# CurveSmash: synthesis of three research reports, ranked directions and first-24-hour plan

Snapshot: 23 October 2026. This is a research report only. It is not a submission, a score or an attack. No downloaded submission code was run, nothing was published, and nothing was submitted to Yukon.

Inputs read as data: `prior-art.md` (SHA-256 `cb7a60a9…`), `mechanisms.md` (`31f7eaa4…`) and `adversarial.md` (`57fe9f19…`). Below they are called **[PA]**, **[ME]** and **[AD]**.

## 0. Evidence key and what I checked myself

| Label | Meaning |
|---|---|
| **Fact (source)** | Stated in a primary paper or the pinned challenge files, with a link. |
| **Checked here** | I recomputed or re-fetched it for this report (listed below). |
| **Input claim** | Asserted by one of [PA]/[ME]/[AD]. I did not re-verify it here. |
| **Requester measurement** | Supplied in the brief, with no raw logs. Not reproduced by anyone. |
| **Inference / Hypothesis** | My reasoning or a testable claim. Not a result. |

What I checked here on 23 Oct 2026:

- **Repository pin.** WebFetch of the [GitHub commit list](https://github.com/Layr-Labs/curvesma.sh/commits) shows `master`'s newest commit is `6423c2728dc03d5f2d647c7f22adf1dac0643a66` ("Merge pull request #151 …OIDC permissions"). **No commit exists after the requested pin, so the rules have not changed since it.** Direct `git`/`curl` access was blocked by this machine's proxy, so I could not re-hash files myself.
- **Live page.** WebFetch of the [Yukon CurveSmash page](https://www.yukon.org/curvesmash) shows:
  - harness pin `Layr-Labs/curvesma.sh @ 6423c27`;
  - secp256k1 "open · Published computation", with the other five tracks "Loading registration…";
  - secp256k1 rows from **127.08 ("current record")** through 129, 135.75, 136.25–136.70, 138.2–138.25, 145 and 146;
  - every result labelled **"Awaiting review"**;
  - rule text: "Preprocessing and failed attempts count", "Memory is reported separately… does not affect ranking", "Acceptance after exploratory AI review is not mathematical proof", and "Actual P-256 arithmetic is charged by its instruction cost… borrowed secp256k1 normalization (1,000 instruction equivalents)."
- **Pinned secp rules.** WebFetch of the [pinned secp256k1 rules](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/secp256k1-ecdlp/rules.md) quotes: "Algorithmic success must be at least 0.39 over uniform full-production challenges and fresh algorithm coins"; "Sum work across processors; do not amortize over future targets or assume free oracles/advice"; and "Memory, preprocessing and advice must be stated and justified but do not create extra objectives or tie-breaks." The fetched text gives no C value. C=1000 comes from the cost model as cited by [PA]/[AD], and the live page's "1,000 instruction equivalents" agrees with it.
- **Integer checks (Python, exact integers on the BLS12-381 and secp256k1/P-256 constants):**
  - BLS12-381 scalar order `r = x^4 − x^2 + 1` with `x = −0xd201000000010000` (confirmed).
  - `log2 r = 254.85709`, `v2(r−1) = 32`, so `2^20 | r−1` and `(log2 r − 20)/2 = 117.42854`.
  - `E = (p^12−1)/r` has `gcd(E,r) = 1` and `log2 E = 4313.55097`.
  - The G1 cofactor `(x−1)^2/3` is odd.
  - **`p^6 ≡ −1 (mod r)`, and the multiplicative order of `p mod r` is exactly 12.**
  - The 0.39-quantile birthday scale `0.994·sqrt(N)` gives `log2` values of:
    - 126.699 for secp256k1 with `N = r/6`;
    - 127.491 for P-256 with `N = r/2`;
    - 126.127 for BLS G1 with `N = r/6`;
    - 127.420 for BLS G1 with `N = r`;
    - **125.627 for GT with `N = r/12`**.
  - The Cheon two-stage term `log2(2·sqrt((r−1)/2^20)) = 118.43`.
  - The reference calibrations multiply out as 6×179 = 1074 (secp) and 6×383 = 2298 (BLS), rounded to C = 1000 and C = 2000.

## 1. Contradictions between the inputs, resolved

1. **Live leaderboard state.**
   - [AD] says secp256k1 is "paused" and shows 146-bit rows.
   - [PA] says 127.08, with contradictory "reviewed"/"Awaiting review" labels.
   - [ME] could only see an indexed extract, with two entries at 146 (it got HTTP 403).
   - **Resolution (checked here):** at my fetch the track is "open", 14 rows run from 127.08 to 146, and all are "Awaiting review". [AD]'s "paused" was either a transient state or a misreading. Either way the page is dynamic and **none of these numbers is an accepted score**.
   - The important consequence, missed by [AD] and [ME]: **the best displayed secp256k1 number (127.08) is already close to the cost of a known automorphism-aware rho** (see Direction 1). Any "new direction" for secp256k1 has to be judged against roughly 2^127, not against 2^129 or 2^146 controls.
2. **Rule changes since the pin.** All three inputs say there are none, and this check agrees: HEAD = pin. The retired prices 78,037,248 and 45,839,872 are historical and retired *at* the pin ([RESCORING](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/docs/RESCORING.md)). They are not changes after the pin.
3. **Old BSGS control.** [PA] and [AD] independently report the same stale-digest values (`18c3338d…`, `e0edc25a…`), and both reject the 256-bit-word and 78,037,248-divisor accounting.
   - This is an **input claim that agrees across two reports and matches requester observation (1)**. I could not re-hash it here because the network was blocked.
   - [AD] ranks re-auditing it first. I demote that: it is already settled to the depth that matters. It invalidates a control nobody should compare against, and BSGS (about 2^129+) is not competitive with the 127.08 rows. Reproducing it is a 30-minute task inside Direction 1, not a direction in its own right.
4. **P-256 endomorphisms.** [AD] says another efficient map is "not ruled out here". [PA]/[ME] say only that the secp map does not transfer.
   - **Stronger fact:** `j = 1728·4a³/(4a³+27b²)`. With `a = −3 ≠ 0` and `b ≠ 0`, `j ∉ {0, 1728}`, so `Aut(E) = {±1}` over any field of characteristic > 3 (standard; [Silverman, AEC III.10](https://link.springer.com/book/10.1007/978-0-387-09494-6)).
   - So P-256 rho gets negation only (the 0.39 scale is about 2^127.49 steps). Any non-automorphism endomorphism would have to have small norm in an order of very large discriminant. That is an inference, not proved here, and it is not a research direction.
5. **Montgomery/x-only transfer ([ME] D5).** Checked here: all three curve groups have odd order (secp256k1 and P-256 have prime order, and the BLS G1 cofactor is odd), so there is no rational 2-torsion and no Montgomery model. [ME] is correct on that point. But D5 is **rejected** as a direction. Memory-bounded BSGS needs about 2^224 giant steps, and full BSGS is beaten by rho at equal arithmetic cost. x-only arithmetic is known ([Costello–Smith](https://arxiv.org/abs/1703.01863)).
6. **Cheon exponent.** [AD] says "about 2^117.5". [PA]/[ME] say 117.4285. These are the same quantity rounded differently (checked here). All three correctly refuse to call it a score.
7. **Citation details.**
   - The r-adding-walk baseline is [Teske, Math. Comp. 70 (2001)](https://www.ams.org/mcom/2001-70-234/S0025-5718-00-01213-8/S0025-5718-00-01213-8.pdf). [AD]'s CiteSeerX link is a secondary mirror.
   - The negation-map baselines are [Bos–Kleinjung–Lenstra, ANTS 2010](https://www.joppebos.com/files/negation.pdf) and [Bernstein–Lange–Schwabe 2011](https://eprint.iacr.org/2011/003). Both are real and complementary.
   - The 2012/609 auxiliary-input polynomial paper's author order is given as "Cheon–Kim" ([PA]) and "Kim–Cheon" ([ME]). I believe the published order is T. Kim, J. H. Cheon, but this is **unverified here**; cite it via the [ePrint record](https://eprint.iacr.org/2012/609).
   - The Kutsuma–Matsuo fixed-base-table Cheon refinement is cited only by [ME] ([SCIS 2007](https://kazutomatsuo.github.io/publications/pdf/scis07_4A1-2.pdf)) and was not opened here.

## 2. Proposals rejected or folded in

| Proposal (source) | Decision | Reason |
|---|---|---|
| 4-character Jacobi partition (requester (3)/(4)) | **Killed** for this implementation | Requester measurement: 3.94 µs vs 0.248 µs batched normalisation is a large wall-time loss. A cheaper invariant 1-character variant stays only as a sub-check in Direction 6. |
| Raw projective hash | **Killed** | Not representation-invariant. The walk becomes a different process (requester: 3/30). |
| Old BSGS rebase ([AD] 1, [PA] A, [ME] D6) | **Folded into Direction 1** | Already reproduced by two inputs. Low information gain. |
| Differential x-only BSGS ([ME] D5) | **Rejected** | Known method. Memory-bounded variant needs about 2^224 steps. Cannot beat rho. |
| secp endomorphism on P-256 ([AD] 7) | **Closed fact** | j-invariant argument, §1.4. |
| Polynomial-image compression on powers ([PA] B) | **Folded into Direction 2** as a short certificate | `η_f ≤ d/(r−1)` caps it at the Cheon exponent. Cheon–Kim prior art covers it. |
| "Pairing transfer is free" ([AD] 5) | Merged into Direction 5 | Same as [PA] C / [ME] D2. |

## 3. Seven directions

Notation: `I_*` means scalar 64-bit AArch64 instruction-equivalents, including loads, stores, address arithmetic, carries and control flow. `W = I_total / C`, with C = 1000 (secp256k1, P-256), 2000 (both BLS G1 tracks) or 20000 (both pairing-inversion tracks). The score is `log2 W`. Every equation includes cold preprocessing, all failed or censored attempts, attack-side randomness, verification, lookups and memory transfers, each charged once. Memory `M_peak` is reported separately and is not scored. The success requirement is `Pr[correct x within the declared cap] ≥ 0.39` over the unchanged production distribution and fresh coins. A 0.39 *quantile* of the birthday model is `≈ 0.994·sqrt(N)` collision-steps. This is a heuristic, and it is distinct from the mean `≈ 1.2533·sqrt(N)`.

### Direction 1 — Instruction floor and ceiling for automorphism-quotient rho on secp256k1, reconciled with the displayed 127.08

**Mechanism and hypothesis.** Parallel rho with distinguished points ([van Oorschot–Wiener](https://cr.yp.to/bib/1999/vanoorschot.pdf)) works on classes under `⟨−1, φ⟩`, where `φ(x,y) = (βx, y)` has order 3. The classes have size 6, so `N = r/6`.

- **Checked here:** the 0.39 quantile is ≈ 2^126.70 steps.
- **Inference:** at a displayed 2^127.08, the implied total budget is ≈ 2^0.38 ≈ **1.30 normalised units ≈ 1,300 scalar instructions per walk step**, *including* everything amortised: distinguished-point storage and lookup, fruitless-cycle escape, re-walks to recover coefficients, and verification.
- One step needs a batched affine addition (≈ 5–6 field M/S plus a 1/b share of an inversion and the batch overhead), a canonical class representative (≈ 2 M to form βx and β²x, compares, and a conditional negation), a partition-table load, a distinguished-point test, and cycle detection.

**Falsifiable hypothesis H1:** a provable per-step *floor* (minimum scalar instructions for those operations with the best known 4-limb secp256k1 reduction), times the 0.39-quantile step count, plus a fruitless-cycle overhead lower bound, either:

- (a) exceeds 2^127.08 × 1000 — the displayed number is then unattainable by this method family as described, which is a concrete claim-audit finding; or
- (b) sits below it — 127.08 is then consistent with known rho, and it becomes **the bar every secp256k1 idea must beat**.

**Published baseline.**
- Pollard rho ([Pollard 1978](https://www.ams.org/mcom/1978-32-143/S0025-5718-1978-0491431-9/S0025-5718-1978-0491431-9.pdf)).
- Automorphism speedups ([Duursma–Gaudry–Morain, ASIACRYPT 1999](https://doi.org/10.1007/978-3-540-48000-6_10)).
- Negation and fruitless cycles ([Bos–Kleinjung–Lenstra](https://www.joppebos.com/files/negation.pdf), [Bernstein–Lange–Schwabe](https://eprint.iacr.org/2011/003)).
- Practical automorphism-aware analysis ([Bos–Costello–Miele, PKC 2014](https://www.iacr.org/archive/pkc2014/83830154/83830154.pdf)).
- The pinned [cost model](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/docs/COST_MODEL.md): 179 instructions per reference multiply, which is a calibration, not a floor.

**Novelty:** none algorithmically. The value is a falsifiable cost reconciliation that sets the real target.

**Cost equation.**

`W = [I_table + I_rng·w + Σ_steps (I_add + I_batchinv/b + I_canon + I_part + I_DP + I_cycle) + I_DPstore·D + I_DPlookup·D + I_rewalk + I_verify + I_out] / 1000`

- `w` is the number of walks and `D ≈ steps·θ` is the number of distinguished points stored.
- The step count is the declared 0.39-success cap, not the mean.

Heuristic assumptions:
- the class walk behaves like a random map on `r/6` classes, so the birthday quantile applies to useful collisions;
- fruitless cycles are handled at a measured rate;
- degenerate collisions (coefficient difference ≡ 0 mod r) are negligible but counted.

**Most likely fatal objection.** The floor/ceiling gap may be too wide (for example 0.8–1.6 units per step) to separate (a) from (b). The 127.08 dossier is also not visible, so only the method family can be audited, not the specific claim.

**Minimal experiment (M5 Max 128 GB, ~6–8 h).**
- Write scalar C kernels with SIMD disabled (`-fno-vectorize`, inspected assembly) for: secp256k1 4-limb mul and sqr with special reduction; batched affine add at b = 32/128/512; canonicalisation; and a 16- or 32-entry r-adding partition.
- Count instructions statically from the disassembly per straight-line block, plus loop counts. Report wall time only as secondary evidence.
- Controls: the libsecp256k1 field mul at the pinned [commit](https://github.com/bitcoin-core/secp256k1/blob/e74a0187aac1cac734d5ad23ca5e40ceb6ddd4a8/src/group_impl.h) as an inspected library, not submission code; and a deliberately "free canonicalisation" ledger, which must be flagged as incomplete.
- Correctness: 4096 development and 4096 holdout random points, compared against an affine oracle; forced inputs P = ±Q, P = O and φ-orbit equality.
- In parallel, measure fruitless-cycle and useful-collision rates for the 6-class walk on 40–48-bit j = 0 prime-order toy curves, with 2 calibration curves and 2 held-out curves and ≥ 1024 targets per held-out curve.

**Success / kill.**
- Report (a) if the floor is above 2^127.08·1000/(0.39-quantile steps) by more than the cycle-rate uncertainty.
- Report (b) if a working kernel at or below the implied 1,300 instructions per step exists.
- Kill the floor claim if any held-out trace undercuts it.

**Transfer.** Production-field kernel counts transfer directly, because they are measured on the actual field. Toy cycle and collision rates transfer only under the random-map heuristic. They need cross-checking at 2–3 bit sizes for drift.

### Direction 2 — A complete cold Cheon ledger for the powers track at n = 2^20, the first serious number for that track

**Mechanism and hypothesis.** The facts:
- Checked here: `2^20 | r−1`, and `A_{2^20}` is supplied at the scoring point.
- Fact ([Cheon 2006](https://www.math.snu.ac.kr/~jhcheon/publications/2006/Eurocrypt_Cheon_LNCS.pdf), [Cheon 2010 JoC](https://www.math.snu.ac.kr/~jhcheon/publications/2010/StrongDH_JoC_Final2.pdf)): Cheon's r−1 algorithm needs `O(sqrt((r−1)/d) + sqrt(d))` encoded exponentiations.
- With d = 2^20 the dominant search is ≈ 2·2^117.43 = 2^118.43 table and comparison entries.
- **Key accounting point (inference):** memory is unscored, so a fixed-base digit table (Kutsuma–Matsuo style; [ME]) costs about 4·2^64 additions per base to build, which is negligible beside 2^118. Each "exponentiation" then becomes ≤ 4 table loads plus ≤ 3 additions.

**Hypothesis H2:** a deterministic two-stage BSGS-Cheon with digit tables reaches **log2 W ≈ 120 ± 1** at n = 2^20. It is then below every generic G1 baseline (≈ 126.1 + step overhead with the 6-fold quotient) by ≈ 6 bits. A low-memory, rho-style Cheon variant (Cheon 2010 §space-efficient) must be costed separately.

**Baseline / novelty.** Published: Cheon, Brown–Gallant, and the [Kim–Cheon polynomial approach](https://eprint.iacr.org/2012/609). Not novel. The novelty is a reproducible, scored-unit ledger that no track entry currently has: the live page shows "—" for all five non-secp tracks.

- **Fiber bound (certificate, not new):** `η_f ≤ d/(r−1)` for any degree-d map, so polynomial-image tricks cannot beat the Cheon exponent at d ≤ n.

**Cost equation.**

`W(n=2^20) = [I_read(P0, A1, A_d) + I_decode/subgroup + I_digit_tables(3 bases: P0, A_d, A1) + Σ_{stage1: 2⌈sqrt(h)⌉} (≤4 loads + ≤3 adds + I_canon) + I_sort/hash(⌈sqrt h⌉ records) + ⌈sqrt h⌉·I_lookup + Σ_{stage2: 2⌈sqrt d⌉} (…) + I_scalar_arith_mod_r + I_verify([s]P0 = A1) + I_out] / 2000`

- `h = (r−1)/2^20`.
- Additions may be charged as H reference units only if they really are batched affine 6M operations. Otherwise charge `I/2000`, and never both.
- Success is 1 for every nonzero s, because the schedule is exhaustive and deterministic.
- `M_peak` is ≈ (2^117.4 records × ~48 B) plus 3·4·2^64 points — astronomical, but unscored.
- Also state `W(n)` for `n < 2^20` using the largest power-of-two `d ≤ n` dividing r−1.

**Fatal objection.** Sorting or lookup over 2^117 records may cost `Θ(log m)` instructions per access, adding ~7 bits. Hash-based lookup then needs a priced, collision-bounded design. Even so, the score likely stays well below generic.

**Experiment (~4–6 h).**
- Implement both stages on 28–40-bit prime-order j = 0 toy curves with `2^k | q−1` (k = 4, 6, 8).
- Exhaust all secrets on one 20-bit group; hold out one whole curve per size and the largest size.
- Controls: an ablation that replaces A_d with a random point (must fail); `d ∤ q−1` (must be rejected); and plain full-domain BSGS.
- Count every addition, load and comparison.
- Separately price production-width BLS G1 (6-limb) affine addition and digit-table access as in Direction 1.

**Success / kill.**
- Success: 100% exhaustive correctness, a ledger matching the traces, and the final `log2 W` stated with an interval.
- Kill if a required power is missing, the second stage is uncharged, or lookup cost is unbounded.

**Transfer.** The algebra transfers exactly. Toy counts validate the shape of the operation count. Production kernel costs come from the production-field microbenchmarks.

### Direction 3 — Frobenius-quotient GT rho as the honest baseline for both pairing-inversion tracks

**Mechanism and hypothesis.** Both pairing-inversion tracks reduce exactly to a GT discrete log:
- fixed-G1 track: `a = log_{e(P,Q0)} z`, output `[a]Q0`;
- fixed-G2 track: `a = log_{e(P0,Q)} z`, output `[a]P0`.

Checked here: `ord_r(p) = 12`, so the Frobenius `σ: u ↦ u^p` acts on GT as exponentiation by `p mod r`, an automorphism of order 12 that includes inversion (`p^6 ≡ −1`). **Inference:** a rho walk on σ-orbit classes has `N = r/12`, giving a 0.39 scale of ≈ 2^125.63 steps. In the cyclotomic subgroup:
- σ costs a few Fp/Fp2 multiplications (fixed Frobenius coefficients);
- inversion is conjugation, which is free-ish;
- squarings use the cheap cyclotomic formulas ([Granger–Scott, PKC 2010](https://eprint.iacr.org/2009/565)).

Since C = 20000 ≈ one dense Fp12 multiplication, **one rho step ≈ 1–1.5 units** is plausible.

**Hypothesis H3:** a fully charged GT-rho ledger lands near log2 W ≈ 126–126.5 for both pairing-inversion tracks, establishing the first concrete comparator against which NFS (Direction 5) or algebraic inversion (Direction 4) must be judged.

**Baseline / novelty.** Automorphism-class rho is published (Duursma–Gaudry–Morain). Frobenius equivalence in finite-field subgroups is standard. **Not novel.** None of the three inputs proposed it, and it gives each pairing-inversion track a concrete number. It cannot violate generic bounds: the 12-fold saving is the √12 orbit factor.

**Cost equation.**

`W = [I_pair(supplied arg, fixed generator) + I_table(r-adding multipliers g^{u_i} z^{v_i}) + Σ_steps (I_Fp12mul + I_canon12 + I_part + I_DP + I_cycle) + I_DP store/lookup + I_rewalk + I_mod_r_solve + I_scalar_mul_out (G2 or G1) + I_pair_verify + I_out] / 20000`

Assumptions:
- random-map behaviour on the 12-classes;
- fruitless cycles of length 2 and more, induced by σ-canonicalisation, are bounded and handled (the analogue of the negation-map issue).

**Fatal objection.** Canonicalising among 12 conjugates needs computing and comparing up to 12 Frobenius images, at ≈ 6 Fp2 multiplications each under tower Frobenius constants. That could cost ≈ 0.5–1 extra unit per step, eating half the √12 gain. Fruitless cycles under order-12 classes may be frequent.

**Experiment (~4–6 h).**
- Toy fields `F_{p^12}` with a 24–36-bit prime `r | Φ12(p)`, using small p — not BLS-specific.
- Run rho with the σ-quotient versus a plain walk on identical seeds, with 2 development and 2 held-out (p, r) pairs and ≥ 1024 held-out targets each.
- Measure useful-collision steps versus `sqrt(πN/2)` and the fruitless-cycle rate.
- Count BLS12-381 production `Fp12mul`, Frobenius and canonicalisation instructions in scalar 6-limb code.
- Controls: a plain walk (no quotient); a quotient with a deliberately wrong Frobenius constant, which must fail invariance checks.

**Success / kill.**
- Success: held-out step reduction ≥ 2.5× (√12 ≈ 3.46 is ideal) *after* canonicalisation instructions.
- Kill if the net is under 1.5× or the cycle rate is unbounded.

**Transfer.** The automorphism algebra is exact for BLS12-381 (checked: order 12). Walk statistics are heuristic. Production costs come from production-field kernels.

### Direction 4 — Pairing-inversion claim audit: quantifiers plus the random-lift barrier (rigorous negative route)

**Mechanism.** These are exact facts and filters ([Galbraith–Hess–Vercauteren 2008](https://homes.esat.kuleuven.be/~fvercaut/papers/pairing_inversion.pdf); [Kim–Cheon DCC 2015](https://doi.org/10.1007/s10623-014-9993-x)):
- The answer must use the **supplied** argument, and the required scalar is `t/b`, not `t`.
- Any-pair, generator-substituted and raw-Miller-equality answers are invalid.
- Checked here: `gcd(E, r) = 1` and `log2 E = 4313.55`. The final-exponentiation fibre has E elements, `z^{E^{-1} mod r}` is one easy root, and a uniform random lift hits the unique Miller-image value with probability 1/E per draw ([PA] D, [ME] D3 derive this independently and agree).

**Hypothesis H4:** any proposed direct inversion either:
- (i) needs a structured root selector, which then must be stated and proved; or
- (ii) is bounded by `L/E`, and so fails.

**Novelty:** none. This is a filter that produces a precise counterexample. Cost: as [ME] D3, with denominator 20000.

**Fatal objection:** a genuinely structured selector would escape (ii). The audit then becomes an analysis task.

**Experiment (1–3 h).**
- Toy bilinear oracle `e(g1^u, g2^v) = ζ^{uv}`, plus exhaustive fibres on `y² = x³ + x` over F43 (r = 11, E = 168) with a whole-curve holdout over F59 (r = 5, E = 696), as in [ME].
- Negative controls: any-pair, swapped generator, and random lift. Each must be rejected.

**Kill** the audit if a claimed counterexample fails to reproduce.

**Transfer:** the quantifier and fibre facts transfer exactly. Timings do not.

### Direction 5 — Cold exTNFS ledger for plain BLS G1 and the pairing-inversion tracks, versus Directions 2–3

**Mechanism.** The MOV/Frey–Rück transfer to `F_{p^12}` followed by (ex)TNFS:
- [Kim–Barbulescu](https://eprint.iacr.org/2015/1027);
- [Barbulescu–Duquesne](https://eprint.iacr.org/2017/334);
- [Discrete Logarithm Factory](https://eprint.iacr.org/2023/834).

The precomputation in these must be charged in full for one target.

**Hypothesis H5:** with every phase priced in scalar instructions and both descents (a varying base for pairing inversion), exTNFS beats:
- curve rho for plain G1 (≈ 126.1 + overhead at C = 2000); and/or
- GT rho for pairing inversion at C = 20000.

Note that C = 20000 makes NFS's small-integer sieving look **10× more expensive relative to the unit** in the pairing-inversion tracks than in plain G1. **Inference:** NFS is more likely to win plain G1 than pairing inversion, if it wins anywhere. The [CFRG draft-14](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-pairing-friendly-curves-14) estimate of ~126 bits uses a different cost model.

**Cost equation:** as in [PA] C, with `I_field + D(target) + D(base)` and pairings; `/2000` or `/20000`.

**Fatal objection:** the finite-size smoothness and linear-algebra constants cannot be measured at production size. The output may only be an interval wider than the gap to rho, giving an unresolved crossover.

**Experiment (3–6 h).**
- Parameter worksheet from the published BLS12-381 parameter sets.
- 10^5 production-p norm samples per selection, with 25% of selections held out.
- Controls: random integers of matched size, and a "free-database" estimator, which must be flagged.

**Kill** any competitive claim whose optimistic bound exceeds the Direction 2/3 ledger.

**Transfer:** production norm sizes transfer. Rare-tail smoothness does not.

### Direction 6 — Collision-law and canonical-partition cost under the 6-fold quotient (calibration, using requester data)

**Mechanism.** Requester measurement (2): a 16-adding walk used 12.4% fewer point calls than a 3-partition walk at q = 16,770,451. This is known in kind from Teske. The open, measurable question is how r-adding size (16/32/64), the canonical-class hash and the cycle-escape rule interact *under the order-6 quotient*. Larger r improves mixing but increases fruitless 2-cycles less. The question is whether that changes the per-step instruction total in Direction 1.

Sub-check: the cheapest representation-invariant bucket. A **single** Legendre symbol, or a canonical-x hash after batch normalisation (which Direction 1 needs anyway), versus four characters. The requester data already make four characters a loser.

**Hypothesis H6:** an optimum (r-adding size, escape rule) exists that lowers total instructions per *useful* collision by ≥ 5% over the default, on held-out curves.

**Novelty:** low. Tuning a known method. Included only because it calibrates Direction 1's overhead term.

**Cost:** the Direction 1 equation, compared method against method.

**Fatal objection:** the gains are below the noise of toy-to-production extrapolation.

**Experiment:** shares the Direction 1 toy harness, about 4 h extra.

**Kill** at < 5% or on holdout reversal.

**Transfer:** heuristic only.

### Direction 7 — Prime-field summation-polynomial index calculus (capped, low prior)

**Mechanism.** As in [PA] E / [ME] D4: a decomposable-map factor base following [Petit–Kosters–Messeng, PKC 2016](https://people.maths.ox.ac.uk/petit/files/16PKC_primeECDLP.pdf), with Gröbner reuse following [Amadori–Pintore–Sala](https://eprint.iacr.org/2017/609).

**Hypothesis H7:** measured solving degree and relation rank scale sub-exponentially enough to beat rho.

**Prior:** very low. [Kosters–Yeo](https://arxiv.org/abs/1503.08001) and others caution that first-fall-degree heuristics mislead.

**Experiment:** 16–24-bit primes, m = 2–3, a 6 h cap, with censored jobs reported. Kill on rank stall or degree growth beyond the model.

**Transfer:** algebraic counterexamples transfer. Timings do not.

## 4. Ranking (evidence × expected information gain × cheap falsifiability)

| Rank | Direction | Why |
|---|---|---|
| **1** | **D1 — rho floor/ceiling vs 127.08** | Uses checked numbers (2^126.70 quantile; implied ≈ 1,300 instructions per step). One day of kernel counting decides whether the live record is consistent with known rho, and fixes the bar for all secp256k1 ideas. Either outcome is informative. |
| **2** | **D2 — Cheon ledger, powers track** | The precondition is checked exactly. The published algorithm predicts a ≈ 6-bit gap below generic. The track currently has no result. Toy correctness is exhaustive and cheap. |
| **3** | **D3 — Frobenius-quotient GT rho** | Order 12 is checked exactly. It gives both pairing-inversion tracks their first concrete comparator. Toy degree-12 fields are cheap. The main risk (canonicalisation cost) is measurable directly. |

D4 is a cheap rigorous negative route; run it if any direct-inversion claim appears. D5 has high uncertainty and slow falsification. D6 is calibration. D7 has a low prior. None of these rankings promises a bit reduction below generic bounds.

## 5. First 24 hours (M5 Max, 128 GB; estimates, not measurements)

- **0–0.5 h:** Re-fetch the pin (HEAD = `6423c27`?) and the live page, and record any change. Re-hash the secp profile and cost JSON to confirm the [PA]/[AD] digests (§1.3).
- **0.5–6 h — first experiment (D1 kernels).** Scalar secp256k1 field mul/sqr, batched affine add (b = 32/128/512), 6-class canonicalisation and distinguished-point test. Static instruction counts from disassembly, with an affine-oracle correctness check on 4096 development and 4096 held-out points.
  - Decision: compute the per-step floor F and the best working kernel K, and compare with the 2^127.08 implied ≈ 1,300 instructions per step.
- **6–10 h:** D1/D6 toy walks on 40–48-bit j = 0 curves (2 calibration and 2 held-out curves, ≥ 1024 targets each): cycle rate and useful-collision quantile. Freeze the overhead term.
- **10–15 h:** D2 two-stage Cheon on toy curves, with exhaustive and held-out runs plus the A_d ablation. Price 6-limb BLS G1 addition and table access. Emit `W(2^20)` with an interval.
- **15–20 h:** D3 σ-quotient GT rho on toy degree-12 fields, with BLS `Fp12mul`/Frobenius instruction counts.
- **20–24 h:** Reveal the holdouts and recompute all ledgers once without retuning. Write up as proved, measured, modelled or unresolved.

**Explicit rejection criteria (any one rejects that claim):**
1. A held-out trace undercuts a claimed floor.
2. The D1 floor exceeds the implied 127.08 budget only within the cycle-rate uncertainty — report "unresolved", not "refuted".
3. D2 is missing a stage or power, or has unbounded lookup cost.
4. D3's net held-out step gain after canonicalisation is < 1.5×.
5. Any free preprocessing, changed distribution, borrowed powers, SIMD counted as scalar, wall time used as instructions, or conditional-on-success statistics used as the success rate.
6. Toy timings presented as production evidence.

## 6. Unanswered questions and limits

- The 127.08 dossier (and the other 13 rows) was not inspected. All are "Awaiting review".
- The protected-file digests come from two inputs and were not re-hashed here (network blocked).
- Kutsuma–Matsuo and the 2012/609 author order were not opened.
- The requester's observations (1)–(4) remain unreproduced, and the 251-bit control is unverified.
- No instruction trace, toy walk or production computation was run for this report. Only the integer checks in §0 were performed.
- Whether NFS or rho wins plain BLS G1 in these units is unknown.
- Passing these tests would not show that an attack is optimal or that no other attack exists.