Bitcoin Forum
July 15, 2026, 01:30:22 AM *
News: Latest Bitcoin Core release: 31.1 [Torrent]
 
   Home   Help Search Login Register More  
Pages: « 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 [26]
  Print  
Author Topic: Solving ECDLP with Kangaroos: Part 1 + 2 + RCKangaroo  (Read 19662 times)
This is a self-moderated topic. If you do not want to be moderated by the person who started this topic, create a new topic. (27 posts by 5+ users deleted.)
kTimesG
Sr. Member
****
Offline

Activity: 896
Merit: 256


View Profile
July 12, 2026, 08:55:17 PM
 #501

You are mixing Pollard Kangaroo and Gaudry-Schost. What you describe would only work for GS or SOTA/SOTA+ (or more generically on methods relaying on birthday attack analysis) but not Pollard Kangaroo. It doesn't matter how many points you compute "at once" in Pollard Kangaroo, because distance between tame and wild, wouldn't change. Or in other words, it doesn't matter if tame catches wild (or wild catches tame) on the plus side going forward, or on the minus side going backwards, both are perfect mirror of each others and for methods that start at one location and never "restart" (i.e. PK) this wouldn't work.

You are missing the fact that in PK all walks go in a single direction.

Hence, only the points are mirrored, not the walks.This means that once you hit one of two points with the same X, the next point is different depending on whether the current point was on the left or right side.

So once you have a DP collision, you have two distances, not one, because the DP might have been on one of two sides, hence different distances to the respective base point (two offsets to the tame base, and two offsets to the public key and the symmetric one).

Maybe actually implement this and see for yourself? You don't have to believe me, I am simply stating facts.

lleoha
Newbie
*
Offline

Activity: 9
Merit: 1


View Profile
July 12, 2026, 10:04:58 PM
 #502

You are missing the fact that in PK all walks go in a single direction.
I am very aware of that.

Maybe actually implement this and see for yourself? You don't have to believe me, I am simply stating facts.
Already did that, more than one time.
https://github.com/lleoha/kangaroo-lab (experiments to compare K with what papers say)
https://github.com/lleoha/coin-cracker (CUDA "mirrorless" SOTAv2, gives k=1.6 but it processes more points/s than RCKangaroo, there's also some math behind SOTAv2's "k").
kTimesG
Sr. Member
****
Offline

Activity: 896
Merit: 256


View Profile
July 12, 2026, 10:23:43 PM
 #503

I am very aware of that.

Great then. You continue to confuse secp256k1 with a generic group. Here's your fallacy:

Quote
The leading constant should not depend on whether the group is this additive group, an elliptic-curve group, or another cyclic group of comparable order

because the exact opposite is true: the constant depends on whether the group has special properties.

PK 1.71 is for generic groups, not for groups with equivalence classes. But you should know better what you're looking for, after all. EOF

Pages: « 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 [26]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!