected published rejected
(a) n ≡ 0 mod ℓ correct abort (control) 0/11 0/8
(b) p+1+t ≡ 0 mod ℓ trace sign flipped (= twist order) 9/11 7/8
(c) order of the OTHER root of b (twist for p≡3 mod 4) 6/11 6/8
(d) sign and root both flipped 3/11 1/8
(e) t ≡ 0 mod ℓ tests the trace, not the order 5/11 4/8
(f) t ≡ ±1, ±2 mod ℓ sloppy trace tests 11/11 8/8
(g1) n ≡ 1 mod ℓ off-by-one (tests n−1) 11/11 8/8
(g2) n ≡ −1 mod ℓ off-by-one (tests n+1) 10/11 7/8
(g3) |t| ≡ 0 mod ℓ signed/unsigned confusion 5/11 4/8
(g4) gcd(partial CRT order, modulus) > 1 = (a) 0/11 0/8
(h) twist order ≡ 0 mod ℓ twist-security abort 9/11 7/8
None separates. Rules (f), (g1) fire on essentially everything, (b), (h) on most of both groups, (d) on the P-224 run only (because P-224 has p ≡ 1 mod 4 and the “other root” is the same curve). Bounded versions — “reject at the first ℓ ≤ B where the statistic vanishes” for any B ≤ 1000 — were tested for all these statistics (and for t ± 1, t ± 2, n ± 1): for no statistic do the skipped curves’ first-ℓ values all lie below the published curves’ (or all above). Single-residue rules “X ≡ r (mod ℓ)” for X ∈ {n, t, n’, n ± 1, t ± 1}, ℓ ≤ 100, r arbitrary: none is satisfied by six or more skipped curves and zero published ones.
So no consistent buggy abort — one that misbehaves the same way on every candidate — explains the skips. A bug that misbehaved only sometimes (depending on the ℓ-sequence actually run, intermediate values, or the machine) remains possible but is not a rule that can be recovered from the published parameters.
Elkies vs Atkin primes (hypothesis A.3(2), time limit). ℓ is Elkies iff (D/ℓ) ≥ 0. Counts for 3 ≤ ℓ ≤ 97 (24 primes):
run cand pub Elkies Atkin
P-256 876 10 14
P-256 1842 * 13 11
P-224 777 14 10
P-224 1485 13 11
P-224 5736 11 13
P-224 7026 * 8 16
192 139 * 9 15
192 2198 11 13
192 5228 * 6 18
192 5405 10 14
192 6013 * 13 11
239 36 12 12
239 1562 17 7
239 2185 * 8 16
239 2320 * 10 14
239 2491 11 13
239 2682 17 7
239 2863 13 11
239 3048 * 12 12
Published mean 9.9 Elkies, skipped mean 12.5 — the published curves are, if anything, more Atkin-heavy (i.e. would have taken longer in a 1997 SEA), the opposite of what a time-limit rejection predicts. The two most Elkies-rich curves (17 of 24) are both skipped. A per-candidate time limit is not supported.
Position-dependent bug (A.3(3)). The eleven skipped indices are 36, 777, 876, 1485, 1562, 2198, 2491, 2682, 2863, 5405, 5736; the published eight are 139, 1842, 2185, 2320, 3048, 5228, 6013, 7026. Tested: popcount; residues mod 2…256; the byte offset 20(i − 1) of the candidate in the lrand48 stream mod 64…65536 (buffer-boundary bugs); every modulus m ≤ 4096 for which the skipped indices (or offsets) fall into ≤ 3 residue classes disjoint from the published; each bit position of i. Nothing separates. Parity, for instance, is 5 odd / 6 even among skipped and 4 / 4 among published.
Seed byte patterns (A.3(4), different candidate stream). If the program mangled some seeds before hashing (C-string truncation at 0x00, text-mode newline translation of 0x0A/0x0D, a bignum conversion dropping leading zeros), the affected “candidates” were never tested as such. Checked for every viable seed: top bit, first byte, count of 0x00 bytes, presence of 0x0A/0x0D/0x1A/0x20/0xFF, number of bytes ≥ 0x80, bit length, parity, popcount, and byte-value sets. Two skipped seeds contain a 0x00 byte (5736, 36) and no published seed does — suggestive for those two but it leaves nine unexplained, and 0x0A appears in skipped and published seeds alike (1485, 5736, 3048). Top bit is 0 for 8 of 11 skipped and 3 of 8 published, so a “bitlen(seed) = 160” check is excluded too (published P-192’s seed has a 158-bit value). No byte position has disjoint value ranges between the groups.
Failed base-point step (A.3(6)). For the May 1997 runs Anthropic published the base-point recipe (FreeLIP zrandom, seed s, discard 7, 26-bit limbs, first x on curve). Control: the six published seeds reproduce the six published Gx here. Running the recipe on every viable prime192/prime239 curve — with each of the six published seeds and with every seed 20000…20600 — the number of tries to the first on-curve x behaves identically for published and skipped curves (mean ≈ 2.0, max 8–15, ≈ 12–16 % needing more than 3 tries in every case), and the assembled x exceeds p before reduction in every run (so a “reject if x ≥ p” bug would have killed everything). The recipe has no failure branch that fires on the skipped curves and not the published ones.
Two-pass human choice (A.3(5)). If all valid curves were printed and a person picked, the picks might be extremal in some printed column. For each run, whether the k published curves are exactly the k smallest or k largest under index, seed (as integer or hex string), b, n, t, n − p: in the single-published runs the published curve is the largest index (the “last viable” fact) and also has the smallest b (P-256: 1 of 2; P-224: 1 of 4), but in prime192 and prime239 the three published curves are not the top-3 or bottom-3 under any of these keys. No sorting rule fits.
Union-of-bugs hypothesis: tested by set cover in §6.21; the true labelling needs a 4-predicate cover, which 35 % of random relabellings also achieve — no signal.
Status of Part A.3 after this section. Of the six process hypotheses, five have been tested against the parameters and none fits as a consistent rule: early-abort false negatives (§6.19), time limit (§6.19), position-dependent bug, mangled seed bytes, failed base-point step, sorted human choice (§6.20). What remains is, by construction, not recoverable from the published numbers: a bug or abort that depended on run-time state, or a human choice with no numerical signature. The skips should be reported as unexplained and, on the evidence, unrelated to any property of the skipped curves.
Every test in §6.1–6.20 asked whether a single rule separates the eleven from the eight. A different hypothesis is a union of two or three unrelated small defects — a C-string bug that eats seeds with a 0x00 byte, a sign test that misfires on one residue class, and so on — which would also explain why the published curves disagree with each other on every single property. This was tested as a set-cover problem: from a library of 135 cheap, “bug-shaped” binary predicates on (seed bytes, n, t, b, index, small residues, Legendre symbols), the 29 that are false on all eight published curves are the usable ones; the smallest union of them that covers all eleven skipped curves was found by exhaustive search up to size 5. Then the identical search was run on 300 random relabellings of published/skipped within each run (per-run counts preserved), to see what cover size chance alone produces.
Result (cover.py, cover.md, cover.json):
20(i−1) mod 4096 < 1024 ∪ b ≡ 1 mod 7 ∪ n ≡ 7 mod 8 ∪ t ≡ 0 mod 7). Nothing bug-shaped appears in any minimal cover; the best single usable predicate covers 6 of 11 (t ≡ 1 mod 8).Conclusion: the skipped set is not a union of a few recognizable small defects either. With 135 predicates and 11 items, four-predicate covers exist for a third of random labellings, and the real labelling needs exactly that many — the covers it finds are noise fitted to noise.
For all ten published prime-field generators (P-192, P-224, P-256, P-384, P-521, prime192v2/v3, prime239v1/v2/v3; parameters verified by n·G = O), computed k·G and (k⁻¹ mod n)·G for 2 ≤ k ≤ 2¹⁶ and recorded the bit length of x and of min(y, p − y) (so negations are covered). Looking for a hash-sized coordinate — 128 bits (MD5) or 160 bits (SHA-1) — or anything else far below the field size:
| Curve | G/2 x-coordinate | shortest coordinate found, k ≤ 2¹⁶ either way | expected min of 2¹⁷ random |
|---|---|---|---|
| P-192 | full size | 174 bits (61807·G) | ~175 |
| prime192v2 | full size | 175 bits (G/7467) | ~175 |
| prime192v3 | full size | 176 bits (9061·G) | ~175 |
| P-224 | full size | 208 bits (G/42457) | ~207 |
| prime239v1 | full size | 222 bits (41569·G) | ~222 |
| prime239v2 | full size | 220 bits (G/40829) | ~222 |
| prime239v3 | full size | 221 bits (4319·G) | ~222 |
| P-256 | full size | 237 bits (G/53620) | ~239 |
| P-384 | full size | 367 bits (14971·G) | ~367 |
| P-521 | full size | 502 bits (10735·G) | ~504 |
Every minimum is within two bits of what 2¹⁷ uniformly random field elements would give. No small multiple or inverse-multiple of any published generator, or of its negation, has a hash-sized coordinate. The specific “hash gives x, then double” story (G = 2·H with H at a 128/160-bit x) is excluded, as is any bare-hash x within the 2¹⁶ radius. Forms that survive: a hash expanded to field size before use (as the X9.62 seed-to-c procedure does), a hash used as a seed for some generator, a hash used as a scalar, or multipliers outside the radius. The plan for testing those is in base-point-brief.md.
The same scan over GF(2^m) (PARI/GP with ffgen; parameters from the std-curves database, each verified by G ∈ E and n·G = O) for the ten NIST binary curves — k·G for 2 ≤ k ≤ 2¹⁶ and G/k for 2 ≤ k ≤ 2¹², negations covered via y ↦ x + y. Results (binpts.gp, binpts.out):
| Curve | h | G/2 x bits | shortest x found | random expectation |
|---|---|---|---|---|
| B-163 | 2 | 163 | 147 (37609·G) | ~147 |
| K-163 | 2 | 126 | 126 (G/2) | ~147 |
| B-233 | 2 | 232 | 215 (G/1579) | ~217 |
| K-233 | 4 | 232 | 219 | ~217 |
| B-283 | 2 | 283 | 267 | ~267 |
| K-283 | 4 | 281 | 267 | ~267 |
| B-409 | 2 | 408 | 391 | ~393 |
| K-409 | 4 | 409 | 393 | ~393 |
| B-571 | 2 | 571 | 554 | ~555 |
| K-571 | 4 | 555 | 555 | ~555 |
Nine of ten are random-looking. K-163 is not. Its half-point G/2 = ((n+1)/2)·G is
x = 0x3a5da90060df8af5be2121e601ae11f1 (126 bits), y = 161 bits,
a 128-bit-sized x-coordinate on a 163-bit curve, with y full-size as it would be if y had been solved from a chosen x. A single coordinate 37 bits short is a 2⁻³⁷ event; across ~70,000 points on ten curves the expected number of such hits is ≈ 10⁻⁶. This is the first positive structural fact found in any NIST base point since Anthropic’s FreeLIP result.
The natural reading: K-163 is a Koblitz curve (y² + xy = x³ + x² + 1, b fixed), so its generator is the only randomly chosen parameter; the program chose an x of 128 bits (a hash output, or a 128-bit random value), solved for y, and multiplied by the cofactor h = 2 to land in the prime-order subgroup, publishing 2·P as G. The other Koblitz curves (h = 4) show nothing at G/4 or anywhere else in the scanned range, and no B curve does either; so whatever produced K-163’s generator was not used for the rest — or was used with a full-size x.
Not yet done: identifying the 128-bit value. A handful of obvious strings under MD5/SHA-1 do not match (3a5da900… is not MD5 of “”, “K-163”, “sect163k1”, the Solinas phrases, or the B-163 seed). As a 4×32-bit word pattern its top bits are 0,0,1,0, so it is not four lrand48 outputs. This is the concrete target for the base-point search in base-point-brief.md: x(P) is 16 bytes, P = G/2 on K-163 (a.k.a. sect163k1, ansit163k1, the WTLS curve).
Files in this working directory: gen.py (candidates and both roots of b per X9.62), count2.gp (verified point counting), analyze.py / analyze2.py (tables), P-256.orders2 / P-224.orders2 (every verified order), smooth.gp / fac*.gp (n ± 1 factorizations), isog.gp (modular-polynomial root counts), battery.py (full battery per run), ANSI192.orders2 / ANSI239.orders2, pts.gp / pts.out / mult.out (small-x points and base-point multiples).