Quote from: kTimesG on Today at 03:07:48 PM

Nice!

However I don't agree with method 2, K is not 1.7 because that value assumes a generic group.

What I mean is: the method computes -P (the "fast inversion") which in the paper is not assumed to have any specific similarity with P, it is just some other element known to lie between [-N/2, N/2] (anti-wild).

But for ECC, -P and P have the same X, hence when the DP is done on X, then we also have -DP as a distinguished point. This property allows for a much lower "K" than 1.7, and 1.25 is easily reachable at least when DP is 0 or very low in respect to the interval size.

I already claimed a much lower factor than 1.7 here, so I can't really say this is something you invented, but it's nice that you confirmed it as well.

https://bitcointalk.org/index.php?topic=1306983.msg64515007#msg64515007

Of course if DP=0 we can use symmetry everywhere easily. But at DP=5 or higher it's not the case and symmetry is not used in 3-way method.