1\section{Mathematical Structure of secp256k1}2\label{sec:secp}34\subsection{Verified domain parameters}56Table~\ref{tab:secp-params} lists the standardised parameters \citep{certicom2010sec2} together with the7derived quantities used in this paper. Every entry was computed twice with exact arithmetic---in our pure-Python8library and in PARI/GP~2.19---and the two implementations agree on all fourteen named checks9(\code{results/baselines/secp256k1\_facts.json}, hypothesis~\Hname{H01}).1011\begin{table}[htbp]12 \centering\footnotesize13 \begin{threeparttable}14 \caption{secp256k1 parameters and derived algebraic invariants (all verified exactly in Python and PARI/GP).}15 \label{tab:secp-params}16 \begin{tabular}{@{}llp{8.2cm}@{}}17 \toprule18 Quantity & Symbol & Value / verified property \\19 \midrule20 Field prime & $p$ & $2^{256}-2^{32}-977$; prime; $p\equiv 1 \pmod 3$, $p\equiv 3 \pmod 4$ \\21 Curve & $E$ & $y^2 = x^3 + 7$; $a=0$, $b=7$; $\Delta\ne 0$; $j(E)=0$ \\22 Group order & $n$ & \code{FFFF\ldots{}BAAEDCE6AF48A03BBFD25E8CD0364141}; prime; $\#E(\F_p)=n$ (SEA re-count) \\23 Cofactor & $h$ & $1$ \\24 Generator & $G$ & $x_G=$\code{79BE667E\ldots{}F81798}, $y_G=$\code{483ADA77\ldots{}10D4B8}; $G\in E$; $[n]G=\Oinf$ \\25 Trace of Frobenius & $t$ & $p+1-n = 432420386565659656852420866390673177327$ ($\approx 2^{128.3}$, $t^2\le 4p$) \\26 CM discriminant & & $t^2-4p = -3f^2$, $f = 303414439467246543595250775667605759171$ \\27 Endomorphism & $\beta$ & \code{7AE96A2B\ldots{}719501EE}; $\beta^3\equiv 1$, $\beta^2+\beta+1\equiv 0 \pmod p$ \\28 Eigenvalue & $\lambda$ & \code{5363AD4C\ldots{}1B23BD72}; $\lambda^3\equiv 1$, $\lambda^2+\lambda+1\equiv 0 \pmod n$; $(\beta x_G, y_G) = [\lambda]G$ \\29 GLV basis & $(a_1,b_1)$ & $a_1=$\code{3086D221A7D46BCDE86C90E49284EB15}, $b_1=-$\code{E4437ED6010E88286F547FA90ABFE4C3} \\30 & $(a_2,b_2)$ & $a_2=$\code{114CA50F7A8E2F3F657C1108D9D44CFD8}, $b_2=a_1$; $a_i+b_i\lambda\equiv 0 \pmod n$; $\det = n$ \\31 Anomalous? & & no ($n\ne p$) \\32 Embedding degree & $k$ & $\ord_n(p) > 10^{6}$ (PARI: $\ord_n(p)$ is a 253-bit integer); MOV/Frey--R\"uck inapplicable \\33 Twist order & $n'$ & $2p+2-n = 3^2\cdot 13^2\cdot 3319\cdot 22639\cdot q_{220}$, $q_{220}$ a 220-bit prime \\34 2-torsion / $x=0$ & & $x^3+7$ has no root in $\F_p$ (no point of order~2); $7$ is a non-residue (no point with $x=0$) \\35 $n-1$, $p-1$ & & $n-1 = 2^6\cdot 3\cdot 149\cdot 631\cdot(\ldots)$; $p-1 = 2\cdot 3\cdot 7\cdot 13441\cdot(\ldots)$ (large cofactors) \\36 \bottomrule37 \end{tabular}38 \begin{tablenotes}\footnotesize39 \item Source: \code{experiments/baselines/secp256k1\_facts.py}. Hexadecimal values abbreviated; full values in the JSON result and in \code{src/wp34/secp256k1.py}.40 \end{tablenotes}41 \end{threeparttable}42\end{table}4344\subsection{Why the special form is interesting}4546Three features distinguish \secp{} from a random prime-order curve: the special prime (fast reduction), $a=0$47(cheaper doubling: $\lambda = 3x^2/2y$), and $j=0$ with $p\equiv 1\pmod 3$, which gives the curve complex48multiplication by the Eisenstein integers and therefore an automorphism group of order~6 instead of~2. The first two49are pure implementation conveniences. The third has a precise algebraic content that we now make explicit.5051\begin{proposition}\label{prop:end}52Let $E/\F_p$ be ordinary with $j(E)=0$ and $p\equiv 1\pmod 3$. Then $\End(E)=\Z[\omega]$, every endomorphism is53$u+v\phi$ with $u,v\in\Z$ and has degree $u^2-uv+v^2$, and $\Aut(E) = \{\pm 1,\pm\phi,\pm\phi^2\}\cong\Z/6$.54\end{proposition}55\begin{proof}56$\phi$ is an automorphism of order~3 defined over $\F_p$, so $\Z[\phi]\cong\Z[\omega]\subseteq\End(E)$. Since $E$ is57ordinary, $\End(E)$ is an order in the imaginary quadratic field $\End(E)\otimes\Q \supseteq \Q(\omega)=\Q(\sqrt{-3})$,58hence equal to $\Q(\sqrt{-3})$, whose unique maximal order is $\Z[\omega]$. Thus $\End(E)=\Z[\omega]$. The degree of an59endomorphism is its norm, $\Norm(u+v\omega)=u^2-uv+v^2$, and the units of $\Z[\omega]$ are the six sixth roots of60unity \citep[Thm.~III.10.1, Ex.~III.10.?]{silverman2009arithmetic}.61\end{proof}6263The Frobenius $\pi$ lies in $\Z[\omega]$ with $\Norm(\pi)=p$ and $\Tr(\pi)=t$, so $\pi = (t\pm f\sqrt{-3})/2$ and64$4p = t^2+3f^2$---the identity the automated search of Section~\ref{sec:framework} found in the form65``$t^2 + 3b_1^2 = 4p$''. For \secp{} we verified $t^2-4p=-3f^2$ exactly (Table~\ref{tab:secp-params}). Proposition~\ref{prop:end}66answers research question~A1 at the structural level: there is no efficiently computable endomorphism beyond67$\Z[\phi]$, because there is no endomorphism beyond $\Z[\phi]$ at all. The smallest non-unit endomorphism,68$1-\phi$ of degree~3, is computable with one addition ($P - \phi(P)$) but is simply the sum of two things we already69have.7071\subsection{The GLV lattice is the ideal $(\bar\pi-1)$}7273\begin{proposition}\label{prop:glv}74Let $L=\{(k_1,k_2)\in\Z^2 : k_1+k_2\lambda\equiv 0 \pmod n\}$ be the GLV lattice. Under the identification75$(k_1,k_2)\leftrightarrow k_1+k_2\omega$, $L$ is the principal ideal $(\bar\pi-1)\Z[\omega]$, where76$\bar\pi=(t-f\sqrt{-3})/2$ is the Frobenius conjugate for which $\omega\mapsto\lambda$ sends $\bar\pi-1$ to~$0$.77Consequently78\begin{equation}79 (a_1,b_1) = \Big(\tfrac{t-f}{2}-1,\ -f\Big),\qquad (a_2,b_2) = (a_1-b_1,\ a_1) \;\;(=\omega\cdot(a_1+b_1\omega)\text{ up to sign}),80 \qquad a_1^2-a_1b_1+b_1^2 = n ,81 \label{eq:glvclosed}82\end{equation}83and these are exactly the constants hard-coded in \libsecp{}.84\end{proposition}85\begin{proof}86The map $\rho:\Z[\omega]\to\Z/n\Z$, $\omega\mapsto\lambda$, is a ring homomorphism because $\lambda^2+\lambda+1\equiv 0$.87Its kernel is an ideal of index $n$, hence of norm $n$; $\Z[\omega]$ is a principal ideal domain, so the kernel is88$(\alpha)$ with $\Norm(\alpha)=n$. Now $n=\#E(\F_p)=\Norm(\pi-1)=\Norm(\bar\pi-1)$ and $\pi$ acts on $E(\F_p)$ as the89identity, so $\pi-1$ kills every point and one of $\pi-1$, $\bar\pi-1$ lies in $\ker\rho$ (which one depends on the90labelling of $\omega$ versus $\lambda$); call it $\bar\pi-1$. Since $(\bar\pi-1)$ and $\ker\rho$ are ideals of the same91norm with one containing the other, they are equal. Writing $\sqrt{-3}=2\omega+1$ gives92$\bar\pi-1 = \frac{t-f}{2}-1-f\omega$, i.e.\ $(a_1,b_1)$ as stated; multiplying by the unit $\omega$ gives the second93basis vector; and $\Norm(\bar\pi-1)=n$ is~\eqref{eq:glvclosed}. The identification with the \libsecp{} constants is an94exact integer check (\code{identity\_search.json}, field \code{closed\_form\_matches\_libsecp256k1}).95\end{proof}9697We are not aware of a place where the \libsecp{} constants are written in this closed form (the library's comments98derive them by the extended Euclidean algorithm, as in \citet{gallant2001faster}); the ideal-theoretic description of the99GLV lattice for CM curves is classical \citep{sica2002analysis,galbraith2011endomorphisms}. We therefore classify100Proposition~\ref{prop:glv} as a known result independently reproduced, with an explicit form that may be of101expository use. It immediately yields the sharp bound $\max(\lvert k_1\rvert,\lvert k_2\rvert)\le \lvert a_1\rvert + \lvert b_1\rvert$ for102Babai rounding; empirically both sub-scalars have at most 128 bits (hypothesis~\Hname{H03}).103104\subsection{Orbits, equivalence classes and the limits of the automorphism trick}105106The group $\Aut(E)$ acts on $E(\F_p)\setminus\{\Oinf\}$ freely (no non-identity automorphism fixes a point of prime107order $n>3$ other than $\Oinf$), so the orbits $\{\pm P,\pm\phi P,\pm\phi^2P\}$ all have size~6 and the orbit space has108$(n-1)/6$ elements. Pollard's rho can be run on orbits because a canonical representative (for instance the point with109minimal $x$ among $\{x,\beta x,\beta^2 x\}$ and then minimal $y$) can be computed with two field multiplications, and110the scalar bookkeeping is adjusted by powers of $\lambda$ and signs \citep{wiener1999faster,duursma1999speeding,gallant2000improving}.111The random-mapping heuristic then predicts $\sqrt{\pi n/12}$ iterations instead of $\sqrt{\pi n/2}$: a factor112$\sqrt6\approx 2.45$. Two costs must be paid: canonicalisation, and \emph{fruitless cycles}---short cycles of the113iteration that contain no useful collision, whose frequency is $\Theta(1/r)$ for an $r$-adding walk on classes and114which must be detected and escaped \citep{bos2010negation,bernstein2011correct}. Section~\ref{sec:results} measures115the achieved factor and the cycle overhead (hypothesis~\Hname{H04}).116117Could the orbit space do more than save a constant? Hypothesis~\Hname{H05} formalises the natural conjecture that118$E(\F_p)/\Aut(E)$ carries a group structure compatible with the projection, which would reduce the DLP to a group of119order $\approx n/6$ (and, iterating, suggest further reductions). It is false.120121\begin{proposition}\label{prop:noquotient}122There is no group structure on the orbit set $E(\F_p)/\Aut(E)$ for which the projection is a homomorphism.123\end{proposition}124\begin{proof}125If the projection were a homomorphism, its kernel would be the orbit of $\Oinf$, which is $\{\Oinf\}$, so the126projection would be injective---contradicting the fact that the other orbits have six elements. Equivalently,127$P\sim\phi P$ and $Q\sim Q$ would force $P+Q\sim\phi P+Q$; on synthetic 16-, 20- and 24-bit $j=0$ curves this fails for128every one of $1500$ random pairs (\code{results/theory/orbit\_quotient\_counterexample.json}).129\end{proof}130131The same argument applies to any finite group of automorphisms fixing the identity: equivalence classes under132automorphisms are compatible with \emph{iterations} (which is all rho needs) but never with the group law. This is133the precise sense in which the structure of \secp{} yields a constant and nothing more (research questions~A2, A5).134135\subsection{Algebraic attacks: an exact exclusion table}136137The reductions that beat the generic bound each need a verifiable property. The MOV/Frey--R\"uck transfer to138$\F_{p^k}^*$ needs a small embedding degree $k=\ord_n(p)$ \citep{menezes1993reducing,frey1994remark}; for \secp{}, $k$139is a 253-bit integer. The anomalous-curve attack needs $n=p$ \citep{semaev1998evaluation,smart1999discrete,satoh1998fermat};140here $n\ne p$. Attacks through invalid points on the twist need a smooth twist order; the twist cofactor is a 220-bit141prime \citep{bernstein2014safecurves}. Weil-descent and summation-polynomial index calculus need an extension field or a142subfield structure \citep{semaev2004summation,gaudry2009index,diem2011discrete,petit2012elliptic}; $\F_p$ with $p$ prime143has none. Hypothesis~\Hname{H06} quantifies the last point experimentally: with a factor base $F=\{P: x(P)<\sqrt p\}$ a144random point decomposes as a sum of two factor-base points with probability $1-e^{-\lvert F\rvert^2/2n}\approx 0.4$ (measured145$0.31$--$0.44$ on 16--28-bit curves, in agreement with the Poisson prediction), but finding the decomposition146without an oracle costs $\lvert F\rvert$ operations per trial, and even with a free oracle the $\lvert F\rvert$ relations cost147$\ge 2.4\sqrt n$ and the linear algebra $\lvert F\rvert^2\approx n$. Semaev's $S_3$ polynomial, which we re-derived and148verified symbolically (check~S4), has degree~2 in each variable, so the $m=2$ decomposition is a square-root problem149in disguise; for $m\ge 3$ the decomposition step itself becomes the bottleneck over prime fields. No algorithm with150complexity below $\sqrt n$ is known for this setting \citep{galbraith2016recent}, and our experiments give no hint of one.151