Nib's open cases

We started by redoing the counting. For every 20-byte candidate in the four runs that produced more than one acceptable curve, about 18,000 of them, we built the curve with the X9.62 recipe and counted its points with PARI/GP, free mathematics software that does in seconds what was a research-grade computation in 1997.

Which square root. The recipe in Chapter 3 needs a b with b² × c = −27, and there are always two: b and its negative. For clocks whose size p leaves remainder 3 when divided by 4, those give twin curves with different numbers of points. The standard lets you pick either, but its own square-root algorithm returns one particular root, (−27/c)^(p+1)/4, and all nine published curves of that kind use it. Valsorda had already noted this in the code he wrote to check the solve; our recount confirms it independently. It matters because several candidates make prime-order curves only with the other root (in P-256's run: candidates 81, 276, 1049 and 1383), and the program would never have seen them.

With that rule plus Valsorda's bit-length rule, our recount reproduces his lists of acceptable candidates exactly, for all four runs that produced more than one acceptable curve (prime239, P-192, P-256 and P-224). That gives us a solid footing, and it leaves the real puzzle untouched: why were some acceptable curves still skipped?

In 1997, counting the points on a curve was hard, and the leading method (called SEA, after Schoof, Elkies and Atkin) works prime by prime. Small primes come in two flavors for each curve, "Elkies" and "Atkin", and Elkies primes make the job much easier. A tempting idea: maybe the 1997 software gave up on curves where a key step failed, so the skipped curves were simply the ones it couldn't finish.

We checked which small primes are Elkies primes for each acceptable curve. On the first two runs we finished (P-192 and P-256, seven curves), one prime split them perfectly: every published curve had 5 as an Elkies prime, and every skipped curve didn't. Seven for seven.

That looked thrilling. But we had looked at sixteen primes to find it, and with that many tries, a perfect split of seven curves turns up by luck more often than you'd think. So before the other runs finished, we wrote the hypothesis down, committed it to the site's repository with a timestamp, and set a pass mark: it had to classify at least 13 of the 14 remaining curves correctly. Then the prime239 run came in, and it got 4 of 8. Dead. (The P-224 run, which finished later, added 2 of 4: P-224 itself fails the rule. A coin flip, in other words.)

Try it yourself below. Pick any prime, and see how well "Elkies at this prime means published" does on the first two runs (where we went looking) versus the rest (which we held back).

That's overfitting, in miniature. Search enough rules and one will fit a small sample perfectly; the only cure is data the rule hasn't seen. If you work in a field that validates models (finance, medicine, AI), you'll recognize the drill: hold-out sample, decision rule fixed in advance, accept the answer. We also checked a few other properties (whether the count is above or below p, how the "twin" curve's count factors), and none separated published from skipped. The skips remain unexplained. Valsorda's two guesses still stand: the generator may have been consumed by some other step in irregular ways, or a bug in a 1997 calculation may have rejected good curves at random.

Anthropic's scanner tried 34 combinations of generator and output slice on B-163 and found nothing. We tried a few more: whole 32-bit outputs (the mrand48 slice, which a top bit of 1 would fit), the bytes of each word reversed, the words in reverse order, and the one-byte slice from Chapter 7 run through the lattice. None fit. B-163 looks like it was made some other way, perhaps by a different program, perhaps earlier, perhaps by hand. Status: open.

Anthropic published the FreeLIP recipe that reproduces six base points. We rewrote it as a search: for every FreeLIP seed from 0 up to about a million, draw 64 random pieces and test every window of them, in both orders, against the published x and y of P-224, P-256, P-384 and P-521. That covers any number of discarded draws and tries. The search does find P-192's base point at seed 20000, as it should. For the four unexplained curves: no match. Whatever made those base points, it wasn't this recipe with a small seed. Status: open.

Every open case here is a real research question with checkable answers. If you crack one, the proof will look like everything else in this case file: a recipe anyone can rerun that produces the published numbers bit for bit. Filippo Valsorda and the Anthropic team are the people to tell.

And if the past is any guide, the next clue will come from asking a different question than everyone before you. Twenty-five years of people looked for a forgotten sentence. The answer was a clock.