How exactly is it three times more work? I think you misunderstand what I am saying

y**2 = x**3 + 7

So you have x1 x2 x3, right? If you want to take advantage of endo, then you collide on an invariant of ±y, right? Like y**2 or min(y, p - y) or maybe by parity (if (y & 1) then y = p - y) which is the fastest way.

Now what? You hope to find the

**same y** of an endo class when jumping through the

**same interval**? Well, your chances to hit an Y of another endo class is astronomically low, since

**they belong to other keys spread through the 256-bit key space**, not necessarily your interval.

130-bit range has 2**129 Y values.

Each Y value has 2 (4) more endos for some other keys each somewhere in the 256-bit space.

Chances to hit some other Y than your own class in the 130-bit space is 6*2**129/2**256 more or less.

So you have something like 1 in 2**127 chances to ever find two Y of different endo classes in the same 2**130 key interval. It just becomes pointless extra computation.

Now, since it takes somewhere like 2**65 operations to solve bit 130, then a basic conclusion is:

**You'd have to solve around 2**62 130-bit puzzles before you ever get an collision on an Y between two different endo classes, on average.**.

Smarter way: make sure you jump through the other 2 endomorphic key intervals (so, 3 jump tables, adjust points as multiples of lambda). This way, you do 3x more work, but at least the chances of collision on Y are much more likely to occur, and the walks are all different, so even more chances to hit a collision.

So, first way is rather pointless (the chance to hit an endo Y is basically less than the chance to solve the puzzle itself), and the second one has no gains.