Post
Topic
Board Development & Technical Discussion
Re: Solving ECDLP with Kangaroos - Part 1
by
RetiredCoder
on 09/11/2024, 15:16:13 UTC
Nice!

However I don't agree with method 2, K is not 1.7 because that value assumes a generic group.

What I mean is: the method computes -P (the "fast inversion") which in the paper is not assumed to have any specific similarity with P, it is just some other element known to lie between [-N/2, N/2] (anti-wild).

But for ECC, -P and P have the same X, hence when the DP is done on X, then we also have -DP as a distinguished point. This property allows for a much lower "K" than 1.7, and 1.25 is easily reachable at least when DP is 0 or very low in respect to the interval size.

I already claimed a much lower factor than 1.7 here, so I can't really say this is something you invented, but it's nice that you confirmed it as well.

https://bitcointalk.org/index.php?topic=1306983.msg64515007#msg64515007

Of course if DP=0 we can use symmetry everywhere easily. But at DP=5 or higher it's not the case and symmetry is not used in 3-way method.