\section{Experimental Design}
\label{sec:design}

\subsection{Environment}

All computations ran on Apple-silicon machines of the author's laboratory cluster (Table~\ref{tab:env} in
Appendix~\ref{app:env}): a laptop (Apple M5 Max, 18 cores, 48~GB) for development, reference checks, SymPy/PARI
verification and figure generation; two Mac Studio nodes (Apple M3 Ultra, 28 cores, 96~GB) and one Mac Studio
(Apple M2 Ultra, 24 cores, 64~GB) for the ECDLP studies, the SAT/SMT grids and the second hardware point of the
signature benchmarks. No GPU was used. Toolchains: Python~3.12 with exact integer arithmetic (SymPy~1.14, NumPy~2.5,
python-sat~1.9 with CaDiCaL bindings, Z3~4.15), native CaDiCaL and Kissat binaries, PARI/GP~2.19 for point counting,
Rust~1.95/1.96 for the ECDLP engine and the signature harness (\kk{}~0.14, rust-secp256k1~0.33 binding \libsecp{}),
Lean~4.35 for the formal layer. Every result file records the host, versions, seed and command line.

\subsection{Baselines and validation}

Before any novel configuration was tried, the standard algorithms were implemented twice and cross-validated
(Hypothesis~\Hname{H23}): a pure-Python reference (\code{src/wp34}, affine coordinates, one inversion per group
operation, explicit operation counters) and a Rust engine (\code{rho\_engine}: Montgomery arithmetic for $p<2^{62}$,
simultaneous inversion across batched walks, ChaCha20-seeded multipliers, per-thread counters and CPU timers). The
engine passes 8 Rust unit/integration tests (including $1\,052$ brute-forced small-curve instances) and 553 Python
tests on a fixture of 60 prime-order curves of 20--32 bits, every answer being re-verified by the Python reference as
$[d]G=Q$; each engine result additionally carries an \code{ok} flag set by an in-process re-verification. The signature
harness passes the 19 BIP340 vectors with both libraries, $1\,000$ cross-library checks per scheme and 200 checks
against the Python reference. SHA-256 is verified against \code{hashlib} for ten message lengths spanning the padding
boundaries, and the CNF encoder against the reference for $r\in\{1,4,16,64\}$ steps.

\subsection{Synthetic ECDLP instances}

Instances are random prime-order curves $y^2=x^3+ax+b$ over random primes of the target bit length, counted with
PARI/GP's \code{ellcard} (SEA) and retained only if $\#E(\F_p)$ is prime and $\ne p$; the $j=0$ family uses $a=0$ and
$p\equiv 1\pmod 3$, with $\beta$ and $\lambda$ computed and checked ($\phi(G)=[\lambda]G$) before use. Targets are
$Q=[d]G$ for uniformly random $d$. Five studies were run (Table~\ref{tab:ecdlp-config}); all jobs are single-threaded
except the parallel-efficiency study, so that operation counts are deterministic given the seed. The
distinguished-point density follows the engine default $2^{-(\lfloor\text{bits}/4\rfloor-2)}$ and each thread runs
128 interleaved walks, which fixes the post-collision overhead at about $128\cdot 2^{\lfloor \text{bits}/4\rfloor-2}$
extra iterations---negligible above 44 bits ($<3\%$) but visible at 20--28 bits, which is why pooled constants are
computed on $\ge 44$ bits and empirical exponents are also fitted on $\ge 32$ bits only.

\begin{table}[htbp]
  \centering\footnotesize
      \caption{ECDLP experimental configuration (seed 34; all instances verified).}
    \label{tab:ecdlp-config}
  \resizebox{\textwidth}{!}{%
    \begin{tabular}{@{}llllp{5.6cm}@{}}
      \toprule
      Study & Curves & Sizes (bits) & Instances/size & Configurations \\
      \midrule
      scaling, generic & random $a,b$ & 20--56 step 4 & 60 & BSGS ($\le 48$); rho Floyd, Brent ($\le 48$); rho DP $r=20$, $r=128$; rho DP + negation ($r=128$); kangaroo on $[0,n)$ \\
      scaling, $j=0$ & $a=0$, $p\equiv 1\ (3)$ & 24--52 step 4 & 60 & rho DP $r=128$; + negation; + $\phi$-orbits; + both ($r=128$ and $r=20$) \\
      iteration-function sweep & random & 36, 40 & 40 & $r\in\{2,3,4,8,16,20,32,64,128\}$ $\times$ mixed walk $\in\{$none$,2,4\}$ \\
      parallel efficiency & random & 56 & 12 & rho DP + negation, threads $\in\{1,2,4,8,16,28\}$ (M3 Ultra, 28 cores) \\
      time--memory & random & 36 (BSGS), 40 (rho) & 20 & BSGS memory $m\in\{2^{10},\dots,2^{20}\}$; rho DP density $2^{-2},\dots,2^{-14}$ \\
      preprocessing (Python) & random & 22, 26 & 60 & $T\in\{2^4,\dots,2^{12}\}$ stored distinguished points \\
      \bottomrule
    \end{tabular}
  }
  \par\smallskip{\footnotesize Nodes: generic scaling, sweep and parallel study on M3U96a (Apple M3 Ultra); $j=0$ scaling and time--memory on M2U64 (Apple M2 Ultra); preprocessing on the laptop. A 20-instance pilot of the two scaling studies (kept in \code{results/synthetic\_ecdlp/pilot20/}) was used to size the final runs.}

\end{table}

\subsection{Measurement and statistics}

For every run we record group additions and doublings (and their sum, the \emph{group operations}), field inversions
and multiplications, iterations of the walk, distinguished points stored and their bytes, fruitless cycles detected,
wall-clock time, CPU time summed over threads and peak resident memory. Means are reported with bootstrap 95\%
confidence intervals (2\,000 resamples); speed-ups between configurations on the same instances use paired
resampling. Empirical exponents come from least squares on $\log T = \log a + \alpha\log n\ (+\beta\log\log_2 n)$ with
bootstrap intervals over the size-level means. Negative controls: an $r=2$ walk (far from a random mapping) in the
sweep; a random oracle in the SHA-256 diffusion and bias tests; a batch containing one invalid signature in the batch
verification; and the control spaces Q4/Q5 of the identity search.

\subsection{Signature and SHA-256 protocols}

Signature benchmarks use ChaCha20-seeded synthetic keys, prehashed 32-byte messages, single-threaded timing with
medians and interquartile ranges over 7 repetitions of 2\,000 operations, and our own instrumented Straus and
Pippenger multi-scalar multiplications for batch verification (operation counts recorded). The SHA-256 experiments
use the reference implementation with $r$-step compression, seeded random messages, $2\,000$ samples per diffusion
configuration and $20\,000$ per bias configuration, Tseitin CNF with ripple-carry adders, and solver time limits of
300~s (preimage) and 600~s (collision) with three seeds per cell; every satisfying assignment is re-hashed with the
reference implementation before being counted.