# CurveSmash prior art and falsifiable research directions Research snapshot: 23 October 2026. Starting revision and current public `master`/GitHub HEAD: **6423c2728dc03d5f2d647c7f22adf1dac0643a66**. This is a research report, not an attack submission, cost certification, or production experiment. ## Assessment I found no supported new classical attack on these production targets. The useful opportunity is to separate three questions that existing controls conflate: what inputs each problem supplies; what the best applicable published algorithms actually do; and what their complete cold computation costs in this challenge's units. Six directions below turn those questions into experiments or bounded negative results. None depends on changing the production distributions. The recommended order is **A: claim audit**, **B: auxiliary-polynomial collision audit**, then **C: cold BLS finite-field comparison**. This ranking reflects evidence, information gained per experiment, and ease of rejection. D, a pairing-image obstruction test, is a particularly cheap alternative if only algebra software is available. E is a high-risk algebraic route; F is implementation research with limited novelty. Evidence labels used throughout: - **Published fact**: an attributable statement in a primary paper or the public challenge specification. A published heuristic is still a heuristic. - **Independent check**: a document comparison, hash calculation, or integer calculation performed for this report. No cryptanalytic benchmark was run. - **Requester measurement**: supplied observations, not independently reproduced here. - **Hypothesis / inference**: a proposed mechanism or consequence requiring the stated assumptions. Experiment designs and runtimes below are prospective estimates, not results. ## Public rules: pin, current state, and changes disclosed **Independent check.** The [GitHub HEAD endpoint](https://api.github.com/repos/Layr-Labs/curvesma.sh/commits/HEAD) resolved to the starting revision. The repository API identifies `master` as the default branch. I retrieved all six `rules.md`, `target-profile.json`, and `verifier.json` files, the shared accounting JSON, benchmark manifest, current non-archived track documentation, README, and calibration record. Comparing the starting revision with HEAD found no changes in those files; HEAD is the same commit. Sources are frozen below to that revision rather than mutable `master` links. No downloaded submission code was executed. **Material public-status discrepancy.** The [live Yukon CurveSmash page](https://www.yukon.org/curvesmash), fetched as public HTML, names the same harness pin, lists all six targets, and displays a secp256k1 record of **127.08**. Its progress/leaderboard area calls results reviewed, while its published-results table labels corresponding entries “Awaiting review.” Other tracks show “Loading registration…” in the fetched document. Therefore this report does not assert their registration state, the 127.08 claim's validity, or a current certified best attack. The page also advertises human judges; this is not evidence that a particular claim received human review. The pinned repository specifies exploratory single-review acceptance. The [historical qualification document](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/docs/BASELINE_QUALIFICATION.md) says import access was pending; that historical status must not be presented as a verified description of today's hosted page. No public proof/dossier behind the displayed 127.08 number was inspected. These are status/evidence differences, not an identified rule change. The [six-track manifest](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/benchmark.json) has one objective, `time_log2`. The shared [accounting definition](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/classical-group-work-v2.json) requires one classical cold attack, success at least 0.39, scalar AArch64 instruction-equivalent work with 64-bit registers, full preprocessing and failures, and no amortization over future targets. Peak memory is separate, including advice and code. Parallelism changes elapsed time, not summed work. | Track; linked own rules | Exact production problem and distribution | C and reference; applicable leading methods | | --- | --- | --- | | [secp256k1-ecdlp](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/secp256k1-ecdlp/rules.md) | Only Q=[x]P; x uniform in 0…r−1, including identity. No powers. | **1000**; batched incomplete affine 6M calibration. Low-memory automorphism-aware rho is the generic benchmark; BSGS is a deterministic control, not the practical best method. | | [p256-ecdlp](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/p256-ecdlp/rules.md) | Same scalar-recovery distribution on SEC 2 secp256r1, including identity; a=−3, not zero. No powers. | **1000**, borrowed normalization only. Charge actual P-256 instructions. Negation-aware rho; BSGS with charged memory/lookup. No automatic order-three secp256k1 quotient. | | [bls12-381-g1-ecdlp-plain](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-g1-ecdlp-plain/rules.md) | Only T=[x]P0; x uniform in 0…r−1, including identity. Must return x. | **2000**, BLS G1 6M calibration. Compare source-group rho with pairing transfer plus a finite-field DLP; no free powers. | | [bls12-381-g1-ecdlp](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-g1-ecdlp/rules.md) | s uniform in 1…r−1; A_i=[s^i]P0 for i=1…n; T=A_1. Only this track supplies powers. | **2000**. State W(n) and applicability; evaluate at **n=2^20**. Cheon/Brown–Gallant and polynomial generalizations are essential baselines. Input generation is excluded; accesses and processing count. | | [bls12-381-fixed-g1-invert-g2](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-fixed-g1-invert-g2/rules.md) | Uniform nonidentity supplied P in G1 and independent uniform z in GT. Return Q in G2 for **that P**. FAPI-1 in G1×G2 order. | **20000**, dense Fp12 multiplication. GT DLP to base e(P,Q0), followed by [a]Q0, is admissible. No n/powers. | | [bls12-381-fixed-g2-invert-g1](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-fixed-g2-invert-g1/rules.md) | Uniform nonidentity supplied Q in G2 and independent uniform z in GT. Return P in G1 for **that Q**. FAPI-2 in G1×G2 order. | **20000**, dense Fp12 multiplication. GT DLP to base e(P0,Q), followed by [a]P0. No n/powers. | Each row was checked against its own target profile, not inferred from its name. Pairing targets include z=1; output infinity is valid exactly there. The pairing is the reduced map pinned to py_ecc v8.0.0, commit `04151f01f59f902ab932a51e0ca0ebce3883fc51`, whose call order is `pairing(Q,P)`. Neither an arbitrary pair nor raw Miller equality is the production task. See the two [FAPI-1 profile](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-fixed-g1-invert-g2/target-profile.json) and [FAPI-2 profile](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-fixed-g2-invert-g1/target-profile.json) definitions. The [reference calibration](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/docs/COST_MODEL.md) reports 179 scalar instructions per secp256k1 field multiply, 383 per BLS base-field multiply, and 22,996 per dense Fp12 multiply, rounded into the fixed C values above. These are normalization calibrations, not timings or complete attack bounds. In particular A=0 and S=M belong to the reference convention; they do not make unrelated additions, branches, squarings or loads free. Memory traffic is charged through executed loads/stores/addressing; do not invent a cache-miss-cycle surcharge and call it instructions. **Changes relative to historical claims, not relative to the requested pin:** the repository's [rescoring record](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/docs/RESCORING.md) retires old prices 78,037,248 and 45,839,872, raw-Miller/any-pair targets and old acceptance records as current baselines. All current tracks require fresh justification; selection and packaging are not qualification. ## Strongest applicable published methods and constraints “Strongest” here means methods that a defensible comparison must include, not a proven global optimum or an independently priced leaderboard. The literature search found no theorem giving the best complete instruction cost for these exact six challenges. ### Ordinary ECDLP: secp256k1, P-256, and plain BLS G1 [Shoup, *Lower Bounds for Discrete Logarithms and Related Problems*, EUROCRYPT 1997](https://www.shoup.net/papers/dlbounds1.pdf), proves square-root generic-group query lower bounds for constant success in prime-order groups. Informally, success is bounded by a constant times t²/r for t generic operations. This excludes sub-square-root claims made solely by rearranging opaque group operations. It does **not** prove hardness of a particular encoding, specify AArch64 constants, bound every representation-aware algorithm, or automatically cover additional secret powers and pairing oracles. For implementations, ordinary three-partition rho is an inadequate sole comparator. [Teske, *On random walks for Pollard's rho method*, Math. Comp. 70 (2001), 809–825](https://www.ams.org/mcom/2001-70-234/S0025-5718-00-01213-8/S0025-5718-00-01213-8.pdf), already studies r-adding walks and deficiencies of the original partition. [Bernstein–Lange–Schwabe, *On the correct use of the negation map in the Pollard rho method*, 2011](https://eprint.iacr.org/2011/003), addresses negation, fruitless cycles, and arithmetic implementation. These are established baselines, not new directions by themselves. [Galbraith–Wang–Zhang, *Computing elliptic curve discrete logarithms with improved baby-step giant-step algorithm*, 2017](https://www.aimsciences.org/article/doi/10.3934/amc.2017038?viewType=HTML), is relevant when using memory: it exploits negation and joint X+Y/X−Y computation. Comparing only against textbook BSGS can exaggerate gains. **Inference from curve structure.** For secp256k1, the map (x,y)↦(βx,y), β³=1, together with negation, offers generic orbits of size six. BLS G1 also has j=0 structure; P-256 has a=−3 and does not inherit that map. The ideal collision reduction √6 (or √2 for negation) is a search-space factor, not an instruction speedup guarantee: canonicalization, coefficient updates and short-cycle handling cost work. Scalar splitting for fast multiplication does not turn an unknown scalar into known 128-bit pieces. The [pinned libsecp256k1 group implementation](https://github.com/bitcoin-core/secp256k1/blob/e74a0187aac1cac734d5ad23ca5e40ceb6ddd4a8/src/group_impl.h) is a primary implementation source for the endomorphism, not a new cryptanalytic result. Pohlig–Hellman does not attack a prime r merely because r−1 is smooth. The relevant distinction is between group order r and multiplicative structure of the scalar field, exploited only when extra powers are supplied. Interval kangaroo on restricted secrets, leakage/lattice attacks on signatures, invalid-curve or wallet attacks do not instantiate these distributions. A toy prime-field curve, extension-field curve, or anomalous curve must not silently substitute for any production curve. The standard generic controls are described in [Menezes–van Oorschot–Vanstone, *Handbook of Applied Cryptography*, §3.6](https://cacr.uwaterloo.ca/hac/about/chap3.pdf). ### Powers-assisted BLS: a known substantial improvement, not a discovery [Cheon, *Security Analysis of the Strong Diffie-Hellman Problem*, EUROCRYPT 2006](https://www.math.snu.ac.kr/~jhcheon/publications/2006/Eurocrypt_Cheon_LNCS.pdf), gives the auxiliary-input attack for d dividing the scalar-group order minus one. The expanded [Cheon, *Discrete Logarithm Problems with Auxiliary Inputs*, J. Cryptology 23 (2010), 457–476](https://www.math.snu.ac.kr/~jhcheon/publications/2010/StrongDH_JoC_Final2.pdf), includes space-efficient variants, precise exponentiation/comparison costs, independently developed Brown–Gallant work, and table-based improvements. Its r−1 branch uses P0, [s]P0 and [s^d]P0 and costs O(√(r/d)+√d) **group exponentiations** before implementing the kernels. Its r+1 branch has different input-degree requirements; check the expanded theorem's powers through 2d instead of borrowing the r−1 condition. **Independent arithmetic:** the pinned BLS scalar order has log2(r)=254.8570894, v2(r−1)=32, and 2^20 divides r−1. Thus A_d exists at scoring n and the leading square-root search size is about **2^117.428545**, before exponentiation, table, restart and normalization costs. This is not a score of 117.43, not a 2^117-point-addition proof, and not a practical Mac attack. v2(r−1)=32 does not supply A_(2^32): n remains 2^20. Known extensions are already substantial. [Satoh, *On Generalization of Cheon's Algorithm*, corrected 2010 version](https://eprint.iacr.org/2009/058), considers higher extension embeddings and reports effectiveness only in the original k=1,2 cases. [Cheon–Kim, *A new approach to the discrete logarithm problem with auxiliary inputs*, LMS J. Comput. Math. 19 (2016), 1–15](https://doi.org/10.1112/S1461157015000303), with [author preprint](https://eprint.iacr.org/2012/609), relates complexity to the absolutely irreducible factors of f(X)−f(Y), with nonuniform birthday analysis. Arbitrary-polynomial collision compression or extension tricks cannot be advertised as new without comparison to this work. No claim of a better production algorithm follows from it here. ### BLS finite-field side and the two pairing orientations [Kim–Barbulescu, *Extended Tower Number Field Sieve*, CRYPTO 2016](https://eprint.iacr.org/2015/1027), makes extension degree twelve a relevant finite-field attack domain. [Barbulescu–Duquesne, *Updating key size estimations for pairings*, J. Cryptology](https://eprint.iacr.org/2017/334), studies concrete pairing parameter estimates. [Al Aswad–Pierrot–Thomé, *Discrete Logarithm Factory*, CIC 2024](https://eprint.iacr.org/2023/834), combines factory precomputation with tower/special variants. Its multi-field benefits must not be imported as free preprocessing for this fixed-field, one-target challenge. A current primary standardization source, the **work-in-progress** [CFRG pairing-friendly curves draft-14, 7 September 2026](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-pairing-friendly-curves-14#section-4.2.1), describes BLS12-381 at approximately 126-bit estimated security. This estimate is neither a native instruction count nor a CurveSmash score. Conflicting “120”, “126” or “128” security labels from different cost models should trigger reconstruction of their assumptions, not selection of the smallest label. The special/tower NFS family and source-group rho both belong in a cold comparison; I have not established which wins in the required units. **Exact reduction, derived here from bilinearity.** Plain BLS: set g0=e(P0,Q0), y=e(T,Q0), recover log_(g0)(y)=x and verify [x]P0=T. FAPI-1: gP=e(P,Q0), recover a=log_(gP)(z), output [a]Q0. FAPI-2: gQ=e(P0,Q), recover a=log_(gQ)(z), output [a]P0. Nonidentity supplied arguments ensure the GT bases have order r. Each reduction works for the full specified distribution. For finite-field virtual logarithms L modulo r, the varying-base FAPI exponent is **L(z)/L(gP)** or **L(z)/L(gQ)**. Charge both descents and the inverse; treating the varying denominator as a free generator log solves the wrong problem. [Galbraith–Hess–Vercauteren, *Aspects of Pairing Inversion*, IEEE TIT 54 (2008), 5719–5728](https://homes.esat.kuleuven.be/~fvercaut/papers/pairing_inversion.pdf), defines FAPI orientations and studies inversion approaches and related hardness assumptions. [Kim–Cheon, *Fixed argument pairing inversion on elliptic curves*, DCC 77 (2015), 143–152](https://doi.org/10.1007/s10623-014-9993-x), revisits exponentiation inversion and Tate/ate variants. Inverting a final exponent or a raw Miller function alone is not a solution to either production track. Conversely, these reductions show an upper bound through GT DLP, not a general equivalence proof between FAPI and scalar DLP. No DLP generic lower bound is asserted here as a theorem for the full coordinate-aware FAPI problem. ### Model boundaries across all six tracks **Derived model check, not a new lower-bound theorem.** For plain BLS with only a G1 unknown, a type-respecting generic bilinear model keeps G1 exponents affine in x, G2 exponents known, and GT exponents affine in x; there is no GT-to-source operation or iterated pairing of GT elements. This explains why merely adding the pairing oracle does not provide [x²]P0 or Cheon inputs. A formal lower-bound claim must specify that model and permitted public inputs rather than invoke ordinary Shoup unchanged. With supplied powers, source expressions instead have degree up to n in s and bilinear expressions can have different degrees depending on supplied group types; the ordinary one-unknown affine argument no longer applies. This is a changed information model, not a violation of a generic lower bound. For either fixed-argument inversion, write the supplied point scalar as b≠0 and z=g0^t with uniform independent t. The required unknown source scalar is t/b, not t alone. A type-respecting generic oracle does not map GT encodings back into a source group. Generic collision reasoning can constrain such algorithms, but a rigorous bound must model the two source groups, pairing and output task explicitly. Neither a CDH-hardness implication nor the GT-DLP upper reduction proves that every coordinate-aware FAPI algorithm needs square-root work. Direction D therefore seeks a restricted obstruction, and direction C prices an admissible upper-bound route. Pairing-aware coordinate algebra and NFS are outside the opaque-encoding assumptions; they still owe complete cold accounting. ## Accounting and experiment contract shared by all directions Use **instruction-equivalent** symbols, not cycles or “256-bit word operations.” Let C_j be the row's fixed normalization. An implementation trace or analytical expansion assigns each executed scalar arithmetic/logical/load/store/address/control instruction one equivalent. Expand 128/256/381-bit operations into 64-bit limbs. SIMD/GPU/AMX work cannot be counted as one scalar instruction; either exclude it from the scored kernel or supply a justified scalar lowering. For a capped, one-target attack with at most k attempts: I_total = I_pre + I_decode + Σ_(i=1…k) I_i + I_output I_i = I_rng,i + I_arith,i + I_partition,i + I_compare,i + I_lookup-sort,i + I_transfer,i + I_control,i + I_recover-verify,i + I_restart,i W_j = I_total / C_j; score = log2(W_j) M_peak = max_t(code + advice + input retained + tables + scratch + processor state + retained randomness + output)_bytes The sum includes failed attempts; bound every run up to its cap to obtain a finite worst-case work budget, even if successful runs stop earlier. Alternatively explicitly declare an expected-work quantity and prove its relation to a success-qualified budget; do not silently interchange the two. A hybrid reference ledger H+R/C is valid only if no kernel is counted both in H and R. All direction-specific equations below partition this same ledger and include its overheads. If independent attempts succeed with probability p0, amplification gives p=1−(1−p0)^k and charges all k budgets. Independence is an assumption requiring justification. The familiar ideal birthday expression 1−exp(−t(t−1)/(2N)) is a heuristic collision model, not a proof of useful scalar recovery. At p=0.39 its t scale is about 0.994√N; compare that **quantile** with the mean 1.253√N, not as if they were the same statistic. Cycles, degenerate coefficient collisions and detection delay must still be included. Prospective Mac protocol: native scalar C/C++ or Rust for production-field kernels, arbitrary-precision/Sage for small exact algebra. Record source/compiler flags, seed lists and test parameters in the future experiment repository. Use no hosted submission code. Generate toy targets over the full toy subgroup by rejection sampling and test the exact production fields separately. Keep setup charged even when reused within one attack. Cap experimental working storage at 96 GiB on the requested 128 GB machine. Do not infer measured throughput from its model name. Before tuning, freeze development seeds and a separately generated holdout list; publish a seed commitment before revealing holdouts. For stochastic attacks use at least 512 development and 1024 untouched holdout challenges per final toy size, and report all failures/censoring. Force identity, boundary scalars, opposite points and zero denominators in a separate correctness suite; do not count forced cases as IID random trials. Use an exact one-sided 95% binomial lower bound above 0.39 as an experimental gate. This is finite-sample evidence, not a production success theorem. Timing ratios use paired trials, rotated execution order and confidence intervals; instruction claims need traces or conservative analytical bounds. A failed candidate remains in the results. Runtime estimates below assume existing basic tooling and include neither a production DLP nor an exponential production table. ## A. Rebuild cold-cost claims as auditable bounds; prove coverage limits **Mechanism and hypothesis.** Construct a typed scalar64 cost derivation for a deterministic BSGS control and bounded rho comparator, then prove that every claimed improvement survives complete cold work and the 0.39 threshold. The research hypothesis is that several apparent “bits gained” are unit, probability or target mismatches. A useful rigorous negative result is to show a claimed scalar interval/table covers less than 0.39 of a uniform production group, irrespective of good timings. If baby indices cover m possibilities and giant indices g possibilities with a deterministic table, the set of covered scalars has size at most mg; without other work, success is at most min(1,mg/r). Count any preprocessing used to enlarge that set. This statement concerns this construction, not all possible algorithms. **Published baseline / novelty.** Shoup supplies the generic assumption boundary; HAC supplies BSGS/rho; improved BSGS and negation literature above are the stronger comparators. The novelty would be a reproducible cost certificate or precise refutation under the current model, not BSGS or rho. A new accepted loose upper bound need not be competitive or a scientific advance. **Independent documentary finding.** The pinned [secp control proof](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/submissions/secp256k1-ecdlp/proof.md) explicitly uses `ceil(k/256)` limbs and divisor 78,037,248. Its [claim](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/submissions/secp256k1-ecdlp/claim.json) contains protected-file hashes that differ from the retrieved bytes. Current profile SHA-256 is `18c3338de676f1909715814325bffdb1513f1621d678b942e8a7a9563b8fd086`; current cost JSON SHA-256 is `e0edc25a3e8b4a4b116442b2c2eb37f81f4aa0068fb6a1906312b040d5e17294`. This reproduces the documentary portion of requester observation (1), without validating its replacement control. Dividing the old numerator by 1000 alone gives approximately 145.252677, but that is **not a repaired valid bound**, because the numerator also needs scalar64 rederivation. **Charged equation.** For m baby records, g giant steps and ℓ=ceil(log2 m): W_BSGS = [I_setup + m(I_add+I_record) + I_sort(m,record_bytes) + g(I_add+I_lookup(ℓ,record_bytes)) + I_candidate_verify + I_rng + I_output] / C_j. M = two_sort_buffers + giant_state + code/scratch/advice. For probabilistic variants add all failed candidate verifications and all capped restarts. Exponentially large table addresses also need multiword representation; a 64-bit machine register does not address an arbitrary 2^128-entry array by assumption. State the abstract addressing/storage lowering used or choose a bounded-memory construction. Hashing, collision resolution and random seeds must be explicit if replacing sorting. **Fatal objection.** Correcting a deliberately loose bound says nothing about the strongest attack. Packaging success and exhaustive toy correctness do not certify costs, and a synthetic 64-bit interpreter is not automatically a scalar AArch64 trace. **Minimal experiment.** First run the documentary hash/divisor/limb check and an independently written coverage calculator: under an hour. Next, implement own tiny BSGS with counted four-/six-limb primitives and compare each kernel's instruction expansion against compiled scalar assembly on production moduli; 2–4 hours. Exhaustively test toy groups up to order about 2^16, then random 20/24/28-bit groups on development/holdout targets; 1–3 hours. Positive controls: exact exhaustive table coverage, identities and last partial block. Negative controls: a hidden setup omission, 256-bit unit-cost multiply, wrong divisor, and deliberately truncated interval. Success: all injected faults detected, exact coverage bound agrees with enumeration, and every operation/memory term has a stated lowering. Reject any attack-cost claim if a charged term remains unbounded or its capped success lower bound is below 0.39. **Transfer.** Type errors and the mg/r bound transfer algebraically without running a production attack. Toy wall-clock factors do not. The requester’s scalar64 log2 upper bound 251 remains an unverified loose control, not an awarded score or comparator for novelty. ## B. Audit polynomial image compression on the actual supplied powers **Mechanism and mathematical hypothesis.** For f(U)=Σ_(i=0…d) c_i U^i, d≤n, the input supplies the ability to form [f(bs)]P0=Σ c_i b^i A_i, where A_0=P0. Store independently sampled left keys [f(a)]P0 and right keys [f(bs)]P0. An equality implies f(bS)−f(a)=0 at S=s; factor this polynomial, then verify candidates against T. For fixed nonzero s, uniform b makes bs uniform over F_r*. Let ν_y be the number of nonzero preimages of y and η_f=Σ_y(ν_y/(r−1))². The collision scale for two lists is roughly η_f^(−1/2), subject to independence and useful-root assumptions. For a monomial d|r−1, η_f=d/(r−1). This makes compression measurable and exposes the price of evaluating implicit polynomials and recovering the correct root. Hypothesis: a sparse nonmonomial or composed map of degree ≤n might improve the **complete constant** after evaluation and root recovery, or admit a useful restricted impossibility result. Since every fiber has size at most d, η_f≤d/(r−1); polynomial image compression alone cannot improve the √(r/n) exponent at fixed degree limit. This elementary bound already disqualifies an entire class of claimed asymptotic breakthroughs. It does not rule out other uses of the powers. **Strongest baseline / novelty.** This mechanism lies squarely in Cheon–Kim polynomial-collision prior art, not unexplored territory. Compare against optimized Cheon r−1, its low-space variants and charged fixed-base tables, not plain rho. Satoh's higher-extension generalization is also prior art with adverse efficiency results. The possible contribution is a **cold scalar64 Pareto comparison or restricted lower bound**, not the polynomial method. Monomial/Dickson/composed polynomial labels are not novelty claims. **Charged equation and assumptions.** Let L,R be list lengths, V roots tested, and E_L,E_R the actual scalar-multiplication/MSM instruction costs per entry: W_f(n) = [I_map_search + I_tables + L E_L + R E_R(n) + I_coefficients + I_sort_lookup_transfer(L,R) + I_factor + V I_verify + I_rng + I_restart + I_output] / 2000. M = supplied_input_retained + lists + fixed_base_tables + factoring/MSM_scratch + code/randomness. Do not charge a generic implicit group exponentiation as one addition. Polynomial search and parameter-dependent evaluation tables are cold preprocessing. For Cheon compare [I_setup + K1 I_transform1 + K2 I_transform2 + all lookup/recovery/randomness]/2000, where K1=O(√(r/d)), K2=O(√d), with constants and caps derived from the chosen algorithm. State W(n) for, at minimum, d=largest power of two ≤min(n,2^32), d|r−1, and evaluate at n=2^20. The ideal two-list collision estimate must be checked separately from probability of factoring and identifying s. No powers beyond n and no other-track SRS are allowed. **Fatal objection.** A general degree-n MSM per right entry may cost far more than the collision compression saves; a collision can leave n roots. The supplied powers give linear combinations, not multiplication of two unknown scalar expressions. An imagined free oracle [u]P,[v]P↦[uv]P invalidates the method. **Minimal experiment.** Enumerate η_f exactly over scalar primes r of 16/20/24 bits, separately from curve arithmetic; compare monomials, predeclared sparse maps and compositions at d=16,64,256. Hold out two primes per bit size and every final coefficient set; 1–2 hours for sparse evaluation, with a two-hour cap. On actual tiny prime-order curves, run the two-list recovery and Cheon on the shared 1024-target holdout protocol; 2–6 hours. Controls: random low-degree maps, f(U)=U, d|r−1 monomial, and intentionally missing A_d. Separately count production-BLS MSM and scalar-transform kernels on 4096 random input sets at modest d; 30–90 minutes. Continue only if full-work improvement exceeds 10% with paired confidence intervals and a supported useful-success gate. Kill a candidate immediately on η gain without recovery, required degree>n, or per-entry costs erasing the gain. A negative map-degree certificate is a successful research outcome. **Transfer.** Fiber-size bounds transfer exactly. Small-field factor counts and timing gains do not prove the BLS polynomial's factorization or full success; certify them over the exact scalar field and retain the exponentiation/MSM factors. Never call the 117.43 search exponent an awarded production score. ## C. Reconstruct the cold BLS NFS crossover, including the varying-base descents **Mechanism and mathematical hypothesis.** Implement a transparent estimator for special/tower NFS candidates at the **exact** BLS characteristic and extension degree twelve. Partition polynomial selection, relation generation, filtering, sparse linear algebra and individual descents. Couple it to the exact three reductions above. Hypothesis: once a single cold field setup and both required logarithms are charged, the ordering of source-group rho versus GT methods differs from the ordering suggested by published “security bits.” The experiment may rule out a purported improvement rather than find an attack. **Strongest baseline / novelty.** The Kim–Barbulescu, Barbulescu–Duquesne and 2024 Factory papers above are mandatory starting points. This is known NFS, not a novel finite-field attack. Factory preprocessing and shared factor-base logs count in full; access to a public precomputed database is not free advice. Updated exact-parameter estimates and source/target reduction costs could be useful new evidence. No global optimality claim follows from the surveyed papers. **Charged equation.** In instruction equivalents let I_field = I_polysearch + N_sieve I_candidate + I_cofactor + I_filter + N_mv I_sparse_mv + I_log_reconstruction + I_rng + I_coordination + I_transfers. W_plain = [I_field + D(y) + D(g0) + 2 I_pair + I_ratio + I_scalar_verify + I_output] / 2000. W_FAPI1 = [I_field + D(z) + D(gP) + I_pair + I_ratio + I_G2_mult + I_pair_verify + I_output] / 20000. W_FAPI2 = [I_field + D(z) + D(gQ) + I_pair + I_ratio + I_G1_mult + I_pair_verify + I_output] / 20000. D is complete descent including smoothing attempts and failures. If a base log is already produced in I_field, remove its separate D term with evidence; never drop both. Charge retries of singular linear systems and capped descent failures. M includes relation files retained, matrix, logs, descent tree, code and state; external storage is reported and read/write instructions still count. Candidate norm distribution, smoothness, rank and descent-tail assumptions must be individually stated. A mean smoothness estimate alone does not establish success≥0.39 within the declared cap. **Fatal objection.** Asymptotic L-notation and dimensionless security labels omit precisely the finite-size constants and tail behavior needed here. Small fields can make selection or linear algebra artificially easy. Counting multiply operations cannot price sieving and memory traffic. An estimator optimized on favorable polynomials can severely overfit. **Minimal experiment.** Begin with a parameter-reconciliation worksheet: exact p,r, tower fields, polynomial identity, norm bounds, expected relation count, matrix dimension, two descent budgets and scalar64 pricing. Reimplement formulas from the papers without executing downloaded code: 3–6 hours. Then collect 10^5 norm samples per predeclared construction at exact production parameters and test smoothness only to small explicit bounds; 2–6 hours with timeout and censoring recorded. Hold out 25% of polynomial choices and 50% of samples before tuning. Controls: generic polynomial choice, random integers of matched log size, and a deliberately free-preprocessing estimator. Fit on development, predict holdout smoothness with binomial intervals, and measure sparse matrix-vector kernels on matrices whose dimensions/density are explicit; 1–2 hours. A complete small analogue, if feasible, gets another four-hour cap; never represent an incomplete sieve as a DLP solution. Success means a cost **range** with all stages priced and holdout predictions within a preregistered factor two, plus a separate success-tail model. Kill a claimed competitive score if its optimistic bound fails against a fully charged rho comparator, if parameters are not the pinned field, or if descent/base logs/setup are omitted. If uncertainty intervals overlap, report the crossover as unresolved; do not choose a winner. Production sieve sizes may remain far beyond 128 GB and are not experimental requirements. **Transfer.** Norm arithmetic at production p transfers; extrapolating tiny-bound smoothness to production relation yield does not without justification. Full-size linear algebra and descent tails remain unmeasured. This route applies to plain BLS and both FAPI orientations; the powers track additionally has a known Cheon competitor, which can dominate without any field sieve. No efficient degree-twelve transfer is assumed for secp256k1 or P-256. ## D. Locate the obstruction in reduced-pairing inversion with an exact image test **Mechanism and mathematical hypothesis.** Let K=F_(p^12), h=(p^12−1)/r, and F(u)=u^h. Independently calculating the pinned integers gives **gcd(h,r)=1** and log2(h)≈4313.550970. Thus for any z in GT, u=z^(h^(−1) mod r) is already one root of F(u)=z. The difficulty is finding a root that is the normalized raw Miller output of the unknown source point for the **fixed supplied argument**. Write M_P(Q) or M_Q(P) for that deterministic raw map, with exceptional divisors handled explicitly. Since reduced pairing is injective in the unknown prime-order group, at most one such raw value occurs in a given F-fiber; where the raw map is defined everywhere, exactly one does. A uniform kernel sample k in ker F makes uk uniform among h roots. An unstructured root search therefore hits that normalized Miller image with probability 1/h per sample (under the stated well-defined-map condition). This is a rigorous negative result for that sampling strategy, not a lower bound for structured algebraic inversion. Hypothesis: symbolic elimination could expose a much smaller structured search or prove a proposed root selector incompatible with the image. The short ate loop alone does not bound inverse-system solving complexity. **Baseline / novelty.** Final-exponent/Miller decompositions and their pitfalls are already in Galbraith–Hess–Vercauteren and Kim–Cheon. Novelty would require a provable selector or an exact obstruction certificate for the pinned pairing, not finding the easy root above. Compare a genuine solver with direction C's GT-log reduction and low-memory GT rho. Do not require raw Miller equality in the challenge verifier; it is an internal device for this particular proposed solver. **Charged equation and assumptions.** For k capped candidate lifts: W_image = [I_derive_system + I_root + Σ_(i=1…k) (I_kernel_sample,i + I_solve_Miller,i + I_curve_subgroup,i + I_pair_verify,i + I_failure,i + I_transfers,i) + I_rng + I_output] / 20000. M = system/coefficient_storage + elimination_matrices + lift_tables + input/code/scratch/randomness. Every algebraic-system construction and rejected lift counts. For structured solvers, state assumptions on number/degree of components and elimination cost; a random-kernel success formula cannot justify a biased selector. If kernel sampling is used, charge construction and tests of kernel elements rather than assuming access to a uniform kernel oracle. Both orientations require their own system: the unknown lives in Fp or the specified twist over Fp2. **Fatal objection.** A cheaply selected exponentiation root is generally unrelated to the Miller image, and elimination degree/number of components can grow enormously. A root in GT is not an elliptic point. Exceptional zeros/poles can also invalidate naïve image-size reasoning unless the chosen raw representation is defined and specified. **Minimal experiment.** On three predeclared small pairing-friendly curves with manageable subgroup orders (target r≤2^12), exhaustively tabulate normalized raw/reduced maps in both orientations. Identify every exceptional point, F-fiber size and image intersection. Use a fourth curve and fresh random nonidentity fixed arguments as holdouts. Controls: true unknown point provides a known-good raw root; random lifts and an intentionally wrong fixed argument should fail. Freeze the toy parameter enumeration procedure rather than selecting easy cases. Run a separate exact-production integer root check and 4096 random GT root identities, not an inverse attack. Estimate 1–4 hours; stop any exhaustive field enumeration above 2^20 elements and use direct source-point image enumeration instead. Kill the proposed inverse if it supplies no image selector beyond random lifts or fails any holdout reduced-pairing check. Success can be an exact restricted impossibility certificate; an attack continues only with an explicit selector and complete cost. **Transfer.** The exponent/root algebra and injectivity transfer to production. Tiny-curve elimination timings do not. In particular replacing variable P or Q by a globally known generator would remove the central fixed-input condition. A proof for one orientation is not automatically an implementation for the other. ## E. Test prime-field summation-polynomial relation generation against rank and solving degree **Mechanism and hypothesis.** Choose a factor base via a composition of low-degree rational maps L; solve the summation-polynomial constraints for R=[a]P+[b]Q=ΣP_i with P_i in that factor base. Collect relations, solve for factor-base logs modulo r, and recover x from a relation with nonzero Q coefficient. The hypothesis is that a particular exact-prime-field factor base yields enough independent relations at a solving degree low enough to beat the complete generic comparator. It is testable and presently unsupported at production size. **Strongest relevant baseline / novelty.** [Petit–Kosters–Messeng, *Algebraic approaches for the Elliptic Curve Discrete Logarithm Problem over prime fields*, PKC 2016](https://people.maths.ox.ac.uk/petit/files/16PKC_primeECDLP.pdf), already uses decomposable rational maps for factor bases; it reports practicality only for small parameters and uncertainty in Gröbner complexity. [Kosters–Yeo, *Notes on summation polynomials*, 2015](https://arxiv.org/abs/1503.08001), gives reasons to distrust equating first-fall degree with solving complexity. These are not an established production attack or an unconditional impossibility theorem. Binary/extension-field descent is not a prime-field result. A different factor base, degree certificate or sharp failed-transfer demonstration would be the contribution; “use Semaev polynomials” is known. **Charged equation and assumptions.** For factor-base size B, capped relation trials J, required rank B, and final descent attempts k: W_rel = [I_find_factorbase + Σ_(j=1…J)(I_randomize_R,j + I_system,j + I_Groebner,j + I_extract_verify,j) + I_filter + I_linear_algebra_mod_r + Σ_(i=1…k) I_target_descent,i + I_scalar_verify + I_rng + I_transfers + I_output] / C_j. M = factorbase + all_retained_relations + peak_Groebner_matrix + final_sparse_matrix + code/scratch. Here C_j=1000 for either 256-bit curve and 2000 for BLS G1. Account for signs of lifted y values, false algebraic roots, duplicates and dependent rows. Hypotheses requiring evidence: relation probability, actual solving degree, rank distribution, and tail probability of recovering x within J,k. None follows from a low first-fall degree. **Fatal objection.** The polynomial system becomes harder faster than the factor base reduces the search; relations may be plentiful but dependent. Smooth structure used to build toy factor bases may disappear for the exact prime. The BLS scalar field's 2-adicity says nothing by itself about a factor base over its coordinate field. **Minimal experiment.** Reimplement one precisely specified PKM-style construction on prime fields of 16/20/24 bits, using two curves with a=0 and two with a=−3 per size. Generate primes without selecting for advantageous smoothness; separately label any applicability-conditioned sample. Hold out one curve of each type at each size and all final targets. Compute exhaustive low-size relation probabilities, actual Gröbner matrix dimensions/degree and relation rank, then complete small DLPs against a charged rho control. Positive control: enumerate all small decompositions; negative control: duplicate relations that raise row count but not rank. Start with m=2,3 summands and B=32,64,128; cap each solve at 60 seconds and all solves at 6 hours, record timeouts rather than delete them. Continue only if held-out relation/rank predictions hold and total work, including failures, improves by at least 20% with a supported success budget. Reject the extrapolation if only selected smooth primes work, if solving degree rises beyond the budget model, or if rank stalls. **Transfer.** A toy solution tests correctness and relation independence. It does not validate a 256-/381-bit Gröbner complexity extrapolation. A production claim needs either a proved solving-degree/operation bound for its exact systems or clearly supported heuristics with unfavorable scaling retained. This route does not bypass the generic bound: it explicitly uses coordinate algebra, and may simply fail. ## F. Synthesize and certify scalar64 arithmetic pipelines across a=0 and a=−3 **Mechanism and mathematical hypothesis.** Treat point/field formulas as a dataflow graph and search a restricted, explicitly listed space of scalar64 schedules: field-reduction boundaries, register spills, shared-denominator X±Y evaluation, exceptional-case routing and normalization. The hypothesis is that fewer field multiplications is not equivalent to fewer complete scalar instructions, and an actual production-field kernel can reverse a toy operation-count ranking. Require algebraic equivalence to the affine group law, including all exceptional inputs, and preserve the same target and walk logic for comparison. A useful result could certify an optimum only within the enumerated schedule family, not among all EC algorithms. **Baseline / novelty.** Formula and coordinate choices are well established: the authors' [Explicit-Formulas Database, Jacobian](https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html) and [a=−3 Jacobian formulas](https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html) expose assumptions and operation counts. Improved BSGS already exploits joint X±Y; the pinned libsecp256k1/blst kernels and the challenge calibration are implementation baselines. Batching, negation and endomorphisms are not new. A proof-producing schedule search under the exact cost convention or a counterexample to cross-curve transfer is the possible contribution. **Charged equation and assumptions.** For batch size b, t total attack steps and exceptional events E: W_pipeline = [I_schedule_search + I_precompute + ceil(t/b)(I_batch_inverse + I_prefix_suffix + b(I_formula + I_partition + I_coeff_update) + I_spills_loads_stores_control) + I_exception(E) + I_collision_detection + I_rng + I_restart + I_recover_verify + I_output] / C_j. M = tables + b*state_bytes + inversion_scratch + collision_state + synthesis_advice/code/randomness. Expand actual multiplication, squaring, addition, inversion and coefficient arithmetic. Charge target/parameter-dependent schedule or table search as preprocessing; exclude only general algorithm design as allowed by the rules, with that boundary documented. The hypothesis that a kernel improvement leaves walk success unchanged requires identical canonical partition traces and coefficient invariants. A timing improvement without an instruction bound is not a scored improvement. **Fatal objection.** An apparently good schedule merely rediscovers known batching, or saves instructions in an insignificant kernel while adding expensive canonicalization. a=0 formulas or exceptional-case probabilities may be wrong on P-256. An incomplete affine formula must have a charged, correct fallback; the reference's incompleteness does not authorize ignoring those inputs. **Minimal experiment.** Run fixed algebraic schedules on exact secp256k1, P-256 and BLS coordinate fields. Use 4096 valid point pairs and random nonzero projective scales for development, a separate 4096-pair holdout, plus forced identity/doubling/opposite/zero-denominator cases. Compare unbatched and b=8,32,128,512 production-field kernels with both reference formulas and known optimized libraries, using identical inputs, nine rotated rounds and no SIMD scoring. Reuse the canonical walk on small groups only to validate end-to-end coefficient recovery and the shared stochastic-success gate. Budget 3–8 hours including inspection of compiled scalar assembly. Continue only with at least 5% instruction reduction, correct holdout traces, explicit spill/load costs and a lower total attack bound. Kill a “novel” claim if it is only a known formula or if gains exist only in multiplication counts or wall time. **Transfer.** Actual production-field arithmetic and equality tests transfer locally. Small-group collision distributions do not establish production mixing; they remain a separate assumption. This direction primarily affects the three ordinary EC tracks and Cheon kernels; it is not a new exponent-level attack or a reason to revive the rejected character implementation. ## Requester observations: evidential use and exclusions 1. The original control's stale hashes, divisor and 256-bit limb convention are independently confirmed by document/hash inspection above. The replacement memory-bounded scalar64 upper bound 251 was not supplied as a checked artifact and is not validated here. No award follows from packaging/tests. 2. The reported 2048 successful small-curve runs and 12.4% point-call reduction for a 16-adding walk over three-partition are **requester measurements**, not this report's experiments. The prior-art attribution to Teske prevents treating this comparison as novelty. Means conditional on successful runs must not silently establish capped success; retain all attempted runs in any follow-up. 3. The reported character partition's 4096 rescalings, 16384 lockstep steps, ~52% fewer multiplications but ~4× slowdown, and noninvariant raw-hash result 3/30 are requester measurements. Representation invariance is necessary for that canonical walk, but not sufficient for speed or mixing. Raw representation hashing can create a different state process and cannot inherit the canonical-walk analysis. 4. The reported production-field ARM64 GCC14.2/GMP6.2.1 microbenchmark—4096 x samples, nine rotated rounds, zero mismatches, four-character partition 3.94 μs versus normalization/x-hash 0.886 μs unbatched or 0.248 μs at batch 128—rejects that implementation's practical speedup. Those are wall times, not scalar instruction traces. It neither rejects every character design nor demonstrates a full ECDLP attack. This report proposes no new character-partition speedup. No production ECDLP, independent native instruction trace, official submission, or award is asserted for the requester work. The separately observed live-page result is not attributed to that work. ## Ranking and the first 24 hours | Rank | Direction | Evidence now | Expected information gain | Cheap falsification and decision | | --- | --- | --- | --- | --- | | **1** | **A — cold-cost/coverage audit** | Exact current rules; independently confirmed historical unit/hash mismatch; elementary coverage bound | Prevents every later comparison from inheriting false units or success assumptions | Under one hour for documentary gate; reject any missing charged term, insufficient coverage or stale target binding. A certificate/refutation is useful even without an attack. | | **2** | **B — polynomial powers audit** | Published admissible Cheon attack; exact divisibility; explicit map/fiber bound | Determines whether proposed powers ideas are already known or cannot beat degree-limited compression; separates recovery from collisions | Enumerate small-field fibers first, 1–2 hours. Reject “new exponent” claims contradicting η≤n/(r−1), absent powers, or costs that erase compression. | | **3** | **C — cold NFS crossover** | Established tower/special NFS literature; exact bilinear reductions; substantial unpriced finite-size uncertainty | Establishes the right competitors for three BLS tracks and identifies missing descents/advice | Worksheet first, 3–6 hours. Reject unsupported stage omission immediately; do not run a large sieve before this passes. More expensive empirical confirmation follows only if useful. | | 4 | D — pairing-image obstruction | Exact easy-root/gcd fact and restricted random-lift obstruction | Quickly kills a recurring false inversion argument; possible rigorous negative result | 1–4 hours of exact toy-image tests; stop without a structured selector. | | 5 | F — scalar64 schedule certificate | Strong published formulas; requester evidence that M-counts mislead | A narrower, measurable implementation result across three curves | 3–8 hours; kill on total-cost regression or known batching alone. | | 6 | E — relation-generation scaling | Published construction and published objections; no production success evidence | High if it yields a degree/rank obstruction; low prior probability of attack gain | Cap at six hours; retain timeouts, rank failures and unfavorable primes. | **First experiment to run:** A's independent current-rule/claim reconciliation, followed immediately by the scalar coverage calculator. Inputs are the pinned profile, cost JSON and historical claim/proof; outputs should be a six-track normalization table, actual-vs-bound hashes, the identified 256-bit primitive mismatch, and exact covered-set size on tiny exhaustive groups. No submission code is needed. This report already performed the documentary hashes and arithmetic checks; the first new computational experiment is the independent coverage/fault-injection harness. It should reject a deliberately truncated search with mg/r<0.39 even if every found answer verifies. Failure to reject that control invalidates the harness. A concrete sequential 24-hour plan on the requested Mac, with useful stopping points: - **Hours 0–2:** Freeze source/specification hashes and seeds; perform A's coverage and fault-injection checks. Write the audit result even if every attack proposal is killed. Re-fetch the public rules and disclose any new difference before claiming a score. - **Hours 2–6:** Reconcile scalar64 field/lookup costs in A. Prepare optimized known comparators, separate instruction costs from elapsed timing, and list every unpriced term. Stop promoting any numerical score with unresolved terms. - **Hours 6–10:** Run B's exact fiber-size enumeration and small implicit-collision recovery controls. Compare with charged Cheon. If only known monomial behavior survives, record that as prior-art confirmation and do not invent novelty. - **Hours 10–15:** Build C's exact-parameter cold-cost worksheet. Explicitly price two logs, field setup and final output verification for each relevant track. If the range remains unbounded, publish the missing assumptions rather than a point estimate. - **Hours 15–19:** If C has a competitive, testable hypothesis, run held-out production-norm samples and scalar matrix kernels. Otherwise run D's exhaustive image obstruction experiment, preserving both orientations and exception cases. - **Hours 19–22:** Reveal untouched holdouts; recompute complete capped success/cost and confidence bounds. Check predeclared kill criteria. Do not retune after seeing holdouts; a changed design needs new holdouts. - **Hours 22–24:** Write a results/negative-results note with all failures, memory peaks, extrapolation assumptions and exact unanswered questions. Classify each surviving idea as known implementation improvement, conditional research hypothesis, or rigorous restricted negative result. Make no Yukon submission in this research phase. **Global rejection criteria:** changed production distribution; target replaced by a favorable fixed generator; powers borrowed by any of the other five tracks; n chosen for a better score; free preprocessing/advice; quantum work; unlimited-width primitive operations; scalar cost inferred solely from wall time; failure/recovery/verification/memory-transfer costs omitted; conditional-on-success statistics used as full success; a useful-success claim below 0.39; or unsupported transfer from toy algebra to production. Rejecting a research hypothesis is progress; claiming a competitive attack without these checks is not. ## What remains unanswered and what this report verified The hosted page's exact registered checkout/dossiers and contradictory status labels remain unresolved. No contemporary submission's displayed number was reconstructed. The globally best cold scalar64 attack for any of the six tracks is not proved here. Concrete NFS finite-size constants, full Cheon low-space constants, and production useful-collision distributions remain research questions. A polynomial-map or algebraic relation result could be interesting without being an admissible competitive score. Source-access limitation: some author/ePrint PDF fetches returned HTTP access errors. In those cases I used the primary author/publisher/ePrint abstract or indexed primary-paper text; I did not independently verify every theorem proof or implementation constant. The linked papers define the required prior-art comparison, not a claim that all their proofs were reproduced. The public Yukon HTML was retrieved successfully by curl even though the browsing tool could not open that page. Checks actually completed: read-only retrieval of pinned/current public rules and profiles; HEAD comparison; each track's C and distribution recheck; inspection of historical proof/claim text; SHA-256 calculation of protected documents; exact 2-adicity/divisibility and final-exponent gcd calculations; exhaustive sanity checks of the interval coverage inequality in additive groups of orders 17, 101 and 257 and monomial fiber counts over scalar fields of orders 17 and 257; primary-source literature search; and structural checking of this Markdown deliverable (six tracks, six mechanisms, six objection/experiment/transfer sections, and 38 source links). These small integer checks are not EC attack experiments. No production attack, downloaded experiment, installer, deployment or official evaluation was run. The verifier's path/byte check cannot independently establish the mathematical truth of this report.