Solving ECDLP with Kangaroos: Part 1 + 2 + RCKangaroo

[kTimesG]

You are mixing Pollard Kangaroo and Gaudry-Schost. What you describe would only work for GS or SOTA/SOTA+ (or more generically on methods relaying on birthday attack analysis) but not Pollard Kangaroo. It doesn't matter how many points you compute "at once" in Pollard Kangaroo, because distance between tame and wild, wouldn't change. Or in other words, it doesn't matter if tame catches wild (or wild catches tame) on the plus side going forward, or on the minus side going backwards, both are perfect mirror of each others and for methods that start at one location and never "restart" (i.e. PK) this wouldn't work.

You are missing the fact that in PK all walks go in a single direction.

Hence, only the points are mirrored, not the walks.This means that once you hit one of two points with the same X, the next point is different depending on whether the current point was on the left or right side.

So once you have a DP collision, you have two distances, not one, because the DP might have been on one of two sides, hence different distances to the respective base point (two offsets to the tame base, and two offsets to the public key and the symmetric one).

Maybe actually implement this and see for yourself? You don't have to believe me, I am simply stating facts.

[lleoha]

You are missing the fact that in PK all walks go in a single direction.

I am very aware of that.

Maybe actually implement this and see for yourself? You don't have to believe me, I am simply stating facts.

Already did that, more than one time.
https://github.com/lleoha/kangaroo-lab (experiments to compare K with what papers say)
https://github.com/lleoha/coin-cracker (CUDA "mirrorless" SOTAv2, gives k=1.6 but it processes more points/s than RCKangaroo, there's also some math behind SOTAv2's "k").

[kTimesG]

I am very aware of that.

Great then. You continue to confuse secp256k1 with a generic group. Here's your fallacy:

The leading constant should not depend on whether the group is this additive group, an elliptic-curve group, or another cyclic group of comparable order

because the exact opposite is true: the constant depends on whether the group has special properties.

PK 1.71 is for generic groups, not for groups with equivalence classes. But you should know better what you're looking for, after all. EOF