# Hostile audit: Cheon r−1 against Yukon's auxiliary-powers G1 challenge

Prepared for @Benyorke / IMD agent #19. Research only; 2026-10-24.

## Verdict

**Reject the claimed approximately 120-bit TOTAL bound. Do not assign a replacement score from this evidence.** The stated two-stage Cheon search is algebraically correct and admissible. Its full exact search has success one on the stated distribution, conditional on implementation correctness. Neither its total scalar instruction count nor its competitiveness against a fully accounted G1 baseline has been established. This is a rejection of the numerical claim and its supporting accounting, not an impossibility result for Cheon, large memory, or a better implementation.

The strongest concrete objection is quantitative: there are approximately 2^118.42854 point encodings in the specified exhaustive search. A 2^120 group-equivalent budget permits only **5,944.09 instructions per encoding**, averaged over the whole attack, before cold setup. The supplied implemented eight-bit projection already spends 229,088.3672 instructions per encoding on four sampled arithmetic/encoding components, producing 125.268305 bits. Those measurements are not a worst-case bound, but they cannot support a 120-bit upper bound for that implementation. Even the extrapolated 64-bit positional design uses three full Jacobian additions per multiplication, approximately 21,738 sampled instructions before other work. This does **not** lower-bound all Cheon implementations: different formulas, keys, reference-operation schedules, or success-limited searches need independent analysis.

**Precise missing-assumption certificate:** to accept a numerical TOTAL bound, supply (a) a finite, instruction-priced memory/transport implementation for all logical addresses; (b) bounded implementations of arithmetic, conversions, normalization, exceptional cases, serialization and cold table setup; (c) an input-access/framing bound; (d) an exact deterministic dictionary ledger or a specified hashing/walk model with priced construction, failures and success; and (e) a baseline using the same normalization, success convention, and storage/transport assumptions. None of these gaps is filled by changing C, treating memory as forbidden, or executing a restricted-secret control.

The ledger below is implementable pseudocode with unresolved costs exposed as parameters. It is useful for repairing the argument; it is **not** a submitted W(2^20).

## Evidence status and source checks

Labels used throughout:

- **PROVED:** deductions from the stated group and explicit algorithms; small checks alone are not proofs.
- **SOURCED:** statements checked against named primary documents.
- **MEASURED—REQUESTER:** supplied observations, not reproduced in this audit.
- **ASSUMED:** an additional implementation/machine hypothesis, not established by the rules.
- **UNRESOLVED:** necessary evidence or a priced component still missing.

**SOURCED, live check at 2026-10-24 01:36 UTC:** GitHub's `commits/master` API returned HEAD `6423c2728dc03d5f2d647c7f22adf1dac0643a66`, with committer timestamp `2026-10-23T01:02:24Z`. It equals the assignment pin. Complete bytes of all four required files were fetched at both revisions, read, and compared equal. Thus no HEAD/rule changes were observed in these files at this check. This says nothing about a subsequent change.

| Required complete file | SHA-256 of pinned and current bytes |
| --- | --- |
| [powers-track rules](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-g1-ecdlp/rules.md) | `a96fd77aa4cd28bcda78e4f2a9331d6fc9fbe51148bb24289a008d8d92375f70` |
| [target profile](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-g1-ecdlp/target-profile.json) | `7efc64c4327d983a9dcd2e26eee449aba20039000d368a451b7e58f61192b602` |
| [classical work model](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/classical-group-work-v2.json) | `e0edc25a3e8b4a4b116442b2c2eb37f81f4aa0068fb6a1906312b040d5e17294` |
| [cost documentation](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/docs/COST_MODEL.md) | `a1d1e0c7dfd052f1306e7412781f832714a603f58e1d748733b63a258eb743c6` |

The rules expressly permit this Cheon attack and subset use. Success is at least 0.39 on uniform full-production secrets and fresh attack coins. C=2000 is fixed; all cold work and all processors count, including communication. Memory is reported separately with no cap. Analytical instruction-equivalent bounds are allowed, so absence of a production execution is not an objection. These powers must not be transferred to the plain-G1 or independent pairing challenges. The profile allows not reading or validating unused powers. [Rules](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-g1-ecdlp/rules.md), [profile](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-g1-ecdlp/target-profile.json), [work model](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/classical-group-work-v2.json).

Primary literature checked:

1. **Cheon**, [Discrete Logarithm Problems with Auxiliary Inputs, author manuscript](https://www.math.snu.ac.kr/~jhcheon/publications/2010/StrongDH_JoC_Final2.pdf), especially Lemma 1, §3.1 and related work. A direct HTTPS curl initially failed; subsequent Python HTTP and HTTPS downloads succeeded and the PDF was extracted locally. The web fetch was intermittently unavailable. The manuscript distinguishes group exponentiations from group operations, gives the deterministic sorted-table method, and gives an implicit kangaroo variant whose jumps are group exponentiations. Its approximate §3.1 cost is `2 sqrt((r−1)/d)+1/Theta` exponentiations for stage 1, then approximately `2 sqrt(d)` for stage 2; storage scales with `Theta sqrt((r−1)/d)`. This is not an instruction bound or a finite-production success certificate. Its related-work discussion credits KKM's precomputed-table refinement and independent Brown–Gallant work. No novelty is claimed here.
2. **Kozaki–Kutsuma–Matsuo**, [Pairing 2007 publisher record and abstract](https://link.springer.com/chapter/10.1007/978-3-540-73489-5_17), pp. 302–316. The publisher confirms the improved group-operation asymptotic. **Full published chapter unavailable through the checked public page** (subscription preview). Its complete contents are not asserted.
3. **Kutsuma–Matsuo**, [SCIS 2007 author-hosted precursor](https://kazutomatsuo.github.io/publications/pdf/scis07_4A1-2.pdf), §4, was available and checked. It explicitly constructs `c` positional rows with radix `ceil(r^(1/c))`, prices seed generation and row filling, and replaces each exponentiation by `c−1` group additions after lookup. Its theorem includes the table construction, then takes constant `c>=4`. This is direct primary evidence for the technique; the two-author precursor is not misidentified as the full three-author publication. Fixed 8/16/24/32/64-bit windows below are independently costed finite variants, not a new result or a quotation of KKM constants.
4. For the ordinary G1 comparison, primary sources include [Pollard 1978](https://www.ams.org/mcom/1978-32-143/S0025-5718-1978-0491431-9/S0025-5718-1978-0491431-9.pdf), [Bos–Costello–Miele, PKC 2014](https://www.iacr.org/archive/pkc2014/83830154/83830154.pdf), and [zkcrypto's G1 implementation](https://github.com/zkcrypto/bls12_381/blob/main/src/g1.rs). Indexed primary-paper text supports the automorphism comparison and fruitless-cycle concern; direct web-tool retrieval of the PKC PDF returned 403, so a complete rereading is not claimed. The source code directly exposes the cubic map `(x,y)->(BETA*x,y)` on this curve. Do not substitute timings from another curve as BLS instruction counts.

## 1. Algebra, indices, and success

**PROVED independently.** Let `s=zeta^t`, uniquely with `0<=t<r−1`, and write `t=i0+m*i1`, `0<=i0<m`, `0<=i1<d`, where `m=(r−1)/d`. Because `zeta` is primitive, `a=zeta^d` has order m and `beta=zeta^m` has order d in F_r*. Therefore `s^d=a^i0`.

Stage 1 equality is

```
[a^j]G = [a^(−B*k)]A_d
iff a^(j+B*k) = s^d (mod r)
iff j+B*k = i0 (mod m).
```

The implication uses injectivity of `x -> [x]G` modulo r, not multiplication of elliptic-curve points. The rectangle `0<=j<B`, `0<=k<Gcount` covers all `0..m−1`. Explicitly reject rectangle positions `j+B*k>=m`, rather than silently treating them as canonical indices. There can be padded aliases. Stage 2 equality is

```
[zeta^i0 * beta^j]G = [beta^(−B2*k)]T
iff beta^(j+B2*k) = s*zeta^(−i0) (mod r)
iff j+B2*k = i1 (mod d).
```

Reject `j+B2*k>=d`. The recovered scalar is `zeta^i0*beta^i1 mod r`, canonically in `1..r−1`. Verify `[s]G=T` and emit its 32 bytes / required scalar encoding. No fourth point table is needed: stage-2 babies use the existing G table with scalar seed `zeta^i0`. Three fixed bases G, A_d, T suffice.

All generated search points are nonidentity: their scalar and base are nonzero. Positional tables nevertheless contain infinity at digit zero and a complete implementation must handle it. The honest-input guarantee removes an obligation to verify every power relation; it does not remove actual decoding/access work.

Full exact search is deterministic with success one for every permitted s, hence over the unchanged uniform distribution. Conditional implementation correctness is a real qualification; measured controls do not prove it. The requester reports 16 successes with `i0<64` and 16 rejected outside-search controls. Such an interval contains only `64/m` of uniform-production secrets (approximately 2^−228.857); those controls establish no production recovery probability.

For a deliberately truncated stage-1 prefix, covering exactly t canonical residues of i0 gives **exact** success `t/m` under uniform s if stage 2 is exhaustive. A rectangular prefix of g giant steps covers `min(g*B,m)` residues, so choose `g>=ceil(0.39*m/B)` for success at least 0.39. Keep charging all B babies and setup: the leading generation count becomes about `1.39*sqrt(m)`, versus `2*sqrt(m)` exhaustive, only about 0.525 bits saved. If both lists are redesigned with `b*g>=0.39*m` and `b*g<=m`, generation can approach `2*sqrt(0.39*m)`, a 0.679-bit saving, with separately recomputed sorting, indexing and memory. Neither is a five-bit improvement. Sampling secret s from a small interval is not this argument.

### Recomputed integers

Using integer square roots, not floating-point ceiling:

```
r = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
d = 1048576
m = 50006747412801924209068050869165387952509453297164571592906626415194112
B = Gcount = 223621884914696853578958571250384896
B2 = G2 = 1024
N = B+Gcount+B2+G2 = 447243769829393707157917142500771840
log2(N) = 118.4285447065236
B*Gcount − m = 218380746987008646073201729736704
```

`B` has 118 bits. The stage-1 **recovered** index i0 needs 235 bits; do not store it in the 16-byte record index. The record holds j (or a logical record number); k is the current giant counter, and their product/sum is assembled into four limbs. This is another distinction that a “118-bit indexing” description must preserve. `B*k` is not a two-limb multiplication result.

Two 112-byte merge arrays for B babies occupy exactly
`50091302220892095201686719960086216704` bytes, log2=125.2358996285812. This is a minimum for that pair of arrays, **not peak total attack storage**. A streaming giant scan does not require storing all giants. No size-based rejection follows.

## 2. Exact search and deterministic sorting ledger

The following is an explicit exhaustive algorithm. `MUL_FIXED` accepts a canonical four-limb scalar and handles zero digits. Modular scalar state may remain Montgomery-encoded between updates but must be converted for digit extraction. All loops and helper costs belong in §5.

```
read n and obtain/parse T and A_d, using an explicitly priced input access method
compute d,m,B,Gcount,B2,G2,a,beta and inverse jump factors
build positional tables F[G], F[A_d], F[T] cold

x = 1
for j in [0,B):
    baby[j] = (EXACT96(MUL_FIXED(F[G], x)), u128(j))
    if j+1<B: x = x*a mod r
stable_bottom_up_merge_sort(baby, scratch)
y = 1
for k in [0,Gcount):
    key = EXACT96(MUL_FIXED(F[A_d], y))
    if exact_binary_search(baby,key) returns j:
        candidate = wide(j)+wide(B)*wide(k)
        if candidate<m: i0=candidate; break
    if k+1<Gcount: y = y*a^(−B) mod r

z = zeta^i0 mod r
x = z
for j in [0,B2):
    baby2[j] = (EXACT96(MUL_FIXED(F[G],x)),u128(j))
    if j+1<B2: x = x*beta mod r
sort baby2 with the same algorithm
y = 1
for k in [0,G2):
    key = EXACT96(MUL_FIXED(F[T],y))
    if search(baby2,key) returns j and j+B2*k<d:
        i1=j+B2*k; break
    if k+1<G2: y = y*beta^(−B2) mod r
s = z*beta^i1 mod r
verify [s]G=T; output canonical scalar
```

Reusing the large array for baby2 is safe once i0 is retained. An upper bound may run every giant rather than rely on early stopping. Modular exponentiation here means scalar arithmetic in F_r, distinct from `[x]P`.

**Exact key:** canonical affine x followed by y, 48 bytes each, all 96 bytes compared. Compare twelve fixed big-endian u64 words lexicographically; each word can be loaded and byte-reversed with scalar instructions. No `memcmp` expected-length assumption. A lexicographic comparator touches at most twelve word pairs even if eleven leading words coincide. Table keys within one stage are distinct by their multiplicative-order argument, but the worst-case comparator does not require random keys or distinct prefixes. Including an index tie-break is optional and costs two extra words if used. Use the same endian convention for sorting and searching.

**Sort:** iterative stable mergesort. For run widths `1,2,4,...`, merge adjacent runs into the other array, including copying unpaired tails. Choose left on equality. Alternate array roles; retain the final array pointer instead of a gratuitous final full copy. Each pass writes each of b records exactly once. Its comparison count is at most `b*ceil(log2 b)` and its full-record copies at most that same bound. No recursive stack indexed by a 64-bit total byte size is needed.

**Search:** ordinary half-open interval binary search using two-limb low/high/mid, one three-way key comparison at each iteration; return immediately on exact equality. The bound is `ceil(log2(b+1))` comparisons. In particular, searching 1024 keys may require **11**, not 10, comparisons.

Define

```
S = B*ceil(log2 B) + B2*ceil(log2 B2)              # sort comparisons
Q = Gcount*ceil(log2(B+1)) + G2*ceil(log2(B2+1))   # lookup comparisons
D = B*ceil(log2 B) + B2*ceil(log2 B2)              # full-record copies
P = B+B2                                        # baby record writes
```

At d=2^20, `ceil(log2 B)=ceil(log2(B+1))=118`, and
`S+Q = 52774764839868457444634222815090856960`.
Each copy transports 112 bytes, fourteen words, requiring at least fourteen loads and fourteen stores in an ordinary local copy, **plus** addressing/control/transport. Sort moves up to `112*D` bytes from source to destination, or `224*D` bytes counting both reads and writes. Query comparison reads are additional. The mere sorting loop cannot be priced as one field operation per key.

A deliberately simple implementation rereads both source records for each sort comparison and rereads the selected record for its copy. It then needs at most

```
Arec = 2*S + Q + 2*D + P
R_dictionary <= (S+Q)*Kcmp + Arec*Kaccess + Kloop
```

logical record transactions. `Kcmp` prices comparing local returned buffers, `Kaccess` prices remote/local read or write including record movement and addressing, and `Kloop` prices all two-limb cursor updates, run arithmetic, binary-search arithmetic, and loop branches. This conservative algorithm is slower than a merge retaining lookahead records but is deterministic and easy to falsify. The 28 load/store minimum is not itself an upper price. A proposed local comparator budget such as 128 instructions must be checked against its code, including buffer loads and returns. Code with a generic library sort is insufficient evidence for these exact constants.

An alternative deterministic byte-radix sort has 96 passes, stable counting scatter, and exact keys. It can avoid comparison costs but must zero 256 counters, count and prefix-sum with multiword totals, route each scatter, and copy records on each pass. Its 96-pass movement versus 118-pass merge movement is a finite comparison, not a license for unit-cost global scatter. Compressed exact 48-byte point encodings can reduce movement if sign, canonicality, infinity representation and conversion cost are priced; x alone is **not** an exact point key (`P` and `−P` collide).

### Hashing comparison without an ideal hash oracle

A concrete collision bound is possible without assuming random point encodings. Regard a 96-byte key as a 768-bit vector. Choose an independent uniform `t x 768` binary matrix and a t-bit offset; evaluate the affine linear hash bit by bit with AND/XOR/parity. For two distinct keys the collision probability is exactly 2^−t. A scalar parity implementation can fold one u64 with shifts/XORs; twelve words per output bit gives a finite, readily priced implementation. Charge all `768*t+t` random bits, matrix storage, generation, evaluation and routing. Cryptographic hashes are alternative concrete implementations, but random-oracle collision behavior would be an additional assumption.

For N distinct compared keys, the union bound is `N*(N−1)/2^(t+1)`. With N below 2^119, t=256 gives a bound below 2^−19. It is not acceptable to use 128-bit fingerprints and assert no collisions at this scale: the birthday expectation is enormous. Independence from keys is essential; this bound is for keys fixed independently of the random matrix, as in the exhaustive deterministic lists.

Fingerprint collisions need not cause incorrect recovery: store all records in collision buckets, compare full exact keys, and never overwrite a bucket member. Then collisions affect work rather than correctness. An explicit robust design sorts `(fingerprint,exactkey,index)` deterministically and merges matching-fingerprint runs with exact comparison. Its worst case falls back to the already charged exact sort (or must bound cross-run comparisons). This design adds hashing and wider records and has no automatic gain. A faster expected-time chained dictionary needs a specified bucket count, allocation, pairwise/universal collision analysis, and tail budget. Use a fixed construction cap and exact-sort fallback, or charge a bounded number of resampled seeds and failure probability. “Rehash until good” is not a finite total bound. Recomputing an exact point from an index to verify a fingerprint also costs another scalar multiplication each time; it is not a free check.

## 3. A concrete 64-bit segmented representation—and its limits

**PROVED representation; ASSUMED transport price.** Here is a possible replacement for an illegal 118-bit flat pointer. It establishes that addressing is not intrinsically impossible; it also exposes the missing machine assumption.

Use q=4096 records per leaf. A logical index is `(hi,lo)`, two u64 limbs in little-endian order, high unused bits zero. Offset is `lo & 4095`; page number is `index >> 12` using two word shifts and OR. Stage 1 needs `ceil(B/q)` pages. Let `h=ceil(log2 ceil(B/q))=106`; provision a complete binary routing tree with `2^h` leaf workers. Each leaf has two contiguous `q*112=458752`-byte arrays, with ordinary local 64-bit pointers. Its local byte offset is `offset*112=(offset<<7)−(offset<<4)`, below 2^19. No record straddles a leaf page. Store sort array identity in the request, not in a gigantic base pointer.

A controller at the root carries the whole logical index in two registers. A request includes its 106-bit destination path, offset, operation, array tag, and up to fourteen record words: reserve **20 words / 160 bytes** per packet. Each node has local parent/left/right ports. Route one path bit at a time, updating two-limb path state. Return a read reply or write acknowledgement along parent ports; with one outstanding controller request, no global return address or routing table is needed. Serial operation avoids concurrent queues and contention; elapsed time is irrelevant to the score. Explicitly include request and reply movement. This scheme cannot be implemented by casting a page number to `size_t`.

A u128 increment uses ADD/ADC; comparison uses high CMP then low CMP; subtraction uses SUBS/SBC; midpoint is low plus a right-shifted two-limb difference. Any shift crossing a limb uses shifts plus OR. Saturate merge endpoints with compare/min. Recovered i0 and modular exponent indices use four limbs. A 118-by-118 product uses four 64-by-64 products, each MUL/UMULH and carry propagation into four limbs; no unit-cost 236-bit multiply is assumed. General n counters may need four limbs since `n<r`.

Define `E20` as an **upper bound**, summed over sender, receiver, router, and any bridge processors, for one adjacent-link transfer of a 20-word packet, including word movement, mailbox/queue protocol, path update, notification, acknowledgement bookkeeping and all executed polling. Define `L14` for the local fourteen-word array access and `I128` for controller/address work. Then a conservative record transaction price is

```
Kaccess <= I128 + L14 + 2*h*E20.
```

These are counting obligations, not measured prices. A local software loop for copying twenty words already has forty word loads/stores, cursor/loop operations and notification work. A network hop is not a single AArch64 load. If idle receivers busy-poll, those instructions must be added; this serial ledger assumes blocking delivery without executed idle polling and a bounded wakeup routine. Link hardware/DMA must not erase charged transfers from the equivalent-work model.

Allocate recursively from the root, sending each child its range and initializing port state. For `V=2^(h+1)−1` nodes, charge `V*Knode_init`, all initialization packets, and all code/advice distribution bytes. Charge root/controller startup and teardown. The leaf arrays can be initialized explicitly using `2*q*14` word stores per leaf plus loops; allocating them is not a free zero page. Alternatively avoid zeroing uninitialized records and prove every read is preceded by a write. Do not charge both alternatives. A heap allocator over a giant global address is unnecessary: local fixed arenas suffice. Allocation and routing of fixed-base tables follow the same scheme if needed.

For an explicit provisioning bound, reserve 4096 bytes of code/state/packet buffers **at every tree node** (this is an implementation budget to check, not a compiled-size observation). Two padded record arrays plus node reserves are bounded by

```
M_tree <= 224*q*2^h + 4096*(2^(h+1)−1)
       < 75101381761847746819065098905839468544 bytes.
```

Add controller code/scratch, positional tables and their routing nodes, batch buffers, scalar constants/certificates, retained input and retained randomness. Stage 2 can reuse record leaves. Program replication is in peak memory and its transmission is cold work. A different leaf size trades node count and local storage; it cannot remove transport costs by notation.

**What the protected rules establish:** 64-bit scalar instructions, charging of larger arithmetic, transfers and aggregate coordination, and no memory cap. **What they do not establish:** a unit-cost globally addressed 2^125-byte memory, a particular interconnect/topology, a bound on `E20`, bounded operating-system allocation/notification, fault tolerance, or a physically available network of 2^106 workers. This hypothetical finite tree is a permissible analytic candidate only with a defensible equivalent-instruction transport implementation. No claim is made that such a network exists. Reliability may be an ordinary ideal-machine assumption if disclosed; fault/retry work cannot be omitted from a claim that includes real faults. A conservative software simulation with a slower explicit storage model could also be priced. The rules do not imply impossibility, but they also do not supply the missing constants.

## 4. Cold positional windows, not free advice

For each base P and row `ell`, define
`F[P,ell,v]=[v*2^(w*ell)]P`, `0<=v<2^w`, with `k=ceil(255/w)` rows. This conservatively fills the unused high digits in the final row too. Full three-base Jacobian cell count is `3*k*2^w`, at 144 bytes per cell.

Initialize row zero and each infinity cell. Derive successive row seeds by w doublings. Copy the seed into digit-one cells, then fill `v=2..2^w−1` by adding the seed to the previous cell. This costs

```
A_build = 3*k*(2^w−2) full additions
D_build = 3*(k−1)*w doublings
Z_build = explicit cell initialization/copy work
```

in addition to every table write, address calculation and routed access not internal to the point kernel. Per query, extract k digits from a canonical 255-bit scalar, load k cells, copy the first to an accumulator, and do k−1 full additions. A fixed-time implementation can include zero digits via complete operations. No query doublings remain; they were paid in the row seeds. If using mixed additions instead, normalize the tables cold and charge their normalization, different cell sizes, and exceptional cases. Do not use a mixed-add timing for Jacobian cells.

| w | k | Three tables: bytes (log2 bytes) | Cold full additions | Cold doublings | Query additions |
| --- | ---: | ---: | ---: | ---: | ---: |
| 8 | 32 | 3,538,944 (21.75489) | 24,384 | 744 | 31 |
| 16 | 16 | 452,984,832 (28.75489) | 3,145,632 | 720 | 15 |
| 24 | 11 | 79,725,330,432 (36.21432) | 553,648,062 | 720 | 10 |
| 32 | 8 | 14,843,406,974,976 (43.75489) | 103,079,215,056 | 672 | 7 |
| 64 | 4 | 31,875,973,759,370,105,192,448 (74.75489) | 221,360,928,884,514,619,368 | 576 | 3 |

All integer entries are independently recomputed. w=8 alone is reported implemented by the requester. The others are extrapolations, not measurements. A 64-bit digit fits a register, but multiplying it by 144 or adding a row/base selector needs a wider address. Even **one** w=64 row exceeds a 64-bit byte address. Apply segmentation to table lookup and construction too; the huge stage-1 routing tree is not a substitute for pricing the separate positional-table accesses.

For perspective only, inserting requester sample prices `add=7246`, `double=2989`, normalization=`722782/256`, serialization=1362, and one Fr update=176 gives:

| w | log2 of query arithmetic/encoding projection divided by 2000 | log2 of cold addition+doubling projection divided by 2000 |
| --- | ---: | ---: |
| 8 | 125.26767 | 16.44888 |
| 16 | 124.24938 | 23.44224 |
| 24 | 123.69198 | 30.90158 |
| 32 | 123.21209 | 38.44215 |
| 64 | 122.13449 | 69.44215 |

These are explicitly **partial sampled-price projections, not bounds, scores, or global lower bounds**. The w=8 table uses `31*7246`, whereas the separately implemented query sample is 224727; using that sample produces 125.268305. The table does not claim all missing costs vanish or that a larger window gives a monotone TOTAL improvement. Construction is cold even where numerically subdominant. Its enormous bytes, accesses and setup must still be counted. The 64-bit construction projection would take about 2^80.41 scalar instructions just for additions/doublings; it is not an M5 experiment.

## 5. Complete accounting obligations and W(n)

Use either actual scalar instructions throughout (`H=0`) or a justified mixture `H+R/2000`. Do not charge `[x]P` as one reference operation. The reference G1 unit is an incomplete batched affine 6M convention with S=M and A=0, **not** a complete-add routine. The documented 383-instruction Fp multiply and the requester 385 sample differ; this does not change C. Full add 7246, mixed add 5414, doubling 2989, scalar mult 862886 and fixed-base 224727 are **MEASURED—REQUESTER** samples with stated harness limitations. No worst-case price for them is proved here. [Organizer cost convention](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/docs/COST_MODEL.md).

Let `K_Fr`, `K_Fp`, `K_add`, `K_dbl`, `K_to`, `K_from`, `K_digit(w)`, `K_invFp`, `K_ser96`, `Kaccess`, `E20`, etc. be checked scalar-instruction upper bounds for the actual routines. A useful ledger must instantiate every one or leave the total unresolved as this audit does.

| Component | Explicit count / obligation |
| --- | --- |
| Input | `R_input(L,d)`: actual bytes L traversed, parse state, ASCII hex decoding, canonical coordinate checks, selected-point conversion, and any selected curve/subgroup checks. Streaming to A_d can require scanning preceding points; no need to validate unused points. If T comes late in JSON, reaching it may require traversing the rest of A. |
| Public arithmetic setup | Compute d,m, B, Gcount and stage-2 dimensions with bounded four-limb division/square root or charge construction of embedded derived constants. Compute a, beta, inverse jump factors, Montgomery R/R², and all table selectors. Each fixed exponent e<r costs at most 254 squarings+254 multiplies via simple binary scalar exponentiation, plus bit/loop and conversion instructions. Exponents reduced modulo r−1 and computation of `−B mod m` require multiword arithmetic too. |
| Primitive-root advice | The task gives zeta=7 and says its certificate was requester-verified; no independent full factor-certificate verification was performed here. Treat primitiveness as an explicit supplied premise. If an attack instead embeds a searched generator or a certificate as advice, price its search/construction and storage. Verification of a supplied complete factorization uses `7^((r−1)/q)!=1` for every distinct prime q and a factor-product check. Do not price the search as free merely because its output is short. Public-profile constants/design effort are excluded, not arbitrary searched advice. |
| Fixed tables | `A_build*K_add + D_build*K_dbl + R_zero/copy + R_table_addresses/transfers + R_alloc`. Include code distribution. Do not add a second price for a store already inside a measured kernel; distinguish kernel-local output and later distribution. |
| Scalar streams | Four streams contain lengths `B,Gcount,B2,G2`. Exactly `U=N−4` multiplicative state updates suffice if no pointless final update is performed. Charge `U*K_Fr`; keep constants/state Montgomery encoded if desired. |
| Conversion and digit extraction | For each of N queried scalars, convert Montgomery state to canonical four-limb integer unless the actual API already does so, then extract k digits. Charge `N*(K_from + K_digit(w))`; charge ingress conversions of scalar seeds/constants separately. Raw Montgomery residues are not the digits of the requested scalar. A w=24 digit can straddle 64-bit boundaries; a w=64 top digit needs a 255-bit mask. |
| Point queries | `N*((k−1)*K_add + K_acc_copy + R_k_cell_reads(w))`; include first/zero digits, table addressing, loop control and kernel exception paths. If using measured MUL_FIXED, replace these included internals by its justified bound rather than adding them twice. |
| Normalization | Batch each of the four streams separately. For stream length l and batch capacity b, use `floor(l/b)` full batches plus one batch at `l mod b` if nonzero. Every batch has a residual inversion, not just a 3M amortization. Standard nonzero-Z Montgomery trick uses `3*(t−1)` Fp multiplications for inverse Z's, one inversion, and per point one square plus three multiplications for `(x/Z²,y/Z³)`, i.e. `7t−3` multiply/square equivalents with S=M, plus loops/buffers. Inversion can conservatively use Fermat exponent p−2 with at most 380 squarings+380 multiplies, plus control. Verify every Z nonzero or implement a masked zero-safe batch routine. Infinity table entries must not enter a nonzero-only batch unchecked. |
| Encoding/records | `N*K_ser96` for canonical full affine keys, with both coordinate Montgomery exits if not internal to serialization. The requester 1362 is for already-affine input. Charge packing 16-byte j, local buffer movement, and baby writes; sorting/search transactions are in §2. |
| Exact dictionary | `(S+Q)*Kcmp + Arec*Kaccess + Kloop`, including copies, both arrays, initialization alternative, multiword bounds and all routers. No randomness or retries in the deterministic design. |
| Reconstruction | Assemble canonical wide i0/i1, scalar powers `zeta^i0`, `beta^i1`, final Fr product, reductions and conversions. The stage-2 scalar seed must be stored safely after reusing baby storage. |
| Verification and output | One independently correct `[s]G`, exact compare to T, `1<=s<r`, canonical 32-byte scalar / 64 lowercase hex characters and output framing, actual output transfer. If a fixed G table is reused, charge its query; no duplicate setup. Handle a verification failure explicitly rather than report an unverified candidate. |
| Reliability/randomness | Deterministic exact algorithm needs no fresh coins and no algorithmic restarts. Hashing/kangaroo variants must add generation, storage, capped trials, failed work and success amplification. Any system-fault model adds its own retries. |

The normalization formula follows directly from prefix products, a backward inverse pass, and coordinate scaling; it is an **independent conservative arithmetic decomposition**, not a claim about blst's exact internal instruction path. The requester batch-256 sample cannot be applied at every t, and fixed setup removed by incremental measurement must be restored once per actual call. A validity flag sampled at setup does not certify all future batches. Conversely it is unnecessary to check every generated point on-curve/subgroup if correctness follows from proven complete routines and validated inputs.

For all `1<=n<r`, one valid parameter choice is

```
d(n)=2^min(32,floor(log2 n))
m(n)=(r−1)/d(n)
B(n)=ceil(sqrt(m(n))); Gcount(n)=ceil(m(n)/B(n))
B2(n)=ceil(sqrt(d(n))); G2(n)=ceil(d(n)/B2(n))
```

because v2(r−1)=32 and `d(n)<=n`. Substitute these into N,U,S,Q,D,P and all setup/storage formulas. The **conditional** family is

```
W(n,L; implementation,transport)
  = [R_input + R_setup/advice + R_tables + R_scalar_updates
     + R_scalar_conversion/digits + R_point_queries + R_normalize
     + R_serialize/pack + R_dictionary + R_allocate/coordinate
     + R_reconstruct/verify/output + R_trials/failures]/2000.
```

Every R is total across processors. It is a reproducible accounting schema, not a numerical W(n) until the parameters are bounded and overlap between kernels is audited. A budget in instructions can be divided by 2000 only once at the end.

**Input framing ambiguity:** profile coefficients have fixed canonical hex lengths, but the profile text alone does not bound JSON whitespace or provide a random-access offset to A_d. An arbitrary amount of whitespace before the needed value is a concrete counterexample to an input-length-independent parser bound if all valid serializations are admitted. This does not change the secret distribution and does not show that the organizer emits such inputs. For a concrete compact generator serialization, supply its byte bound (roughly hundreds of bytes per point at n=2^20, hence a few hundred MB); for a supplied random-access array interface, price its offset/index construction. Until then use L explicitly. One need not ask the requester for a secret or read every unused power to resolve this representation detail.

Peak memory is

```
M_peak <= M_record_layout + M_positional_tables/layout
          + M_code/state + M_batch + M_input_retained
          + M_constants/certificates + M_randomness + M_transport_buffers,
```

with lifetime reuse explicit. Input can be streamed, old table rows reused only if not needed later, and stage-2 records can reuse stage-1 arrays. Cold advice includes parameter-dependent tables and any searched constants; target-dependent A_d/T tables are preprocessing too. The two-array number alone does not satisfy this peak ledger.

## 6. Published lower-memory alternative, costed rather than idealized

**SOURCED algorithm; independent accounting below.** Cheon's §3.1 implicit kangaroo represents scalar-field states u by points `[u]G`. For stage 1, jump choices multiply a state by `a^ell`; implement this as `Q <- [a^ell]Q` on a changing point Q. Tame and wild paths start from known `[a^c]G` and A_d respectively. A point-dependent partition must agree on equal points. Exact collision plus tracked distances recovers i0 modulo m. Stage 2 analogously uses beta and an appropriately scaled T. This is a lower-storage published alternative; its approximate exponentiation counts above are not a modern instruction/success proof. [Cheon §3.1](https://www.math.snu.ac.kr/~jhcheon/publications/2010/StrongDH_JoC_Final2.pdf).

**Important falsification:** changing-Q jumps cannot reuse the three fixed-base positional tables. Each jump is a scalar multiplication by a precomputed scalar **on the current point**, not one point addition and not necessarily one fixed-base multiplication. Jump-scalar multiplication can use its own fixed-scalar addition chain, whose construction and exceptional paths must be priced; it is not the same optimization.

For one bounded run, let J be the chosen jump-set size, L1,L2 its capped step counts, Theta its distinguished-point density, Dp the actual number retained, and K_jump the worst-case changing-base scalar-mult bound (including scalar-specific recoding or tables). Define

```
R_run <= R_jump_set_setup + (L1+L2)*(K_jump + K_partition
          + K_canonical_point + K_distance_update + K_DP_test)
         + R_DP_dictionary(Dp) + R_DP_transfers + R_collision_check
         + R_reconstruction/verification + R_random_sampling.
```

All jump scalars and seed generation cost Fr exponentiations; store their distances and scalars. At most L1+L2 distinguished points can be retained without a density assumption. Capping the table and terminating/restarting when it fills bounds memory but lowers success. Floyd/Brent-style detection reduces table memory differently and increases function evaluations; it is a separate schedule to price, not a free replacement.

A concrete partition can be a seeded finite hash of canonical encodings with an exact implementation and charged seed; its equivalence to a random walk is **heuristic**, not supplied by universal pairwise collision bounds. Normalize/serialize often enough that two equal projective points choose the same jump. Hashing raw Jacobian triples fails this requirement: `(X,Y,Z)` and `(u²X,u³Y,uZ)` represent the same affine point but can choose different jumps. Exact DP collision verification and travel arithmetic are mandatory. Distance totals and wrap modulo m/d need multiword counters; a run cap gives their maximum bit length.

For a supported one-run production success lower bound p at the actual caps, t independent runs give `1−(1−p)^t`, so take
`t=ceil(log(0.61)/log(1−p))` if a single run does not already reach 0.39. Charge at most t complete run budgets plus any safely shared one-target setup, all failed runs, fresh seeds and verification. No p is established by the requester's restricted controls. An approximate expected runtime does not itself establish p by a deadline. If a genuine expected-time upper bound E for a correct Las Vegas algorithm existed, Markov would give success at least 0.39 by budget `E/0.61`; the paper's approximate random-walk estimate is not that bound.

**Magnitude only:** inserting the requester ordinary-mult sample 862886 into `2*sqrt(m)` gives log2 of stage-1 multiplication-only W approximately **127.18**, before partitioning, normalization, DP work and amplification. This is not an upper bound; specialized fixed-scalar jumps might change it. It illustrates why quoting the same square-root asymptotic and saying “low memory solves the addressing objection for free” is false. A fair storage example is a cap of 2^28 distinguished-point records. At an assumed 160 bytes per record this is 42.95 GB before dictionary overhead; two such arrays would be 85.90 GB, so a 128 GB machine can plausibly hold this cap with careful implementation. Under the same walk/density heuristic, choosing `Theta=2^−92` gives about `2*sqrt(m)*Theta = 2^26.42854` stage-1 retained records on average and a detection tail of `2^92` jumps, far below `2*sqrt(m)`. Thus small Theta does **not** by itself destroy the square-root advantage or force a large memory: it is the jump cost and unsupported finite-budget success model that remain critical. Actual hash evaluation, online dictionary work, cap-overflow probability, tail work and restarts still need pricing. This example is not a proven occupancy or success bound. Choose and price the time/storage tradeoff, do not inherit both BSGS arithmetic and kangaroo memory.

## 7. Fair G1 comparator and competitiveness

The strongest applicable **generic G1 comparator identified here** is an automorphism-aware Pollard rho, including order-three `(x,y)->(omega*x,y)` and negation, giving six-element orbits on nonzero prime-order points. For `lambda^2+lambda+1=0 mod r`, the cubic map acts as scalar lambda; maintain the accompanying coefficient transformation when canonicalizing. Orbit size six is valid because a nonzero prime-order point cannot be fixed by nontrivial lambda or negation. Fruitless cycles, partition design, exact point normalization, canonical representative selection, coefficient updates and DP transport are real costs. The automorphism speedup is not a price-free division by sqrt(6). The cited primary implementation/papers support using this comparator, but not a numeric BLS12-381 TOTAL score.

Under an explicitly **ASSUMED independent random-orbit birthday model**, a bounded number t of visited orbits has success approximately `1−exp(−t²/(2*(r/6)))`. Thus success 0.39 requires roughly

```
t39 = sqrt(−2*ln(0.61)*r/6), log2(t39)=126.1277875.
```

This is a visit count, not W and not a proven probability for an implemented walk. Add all per-visit work, cold r-adding tables, coefficient arithmetic, cycle escape, DP storage/addressing, failures, final modular inversion and verification. Inserting 7246/2000 alone raises this illustrative exponent to about 127.985, before the rest. Using the reference 6M addition unit could give a different base cost only after implementing a valid batching/exception scheme; one cannot choose the cheaper convention solely for the preferred algorithm.

For a deterministic comparator with transparent uniform-success accounting, ordinary BSGS can cover a prefix of `ceil(0.39*(r−1))` scalar values. Generate additive baby/giant lists with complete additions, handle infinity, use exact keys and the **same** segmented dictionaries. Its leading list size sum is about `2*sqrt(0.39*r)`, log2 approximately 127.75. It is more than a group-operation count once sorting/addressing are included. With unbounded unscored storage it is unfair to reject this baseline for memory while allowing enormous Cheon tables, or vice versa.

The eight-bit Cheon arithmetic-only 125.2683 and the optimized-rho visit-only 126.1278 are different accounting levels. Comparing them as final scores would be invalid. Cheon may remain competitive after a careful dictionary implementation, or lose much of its advantage in a conservative routed layout. This audit cannot settle that comparison without the missing costs.

This is not an optimality claim across all algorithms. Pairing maps and finite-field DLP methods must be considered before asserting a globally strongest G1 attack; a G1 target can be mapped via a public G2 generator, even though the other challenge targets are independent. An NFS/TNFS headline “security bits” number is not already an AArch64 total-work bound in this model. No fully normalized competing finite-field implementation/ledger was obtained here; no global strongest-known or novelty assertion is warranted.

## 8. Falsification findings, strongest responses, and checks

| Rank / finding | Concrete objection | Evidence-based response / disposition |
| --- | --- | --- |
| 1 / unsupported total score | 120-bit budget gives 5944 instructions/encoding, versus 229088 sampled arithmetic-only eight-bit projection. Missing costs cannot repair that projection downward. | A new implementation or different success-limited algorithm could be cheaper; the present projection is rejected, not Cheon itself. |
| 2 / wide addressing omitted | `112*j` for a 118-bit j cannot be evaluated/addressed by a 64-bit pointer; w=64 positional cells also overflow flat byte addressing. | Two-limb logical indices plus finite routing are possible (§3). Supply transport/allocation prices; do not invent a memory cap. |
| 3 / sampled values promoted to bounds | Incremental loop counts remove fixed costs; 64/128/256 loops and 64 scalar samples cannot bound every production path or batch tail. | A straight-line/branch-complete analytic instruction bound is allowed and preferable to an impossible exponential benchmark. |
| 4 / arithmetic and representation gaps | Digits of a Montgomery scalar are wrong; raw projective hashes do not respect point equality; i0 does not fit the 16-byte record. | Canonical conversions, normalization, complete operations, and four-limb recovered indices repair correctness, with costs. |
| 5 / dictionary optimism | 1024-key search can take 11 comparisons; long prefixes defeat average `memcmp` pricing; arbitrary hash collisions defeat overwrite dictionaries. | Worst-case fixed-key comparison and merge/copy bounds, or a specified collision-bounded dictionary with fallback. |
| 6 / success extrapolation | Uniform production probability of the restricted `i0<64` control is about 2^−228.857. | Treat controls as implementation evidence only; exhaustive exact algorithm has an independent mathematical success proof. |
| 7 / free low-memory speedup | Implicit kangaroo's changing base prevents reuse of three positional tables. | Price each jump's scalar chain and DP overhead; independently support finite-budget success/restarts. |
| 8 / hidden serialization assumption | Unbounded legal JSON whitespace can make a bound in n alone false for a streaming parser. | Bind to the actual generator serialization/interface and its byte length; this is not a cryptanalytic obstruction. |

Independent local checks performed in this audit:

- All four pinned files and matching HEAD copies were downloaded and compared; SHA-256 values above were computed from the bytes.
- Integer-only Python recomputed divisibility, v2(r−1)=32, both square-root dimensions, N, padding, index widths, array bytes, sort/search comparison bound, all positional table dimensions and cold operation counts. Floating-point log2 was used only to display logarithms, never to decide ceilings.
- A faithful additive cyclic-group model exhaustively tested every nonzero secret for every divisor d of p−1 for `(p,zeta)=(97,5)` and `(193,5)`: **3840/3840 recoveries**. The model checked primitive-root order, exact equality, padding rejection, both stages and final scalar equality. It does not test BLS arithmetic or network code.
- No requester blst instruction experiment, full-production search, or production success experiment was independently rerun. No BLS kernel source/binary from the requester was provided to establish the claimed upper prices. No Yukon submission, deployment, publication or wallet action occurred.

### Reproducible integer ledger and relation checker

This uses only Python's standard library. Save/run as scratch code; it is included here so the delivered report is self-contained. It reproduces arithmetic projections, **not** instruction upper bounds.

```python
from math import isqrt, log2, ceil, log
r = int('73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001', 16)
d = 1 << 20
assert (r-1) % d == 0
assert ((r-1) & -(r-1)) == 1 << 32
m = (r-1)//d
csqrt = lambda x: isqrt(x-1)+1
B = csqrt(m); Gc = (m+B-1)//B
B2 = csqrt(d); G2 = (d+B2-1)//B2
N = B+Gc+B2+G2
S = B*(B-1).bit_length() + B2*(B2-1).bit_length()
Q = Gc*B.bit_length() + G2*B2.bit_length()
print('m,B,Gc,B2,G2,N',m,B,Gc,B2,G2,N)
print('padding',B*Gc-m,'comparisons',S+Q)
print('array bytes',224*B,'log2',log2(224*B),'log2N',log2(N))
print('sample-only 8bit',log2(N*(224727+722782/256+1362+176)/2000))
for w in (8,16,24,32,64):
    k=(255+w-1)//w
    cells=3*k*(1<<w); adds=3*k*((1<<w)-2); dbl=3*(k-1)*w
    print(w,k,cells*144,adds,dbl,
          log2(N*((k-1)*7246+722782/256+1362+176)/2000),
          log2((adds*7246+dbl*2989)/2000))
q=4096; h=(((B+q-1)//q)-1).bit_length()
print('tree depth, memory upper expression',h,224*q*(1<<h)+8192*(1<<h))
print('120-bit instruction budget per encoding',2000*2**120/N)
print('rho orbit heuristic t39 log',0.5*log2(-2*log(.61)*r/6))
print('kangaroo sample mult-only log',log2(2*csqrt(m)*862886/2000))

cases=0
for p,z in ((97,5),(193,5)):
    assert len({pow(z,t,p) for t in range(p-1)})==p-1
    for dd in range(1,p):
        if (p-1)%dd: continue
        mm=(p-1)//dd; b=csqrt(mm); gc=(mm+b-1)//b
        b2=csqrt(dd); g2=(dd+b2-1)//b2
        a=pow(z,dd,p); beta=pow(z,mm,p)
        for s in range(1,p):
            babies={pow(a,j,p):j for j in range(b)}
            i0=None
            for k in range(gc):
                point=pow(a,-b*k,p)*pow(s,dd,p)%p
                j=babies.get(point)
                if j is not None and j+b*k<mm:
                    i0=j+b*k; break
            assert i0 is not None
            babies2={pow(z,i0,p)*pow(beta,j,p)%p:j for j in range(b2)}
            recovered=None
            for k in range(g2):
                point=pow(beta,-b2*k,p)*s%p
                j=babies2.get(point)
                if j is not None and j+b2*k<dd:
                    recovered=pow(z,i0,p)*pow(beta,j+b2*k,p)%p; break
            assert recovered==s
            cases+=1
print('toy relation cases',cases)
```

## 9. Ranked next experiments on an Apple M5 Max with 128 GB

These are **proposed bounded research experiments**, not measurements of that machine. Do not execute the exponential attack. Estimate runtime after a short pilot using actual throughput; instruction equivalents and wall time are different. The capacities below refer to the requested 128 GB machine, not an inspection of this seat. Reserve at least 16 GB for system/code/scratch before attempting large allocations. Use fixed development vectors and a separately frozen holdout set; record seeds, compiler, source hashes and instruction-accounting method before tuning.

1. **Close correctness and per-call instruction bounds first.** Budget 2–6 engineer hours, with test runs capped at minutes. Audit/compile scalar Fr conversion, fixed-base w=8/16, complete add/double, normalization for every batch size 1..256 and serialization. Controls: zero digits, all-one limbs, r−1, carry chains, infinity entries, identical/inverse addends, arbitrary Jacobian rescalings, and boundary digits crossing limbs. Freeze 10,000 uniform full-width scalar/point holdouts in addition to edge vectors; compare ordinary multiplication and canonical encodings. Inspect all data-dependent branches and input-dependent loops analytically. **Kill a price claim** on any mismatch or any uncovered path exceeding it; sampled maximum remains only a sample. An M5 native timing is not a replacement for the scalar AArch64 instruction ledger.
2. **Implement exact segmented sorting/search with small pages that force carries.** Budget 1–4 hours; 2^20 records are 112 MiB per array, 2^24 are 1.75 GiB per array. Sweep 1–16 million records, page sizes 4..4096, and simulated logical high limbs near 2^64 boundaries without allocating gaps. Test adversarial common prefixes, identical fingerprints, reverse order, padded tails, 1024-key unsuccessful endpoints, and i0 four-limb assembly. Count every copy, word load/store, hop and control operation with instrumented reference routines. A 16-million-record merge is about 400 million record copies; at an **assumed** sustained movement rate of 1–10 GB/s, read/write traffic alone takes about 9–90 seconds, with comparison/routing overhead making minutes plausible. **Kill** flat-pointer truncation, missing messages/polling, or counters outside the analytic ledger. Small-depth tests validate code, not a physical 106-level network price; depth dependence still needs a proof.
3. **Measure cold w=16 before deciding on w=24.** w=16 uses 0.453 GB and 3.146 million additions. At a planning range of 10^5–10^6 complete additions/s, construction alone is roughly 3–32 seconds, plus initialization/measurement overhead. w=24 uses 79.725 GB and 553.65 million additions: approximately 9–92 minutes under that same explicitly hypothetical throughput, before overhead. Run a pilot, then cap the w=24 attempt by a predeclared time/memory budget; abandon it if the projected run exceeds that budget or memory pressure invalidates instrumentation. Keep frozen random scalar holdouts independent of tuning. **Kill** the extrapolation on exceptional-case mismatch, hidden conversion or row-address costs. w=32 needs 14.84 TB and w=64 about 31.9 zettabytes; neither full table fits this machine. Benchmark pieces and prove address formulas, never claim a full-table measurement.
4. **Test the implicit kangaroo's actual changing-base jump and partition.** Budget hours for development, then minutes per capped run. Benchmark full 255-bit fixed-jump scalars on changing points; distinguish that from fixed-base multiplication. Use exhaustive toy groups and frozen BLS restricted-index windows with both inside and outside controls, several independent seeds, rescaled projective representations and deliberately short cycles. Publish success-versus-step-cap and DP-density curves, all failures, seed generation and storage. A million ordinary scalar multiplications can take minutes or longer; stop at the pilot-derived cap rather than promise a production recovery. **Kill** any model with unequal transitions for equal affine points, unexplained fruitless cycles, or a success extrapolation based only on restricted secrets.
5. **Benchmark the competing G1 rho step under identical accounting.** Include six-orbit canonicalization, scalar coefficient updates, batch exceptions, partitioning, DP messages and cycle escape. Use small/exhaustive groups for collision statistics and full-width BLS inputs for kernel timing; these are different controls. Budget hours for implementation and bounded millions of step evaluations. **Kill a competitiveness claim** if one side receives free normalization, reference additions, advice, transport or restarts that the other side pays. A complete measured step still needs an explicit production random-walk heuristic or success argument.

At the quoted arithmetic-only w=8 projection, total scalar work is about 2^136.234 instructions. Even the deliberately optimistic hypothetical aggregate rate of 10^12 instructions/s would require about 3.2×10^21 years; routing/sorting are extra. A production execution is not a sensible validation experiment. The useful next result is a closed instruction ledger and defensible finite-budget success model, or a documented rejection of a specified score—not another unpriced bit estimate.