Post
Topic
Board Development & Technical Discussion
Re: Pollard's kangaroo ECDLP solver
by
arulbero
on 01/05/2020, 18:24:58 UTC
-snip-
I think there's a paper about this already:
https://www.iacr.org/archive/pkc2010/60560372/60560372.pdf

You probably need to detect frutiless cycles with this method (stuck kangaroos in a loop without distinguished points).

Thank for this reading.
In abstract it was noted that the method "to solve the DLP in an interval of size N with heuristic average case expected running time of close to 1.36√N group operations for groups with fast inversion".

We do not have fast inversions. They also showed in practice that the total number of operations was not 1.36sqrt(N), but 1.46-1.49sqrt(N).

Quote
Here fast inversion means that computing u^−1 for any u in the group is much faster  than  a  general  group  operation.

Inversion in additive group means: -P, and -P is pratically for free.