# CurveSmash: adversarial research controls

**Scope and status (23 October 2026).** This is a sourced research report, not a submission or an attack claim. I inspected the public `Layr-Labs/curvesma.sh` Git repository at [`6423c2728dc03d5f2d647c7f22adf1dac0643a66`](https://github.com/Layr-Labs/curvesma.sh/tree/6423c2728dc03d5f2d647c7f22adf1dac0643a66). An independent `git ls-remote` check found that public `master` and `HEAD` still resolve to that exact commit. **No change to the six repository rule files was found since the requested pin.** The [public Yukon page](https://www.yukon.org/curvesmash) currently presents secp256k1 as paused and displays 146-bit result rows; those dynamic status and result displays do not amend the pinned track rules or qualify the selected repository control. The repository [README](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/README.md) calls the original baselines accounting controls and says they have not been qualified under the current review configuration; its [rescore policy](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/docs/RESCORING.md) requires fresh claims after cost or target changes.

## Rules and evidence boundaries

The common [work model](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/classical-group-work-v2.json) scores one **classical cold attack** by `log2(W)`, requires success probability at least **0.39** over the production distribution and fresh algorithm coins, and reports peak memory separately. `W=H+R/C`, where `H` is the number of charged reference operations and `R` is other scalar **64-bit AArch64 instruction-equivalent** work. Include construction of any advice, all setup and failed trials, random sampling, sorting, lookup, loads and stores, interprocessor coordination, attack-side verification, output, and amplification exactly once. The rounded fixed prices and the distinction between a reference operation and a real implementation are in the [cost model](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/docs/COST_MODEL.md). There is no memory objective and no amortization over later targets.

| Track and protected rule | Production input/output; no altered distribution | Fixed C and relevant published comparator |
| --- | --- | --- |
| [secp256k1 DLOG](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/secp256k1-ecdlp/rules.md) | Uniform `x in [0,r)`, `Q=[x]P`; return `x`; no powers | 1,000; Pollard rho and established automorphism-aware implementations [Pollard](https://www.ams.org/mcom/1978-32-143/S0025-5718-1978-0491431-9/S0025-5718-1978-0491431-9.pdf), [Bos et al.](https://www.iacr.org/archive/pkc2014/83830154/83830154.pdf) |
| [P-256 DLOG](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/p256-ecdlp/rules.md) | Uniform `x in [0,r)`, `Q=[x]P`; return `x`; `a=-3`; no powers | 1,000 **borrowed normalization**, actual P-256 instructions charged; generic rho with valid negation handling [Bos et al.](https://www.joppebos.com/files/negation.pdf) |
| [BLS12-381 ordinary G1 DLOG](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-g1-ecdlp-plain/rules.md) | Uniform `x in [0,r)`, `T=[x]P0`; return `x`; no powers | 2,000; compare curve rho against pairing transfer and finite-field NFS [MOV](https://doi.org/10.1145/103418.103434), [Barbulescu–Duquesne](https://eprint.iacr.org/2017/334.pdf) |
| [BLS12-381 auxiliary powers](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-g1-ecdlp/rules.md) | Uniform nonzero `s`; `T=A1=[s]P0`, `Ai=[s^i]P0`, `1<=i<=n`; return `s`; evaluate **n=2^20** | 2,000; [Cheon](https://www.math.snu.ac.kr/~jhcheon/publications/2006/Eurocrypt_Cheon_LNCS.pdf) |
| [Fixed G1, recover G2](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-fixed-g1-invert-g2/rules.md) | Supplied independently uniform nonidentity `P in G1` and uniform `z in GT`; return `Q in G2` with `e(P,Q)=z`; no powers | 20,000 dense Fp12 multiplication; fixed-argument pairing inversion [Galbraith–Hess–Vercauteren](https://homes.esat.kuleuven.be/~fvercaut/papers/pairing_inversion.pdf) |
| [Fixed G2, recover G1](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-fixed-g2-invert-g1/rules.md) | Supplied independently uniform nonidentity `Q in G2` and uniform `z in GT`; return `P in G1` with `e(P,Q)=z`; no powers | 20,000 dense Fp12 multiplication; [Galbraith–Hess–Vercauteren](https://homes.esat.kuleuven.be/~fvercaut/papers/pairing_inversion.pdf) |

There is **no qualified current baseline** in these six repository tracks; their selected packages for five tracks are templates. Published algorithmic comparators above are not scored CurveSmash bounds. In particular, [Shoup's generic-group lower bound](https://www.shoup.net/papers/dlbounds1.pdf) applies to generic encodings without auxiliary structure, not to a claim using pairings, field arithmetic or supplied powers. Nothing below claims to violate it.

**Attribution key.** `Verified` means a source check or a calculation reproduced here. `Requester observation` means measurements and controls supplied in the brief, with no raw logs available for independent reproduction. `Hypothesis` means a proposed testable claim. `Unknown` means neither the cited literature nor the available measurements establishes it. Runtime estimates below are planning estimates for one M5 Max / 128 GB Mac Studio, not measurements on that machine. Experimental holdout seeds, curves, and thresholds should be committed to the experiment protocol before tuning. No downloaded submission code needs to run.

## Seven materially different directions

### 1. Rebase the selected secp256k1 BSGS claim as a strict negative-result audit

**Mechanism and hypothesis.** Rebuild the selected deterministic baby-step/giant-step ledger with four 64-bit limbs per 256-bit field element, the fixed `C=1000`, and explicit byte movement for two tables. The falsifiable hypothesis is that the published `129.000802` number cannot be a current score, even though BSGS correctness survives. `Verified`: the selected [claim](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/submissions/secp256k1-ecdlp/claim.json) declares protected digests `e4db9d...` and `28e49e...`; hashing the actual pinned target profile and work model bytes gives `18c3338de676f1909715814325bffdb1513f1621d678b942e8a7a9563b8fd086` and `e0edc25a3e8b4a4b116442b2c2eb37f81f4aa0068fb6a1906312b040d5e17294`. Its [proof](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/submissions/secp256k1-ecdlp/proof.md) calls a 256-bit limb one word operation and divides by the retired `78,037,248` price; the current rule fixes 64-bit instructions and `C=1000`. The repository's [rescore policy](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/docs/RESCORING.md) explicitly identifies the retired prices. Purely replacing that divisor gives `log2(53138902757214055580596734746073842102688867536/1000)=145.252677`, **only a unit-change diagnostic**, not a valid new bound: the numerator is not established 64-bit instruction work. `Requester observation`: a separate loose scalar64 memory-bounded control claims at most 251 bits; its source and ledger were not supplied here and it is not an award or competitive baseline.

**Published comparator and novelty.** Shanks-style BSGS is standard; the [Handbook of Applied Cryptography, §3.6](https://cacr.uwaterloo.ca/hac/about/chap3.pdf) gives the generic DLOG methods. Pollard rho and automorphism-aware variants are the stronger relevant published computation comparators for low-memory ECDLP [Pollard](https://www.ams.org/mcom/1978-32-143/S0025-5718-1978-0491431-9/S0025-5718-1978-0491431-9.pdf), [Bos et al.](https://www.iacr.org/archive/pkc2014/83830154/83830154.pdf). This audit has no cryptanalytic novelty; it can rigorously retract an invalid normalization.

**Complete cost test.** Let `m=2^128`, `h=ceil(r/m)`, and charge actual scalar instructions `I` for every component. The proposed claim must satisfy
`W_BSGS=(I_decode+I_setup+m(I_baby_add+I_record_write)+I_sort(m)+h(I_giant_add+I_lookup(m))+I_verify+I_output)/1000`.
Here `I_sort` includes all comparisons and both full-buffer transfers, `I_lookup` includes unsuccessful binary searches, and `I_verify` includes scalar multiplication and equality. Randomness, probabilistic failure, and amplification are zero for a correct exhaustive BSGS; success is exactly one. Peak memory is `2m * actual_record_bytes + code + scratch + retained input`, separately reported. No table or precomputation can be free. A revised 64-bit upper bound is required for all arithmetic; simply multiplying the old numerator by four is unjustified.

**Fatal objection and minimal experiment.** The likely fatal objection to *using* the old score is its unit mismatch, already verified; the objection to the audit is that an alternative tight implementation could still produce a different competitive score. In 1–3 hours, independently parse the pinned files, recompute both SHA-256s and the exact BSGS integer ledger; use a tiny opaque cyclic group for exhaustive coverage, infinity, final partial block, and lookup failures. Hold out two subgroup orders and random targets selected before coding. A positive control is the original proof's arithmetic reproducing its old 129.000802; a negative control deliberately supplies the old C and must be rejected under current rules. **Success:** stale digests and incompatible cost unit are reproduced and the audit labels the score unqualified. **Kill:** any file hash or divisor finding fails on the pinned bytes. Toy runs prove control flow only; they cannot certify a `2^128`-entry table or its 64-bit instruction count.

### 2. Stress-test the 16-adding walk's collision law across field and group regimes

**Mechanism and hypothesis.** The hypothesis worth testing is narrower than “16-adding is new”: a fixed, target-independent 16-bucket walk might retain a lower *total instruction cost to 0.39 success* than a carefully implemented 3-partition walk as subgroup size grows. `Requester observation`: 2,048 successful native small-curve trials and 254 random targets per method/curve after forced boundaries, on fixed 12/16/20/24-bit fields, gave 12.4% fewer mean point calls for 16-adding on the largest subgroup `q=16,770,451`, with setup, retries and verification included. Those are not production trials. [Teske's original r-adding-walk paper](https://citeseerx.ist.psu.edu/document?doi=e97256e6e33f5a2ab34f9288ab4fa62530424244&repid=rep1&type=pdf) already reports substantially better step counts than Pollard's original partition; [van Oorschot–Wiener](https://cr.yp.to/bib/1999/vanoorschot.pdf) handles parallel collision search. Choosing 16 buckets, batching, endomorphisms, and negation are known techniques, not novelty. Any novelty would lie in a reproducible, production-specific cost or collision-law finding.

**Complete cost test and heuristics.** For method `j`, a cold attack with independent trials has
`W_j=[I_table,j + a_j{E[N_step,j](I_add,j+I_partition,j+I_coeff,j+I_distinguished,j+I_transfer,j)+I_restart,j+I_collision_lookup,j+I_verify,j+I_rng,j}+I_output,j]/1000`.
Use measured *total* steps including fruitless cycles, collisions with unusable coefficient differences, and failed walks. `a_j` must be chosen so `1-(1-p_j)^a_j >= .39`, with `p_j` supported for uniform targets and fresh coins; if `p_j` is not known, this formula is not a success proof. Memory includes bucket tables, collision state and code. The sole extrapolation heuristic is that the effective random-map/collision behavior and per-step instruction ratios remain stable at 256 bits. This is especially doubtful for small samples and different field arithmetic. Known negation optimizations require explicit cycle handling [Bos et al.](https://www.joppebos.com/files/negation.pdf).

**Fatal objection and minimal experiment.** The likely fatal objection is that fewer point calls do not imply lower scalar instruction work, and toy collision constants may drift with order and partition correlation. Run 31–40-bit prime-order toy curves (or as large as feasible in 6–12 hours), with two calibration curves and two preregistered holdout curves, at least 256 independent random targets/method/holdout. Keep identical point kernels, target samples, stopping budgets, and collision storage; include a deliberately biased partition as a negative control and a known 3-partition implementation as positive control. On the actual secp256k1 field, separately count scalar instructions for table construction, one step, bucket selection, coefficient update and memory access; do not attempt a 256-bit DLOG. **Success to continue:** the 95% uncertainty interval for total 16-adding instruction work is below the 3-way control on both holdouts, success exceeds .39 at a declared budget, and no unpriced component remains. **Kill:** advantage is only in point-call count, disappears after setup/lookup, or reverses on a holdout. A toy result can test stochastic-walk mechanisms and software accounting; it cannot establish the production collision constant or a new rho asymptotic.

### 3. Search for a *cheap* representation-invariant partition, with the existing Jacobi kernel as a negative control

**Mechanism and hypothesis.** For Jacobian `(X:Y:Z)` representing `x=X/Z²`, `chi(X+cZ²)=chi(x+c)` because a change of representative `(X,Y,Z)->(lambda²X,lambda³Y,lambda Z)` multiplies the argument by the square `lambda²`. Thus a quadratic-character bucket is well defined without affine inversion. The testable hypothesis is that some shared or fewer-character implementation can classify a point with fewer **total** instructions than normalization plus an x-hash while preserving walk quality. This is a possible engineering research question, not a discovered speedup. `Requester observation`: four characters passed 4,096 rescaling cases, 16,384 lockstep steps, bucket-trace positive controls and exception checks; they reduced multiplication calls about 52% yet ran about four times slower on the largest toy curve. A raw noninvariant projective hash solved only 3/30 largest random targets within its fixed budget. On actual secp256k1-field samples, native ARM64 GCC 14.2/GMP 6.2.1 gave median **3.94 μs** for four Jacobi tests versus **0.886 μs** for unbatched normalization and **0.248 μs** at batch 128, over 4,096 valid x values, random nonzero scales and nine rotated rounds, with zero mismatches. These timings are requester measurements, not 64-bit instruction traces. [Bernstein–Lange](https://eprint.iacr.org/2007/286.pdf) supplies the relevant published coordinate-cost context; established batch inversion is a control, not novelty.

**Complete cost test and heuristics.** For partition design `v`, charge
`W_v=[I_precompute,v+a_v{N_v(I_point,v+I_bucket,v+I_coeff,v+I_cycle,v+I_lookup,v+I_memory,v)+I_retries,v+I_rng,v+I_verify,v}+I_output,v]/1000`,
with `a_v` justified to attain .39 success as in direction 2. The comparison must use the same curve arithmetic, collision representation and memory policy; count batch fill/drain and exceptions. Peak memory includes any per-batch arrays. The hypotheses are that the new bucket preserves sufficient mixing and that a cheaper *instruction* kernel exists; multiplication count alone supports neither.

**Fatal objection and minimal experiment.** The most likely fatal objection is already suggested by the production-field timing: Jacobi/GCD work dominates saved multiplications. In 2–4 hours on the M5 Max, implement only the partition kernels for fixed valid secp256k1 points and random projective scales, comparing 1, 2 and 4 shared-character candidates against normalized-x hashing at batch sizes 1/32/128. Reserve half the x values and all seeds for a blind holdout; include `Z=0`, zero arguments, and rescaled equivalent points as edge controls. Record compiler disassembly or analytical scalar instruction counts as well as time; compare bucket traces against an affine oracle. **Success to continue:** a candidate is invariant and strictly cheaper than the best normalization control in instruction equivalents on the holdout, including batching and exceptions. **Kill:** any scale mismatch, material walk bias, or cost at least the control. This test transfers the field-kernel cost more directly than toy curves; it still says nothing about 256-bit DLOG success until walk statistics and the full ledger pass direction 2.

### 4. Audit fixed-argument pairing inversion for “any-pair” and final-exponentiation shortcuts

**Mechanism and hypothesis.** Write `g=e(P0,Q0)` and let an instance supply `P=[b]P0`, `z=g^a`, with unknown `b!=0` and `a`. A valid G2 answer is `[a/b]Q0`. For the reverse orientation, supplied `Q=[b]Q0` requires `[a/b]P0`. A claimed method that finds *some* pair with pairing `z`, or replaces the supplied argument by a generator, has not inverted the fixed map. A second false-premise candidate is to take an arbitrary preimage under final exponentiation and invert a Miller expression: the exponentiation map has a large kernel, and the arbitrary lift need not be in the image of the supplied fixed-argument Miller map on the required subgroup. [Galbraith–Hess–Vercauteren](https://homes.esat.kuleuven.be/~fvercaut/papers/pairing_inversion.pdf) defines FAPI-1/FAPI-2 and analyzes these obstacles. The strongest relevant published comparison route is target-group DLOG by finite-field algorithms [Barbulescu–Duquesne](https://eprint.iacr.org/2017/334.pdf), although no full CurveSmash-normalized bound is known here. This route is a claim audit, not a new inversion algorithm. The repository [fixed-G1](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-fixed-g1-invert-g2/target-profile.json) and [fixed-G2](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-fixed-g2-invert-g1/target-profile.json) profiles fix the exact per-instance argument and canonical subgroup checks.

**Complete cost test and heuristics.** For either orientation, a GT-DLOG comparator computes `u=e(P,Q0)` or `e(P0,Q)` and `c=log_u(z)`, then returns `[c]Q0` or `[c]P0`. Charge
`W_FAPI=[I_decode+I_pair+I_GTpre+I_GTrelations+I_GTlinear+I_GTdescent+I_GTsearch+I_scalar_mul+I_pair_verify+I_lookup+I_transfer+I_rng+I_failed+I_output]/20000`.
Zero terms need an explicit reason; a plain GT rho comparator has zero NFS relation/linear/descent terms but pays its full GT search. If a proposed direct algebraic method is substituted, price every field factorization, root selection, subgroup test and pairing verification in the same ledger. Peak memory includes any precomputed finite-field tables and retained roots. The GT-DLOG path is exact if completed; an unproved probability of a random Miller lift landing on a valid point cannot establish .39 success. The identity target occurs with probability only `1/r` under these rules.

**Fatal objection and minimal experiment.** The fatal objection to a shortcut is failure on the *supplied* argument, or output outside the specified subgroup; to this audit, a genuinely new direct algebraic method could pass all tests and require separate analysis. In 2–4 hours, build an algebraic tiny-pairing oracle `e(g1^u,g2^v)=ζ^(uv)` with hidden test scalars. Test both orientations over random nonzero `b` and random `a`, while positive controls use `a/b` and negative controls return an any-pair answer, a substituted generator, or a scalar. Hold out half the `(a,b)` pairs and all identity targets from development. Separately enumerate final-exponent preimages in a small finite-field multiplicative group to expose nonuniqueness; a proposed lift-to-point rule must then be proved for its actual Miller map and tested against BLS12-381 subgroup and pairing equality on small batches, without executing a DLOG. **Success:** the control rejects every wrong-orientation/wrong-argument answer and locates a precise unproved implication. **Kill:** an asserted counterexample fails to reproduce. Tiny pairings expose quantifier errors; they do not predict direct-inversion complexity on BLS12-381.

### 5. Challenge the “pairing transfer is free” premise for ordinary BLS G1 DLOG

**Mechanism and hypothesis.** The ordinary G1 target gives only `T=[x]P0`. Pairing with public `Q0` transfers it to `e(T,Q0)=g^x`, so a finite-field DLOG returns the scalar. This is the [MOV reduction](https://doi.org/10.1145/103418.103434), and number-field-sieve variants are the relevant published finite-field competitor, not an invented G1 attack [Barbulescu–Duquesne](https://eprint.iacr.org/2017/334.pdf). The falsifiable hypothesis is whether a *fully cold, scalar-instruction* NFS or related GT attack can beat a fully priced curve-side rho under **C=2000**, once polynomial selection, relation collection, linear algebra, individual descent and verification are included. The literature's security estimates are not a CurveSmash instruction trace or qualified score. It remains **unknown** which is lower in this exact metric without a complete implementation-specific ledger.

**Complete cost test and heuristics.** Require
`W_plain=[I_pair(T,Q0)+I_pair(P0,Q0)+I_polyselect+I_sieve+I_filter+I_linear+I_descent+I_GTverify+I_G1verify+I_access+I_transfer+I_rng+I_failed+I_output]/2000`.
If a GT generator pairing can be derived from a public profile constant, explain and price it; no cached log database is free. The alternative curve-rho ledger is direction 2 with BLS G1 instructions and `C=2000`. Peak NFS memory includes factor bases, relations, matrices and scratch. Heuristic assumptions concern smoothness rates, relation independence, matrix dimensions, and descent success; each must be stated at BLS12-381 parameters, not inferred from a tiny field.

**Fatal objection and minimal experiment.** The likely fatal objection is uncharged, cross-target precomputation or an unjustified NFS constant. In 3–6 hours, make a stage-by-stage cost notebook from a published NFS parameter set, with explicit 64-bit limb kernels and bytes moved. Use two deliberately independent input targets: one for calibration, one hidden until formulas are frozen; compare a zero-precomputation control (which must fail the ledger) and a conventional rho ledger. Check the paired DLOG equality on a small BLS subgroup or a simple bilinear toy, but do not claim a full NFS run. **Success:** every stage has a reproducible bound, success argument, and sensitivity range that still wins against the curve comparator. **Kill:** any unpriced stage, amortized database, or parameter sensitivity large enough to reverse the comparison. Toy transfer validates algebra only; no toy smoothness measurement establishes production NFS cost.

### 6. Audit Cheon's exact auxiliary-power preconditions and input-access costs

**Mechanism and hypothesis.** In the one auxiliary-powers track, `d=2^20` divides `r-1` (`Verified`: integer remainder zero from the pinned subgroup order), and `A_d` is present exactly at scoring `n=2^20`. [Cheon's original theorem](https://www.math.snu.ac.kr/~jhcheon/publications/2006/Eurocrypt_Cheon_LNCS.pdf) gives an algorithm using `g,g^s,g^(s^d)` when `d | r-1`, with group-work order roughly `O(log r (sqrt((r-1)/d)+sqrt(d)))`, subject to its stated model and memory. Its leading first square-root scale is about `2^117.5` for this track. This is an already published algorithm, not novelty. The research question is whether a proposed *concrete* schedule and 64-bit ledger at `n=2^20` is internally valid and favorable once reading/decoding the selected powers and failure paths are counted. For `n<d`, that Cheon construction is unavailable without a separately justified fallback; no other track supplies these powers.

**Complete cost test and heuristics.** A compliant claim states `W(n)` and its domain. For `n>=d`, require
`W_Cheon(n)=H_stage1(n)+H_stage2(n)+[I_read(A1,Ad)+I_decode+I_bases+I_precompute+I_bucket+I_sort+I_lookup+I_transfer+I_rng+I_failed+I_verify+I_output]/2000`.
The `H` terms include *every* actual G1 reference addition in both discrete-log stages, including unsuccessful searches and restarts. Extra G1 arithmetic unlike the 6M reference is charged in `I`, not hidden in `H`; do not double count. State peak table, input-buffer and code bytes. Supplied `Ai` generation is organizer work and excluded, while attack-side access is charged. A complete deterministic exhaustive schedule may have success one for all nonzero `s`; a truncated stochastic variant needs a supported `>=.39` probability, not just the asymptotic theorem.

**Fatal objection and minimal experiment.** The most likely fatal objection is choosing a convenient `d` absent from the sequence, using the `r+1` case without its needed inputs, or dropping one discrete-log stage. In 2–5 hours, independently verify divisor arithmetic and index `A[d-1]`, then implement the exact proposed stage decomposition on two small prime-order opaque groups: one with `d|r-1` and one where this precondition fails. Precommit random nonzero `s` holdouts and boundary values `s=1,r-1`; include a negative control that swaps `A_d` for an unrelated point. **Success:** recovered `s` verifies against `A1` on every exhaustive small instance, both stage counts and access costs match the ledger, and the invalid-condition control is rejected. **Kill:** wrong `n`, uncharged second stage, invalid divisor, or probability below .39 at the claimed budget. Toy algebra can validate the reduction and accounting shape; it cannot supply BLS G1 instruction costs or prove the production heuristic constant.

### 7. Block secp256k1 endomorphism and formula imports into P-256

**Mechanism and hypothesis.** An easy but subtle false premise is to apply a secp256k1 `j=0` cube-root map `(x,y)->(βx,y)` to P-256 and credit its orbit speedup or its point-add cost. For a curve `y²=x³+ax+b` with `β³=1`, the transformed curve equation changes by `a(β-1)x`; since P-256 has `a=-3`, the map is generally **not** a P-256 automorphism. This is a direct algebraic obstruction, not a conjecture. [SEC 2](https://www.secg.org/sec2-v2.pdf) and the pinned [P-256 profile](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/p256-ecdlp/target-profile.json) give the parameters. The relevant comparator is ordinary rho with valid negation handling [Bos et al.](https://www.joppebos.com/files/negation.pdf); [GLV's original paper](https://www.iacr.org/archive/crypto2001/21390189.pdf) applies to curves with a proven efficient endomorphism. Neither known batching nor an endomorphism on another curve is a new P-256 attack.

**Complete cost test and heuristics.** For an actual P-256 walk, require
`W_P256=[I_curve_setup+I_walk_add+I_P256_partition+I_coeff+I_precompute+I_collision_lookup+I_transfer+I_rng+I_failed+I_verify+I_output]/1000`,
where `I_walk_add` is the sum of **actual P-256** point-operation instructions over all walks and retries. The secp256k1 6M unit is only the denominator, not a free P-256 addition. Memory includes tables, state and code. A claimed automorphism must exhibit a map on the exact P-256 group, its eigenvalue, canonicalization cost, cycle handling and proof of preserved curve membership. The hypothesis that a secp map works is false by the displayed equation; the broader possibility of another efficient map is not ruled out here.

**Fatal objection and minimal experiment.** The fatal objection to a transplanted map is that it does not map generic P-256 points to P-256. In under 1 hour, verify the symbolic equation and check the generator plus 1,024 seeded multiples against the P-256 on-curve test, with a valid P-256 negation map as positive control and the secp cube-root map as negative control. Hold out 256 multiples until the code is frozen. For any surviving *different* map, require both on-curve and `[lambda]P` equality on holdouts, then price its instructions against the ordinary P-256 rho ledger. **Success:** the symbolic argument and negative-control failures agree. **Kill:** the symbolic derivation is wrong or the candidate exhibits a valid, priced P-256 map. Toy curves with `a=0` are actively misleading for this question; the obstruction and the kernel test use the production P-256 parameters directly.

## Priority and first day

| Rank | Direction | Evidence now | Expected information gain / cheap falsifiability |
| --- | --- | --- | --- |
| **1** | BSGS rebasing, direction 1 | Direct pinned-byte hashes and incompatible divisor/word size reproduced | Decisive current-claim audit in hours; gives a rigorous negative result even if no attack emerges |
| **2** | Invariant partition economics, direction 3 | Strong requester timing and correctness controls, but no independent instruction trace | One short ARM64 kernel comparison can reject or rescue the only plausible saved-arithmetic mechanism |
| **3** | Fixed-argument pairing inversion, direction 4 | Exact published FAPI distinction and pinned input quantifiers | Tiny exhaustive controls cheaply expose wrong-argument and lift-to-point errors across two tracks |

Cheon precondition and P-256 algebra are also cheap, but primarily guard known facts. The NFS comparison has high potential information value and a larger uncertainty budget; the rho holdout study is longer and mostly calibrates a known method. Rank is by present evidence, information gain, and speed of falsification, **not** by excitement or a promised bit reduction.

**First experiment (hours 0–2):** reproduce direction 1 from the pinned bytes in a clean read-only script: SHA-256 of the protected profile/model, exact old ledger sum and divisor, four-64-bit-limb substitution plan, and tiny exhaustive BSGS correctness tests. Freeze the output and its input hashes before any new score is discussed. Explicit rejection criterion: if hashes and divisor do not match the values above, retract this report's verified finding; otherwise reject the `129.000802` claim as a current qualified comparator. Do **not** promote `145.252677` to a score without a new 64-bit ledger and fresh review.

**Concrete first 24 hours:** hours 0–2 run the first experiment; hours 2–6 inspect and price all BSGS primitive operations and table transfers under scalar64; hours 6–10 reproduce the four-character and batch-normalization kernels on ARM64 with a blind holdout and instruction accounting; hours 10–14 run both fixed-argument FAPI tiny-pairing controls and record the exact failed implication in any shortcut; hours 14–18 verify Cheon divisor/index and P-256 automorphism controls; hours 18–24 freeze protocols and budgets for the 31–40-bit rho holdouts and the ordinary-BLS transfer ledger. If the first three ranked routes fail their stated continuation gates, publish a **negative audit with exact counterexamples and cost corrections**, not an attack score. No production distribution, target, reference constant or auxiliary-input rule should change.

**Unanswered questions.** No native scalar AArch64 trace was supplied for a full candidate walk or pairing attack. No production ECDLP, FAPI inversion, NFS computation, official submission or awarded score was independently reproduced here. The requester's toy and microbenchmark observations remain observations until logs and code are reviewed. Current public page rows may represent external review state; their underlying claims were not audited in this report. A toy success, a wall-time microbenchmark, or a passing package test cannot by itself establish a `>=.39` full-production success probability or a normalized cold-work bound.