\section{Implications for Cryptographic Security}
\label{sec:implications}

\paragraph{For secp256k1.} Nothing in this study weakens the curve. The three structural features that make
\secp{} ``special''---the generalised-Mersenne prime, $a=0$, and complex multiplication by $\Z[\omega]$---translate into
exactly the constant factors the literature predicts and we measured: faster field reduction, cheaper doubling, a
$2\times$ reduction in doublings for scalar multiplication through GLV, and a $\sqrt6$ reduction in the expected
number of rho iterations (Section~\ref{sec:results}). Proposition~\ref{prop:end} shows that the endomorphism ring is as
small as it can be given $j=0$, so there is no further endomorphism to exploit; Proposition~\ref{prop:noquotient}
shows that the automorphism orbits cannot be turned into a smaller group; and the exact exclusion table
(Section~\ref{sec:secp}) confirms that every known algebraic transfer is inapplicable. The generic bound therefore
stands: solving one \secp{} instance costs about $\sqrt{\pi n/12}\approx 2^{127.0}$ group operations with the full
automorphism trick, roughly $2^{72}$ times the largest ECDLP computation ever completed. Preprocessing does not
change this conclusion: the per-instance cost $\sqrt{n/T}$ after a table of $T$ points requires $\sqrt{nT}$ work up
front, and a table reducing each instance to $2^{80}$ operations would itself cost $2^{176}$ operations and $2^{96}$
entries. Our measurements (Hypothesis~\Hname{H12}) put the constant at about $1.5$, which does not alter the
exponent.

\paragraph{For the signature schemes.} The security difference between ECDSA and BIP340 is structural: Schnorr's
linear response $s=k+ed$ admits a clean reduction and enables batch verification, aggregation and threshold
protocols; ECDSA's $k^{-1}$ obstructs all three and forces the proofs into stronger idealisations. Operationally
the two schemes cost the same to verify in \libsecp{} (within $5\%$), so the choice is about provable security and
protocol features, not speed. Batch verification is the one verification-side improvement that is both real and
consensus-neutral; its gain is bounded by the non-linear-algebra work per signature (square root, hashing) and
saturates near $3\times$ in our measurements. The quantities that actually decide security in practice are
nonce generation and side-channel resistance, which deterministic nonces and constant-time scalar multiplication
address; none of the algebra in this paper changes that assessment.

\paragraph{For SHA-256.} Our reduced-step experiments reproduce the easy end of the known picture: full diffusion
within a few steps, no detectable bias beyond a handful of steps, SAT preimages and collisions feasible only far
below the published dedicated-tool records. The step function being a bijection and the schedule being invertible
are reminders that the compression function alone offers no preimage resistance---the Merkle--Damg\aa rd
feed-forward does---and that ``free-start'' results must not be confused with attacks on the hash. The security
margin of SHA-256 is the distance between 31 (practical collision), 37 (theoretical collision), 45 (theoretical
preimage) and 64 steps; nothing here narrows it.

\paragraph{For automated discovery.} The pipeline's value was not a new attack but the discipline it imposed: every
candidate shortcut was either explained by existing theory, measured to be a constant, or refuted. An autonomous
agent working on cryptographic primitives is exposed to a specific failure mode---mistaking a constant-factor or
representation improvement for a complexity improvement---and the classification rubric, the operation counts and
the formal layer are the controls against it. We regard the fact that the agent produced zero claims of a break, while
producing a closed-form explanation of a set of implementation constants and a dozen quantified reproductions, as
the correct outcome.

\paragraph{Responsible-disclosure assessment.} No security-relevant result emerged that would require disclosure.
All instances attacked were synthetic; no real key, address or blockchain datum was used or produced; the code
released with the paper attacks only the reduced-size curves it generates itself.

\paragraph{Quantum computing.} The analysis above is classical. Shor's algorithm \citep{shor1997polynomial} solves the
ECDLP in polynomial time on a fault-tolerant quantum computer, with concrete resource estimates for 256-bit curves
in the range of a few thousand logical qubits \citep{roetteler2017quantum}; this, not any classical shortcut, is the
known threat to \secp{}, and it is independent of the curve's special structure.