1{"id": "H01", "title": "Standardised secp256k1 parameters and GLV constants are exactly consistent", "axis": "A", "kind": "algebraic", "status": "evaluated", "classification": "known_reproduced", "verdict": "All 14 facts agree between Python and PARI/GP; (\u03b2, \u03bb\u00b2) mismatch confirmed as expected.", "evidence": ["results/baselines/secp256k1_facts.json"], "logged_utc": "2026-11-01T07:04:09+00:00"}2{"id": "H02", "title": "End(E) = Z[\u03c9] and the GLV basis is the Eisenstein ideal (\u03c0\u0304 \u2212 1): closed form of the libsecp256k1 constants", "axis": "A", "kind": "algebraic", "status": "evaluated", "classification": "known_reproduced", "verdict": "Closed form holds exactly; all 22 identities found by the search are explained by CM theory. Known in principle (ideal structure of the GLV lattice), the explicit identification with the published constants is a useful clarification, not new mathematics.", "evidence": ["results/automated_discovery/identity_search.json", "results/baselines/secp256k1_facts.json"], "logged_utc": "2026-11-01T07:04:09+00:00"}3{"id": "H03", "title": "GLV decomposition halves doublings; sub-scalars never exceed 128 bits", "axis": "A", "kind": "algebraic", "status": "evaluated", "classification": "known_reproduced", "verdict": "Max sub-scalar size 128 bits; 184 vs 304 group ops (GLV+wNAF vs wNAF), 2.07\u00d7 vs double-and-add.", "evidence": ["results/baselines/scalar_mult_opcount.json"], "logged_utc": "2026-11-01T07:04:09+00:00"}4{"id": "H04", "title": "Automorphism orbits give exactly \u221a6 on Pollard rho, with measurable fruitless-cycle overhead", "axis": "A", "kind": "algebraic", "status": "evaluated", "classification": "known_reproduced", "verdict": "180 paired instances at 44\u201352 bits: iteration speed-up 2.21 [2.00, 2.45] (r = 128) and 2.42 [2.19, 2.70] (r = 20) vs \u221a6 = 2.449; constant 0.499\u00b7\u221an vs \u221a(\u03c0/12) = 0.512; negation alone 1.29 vs \u221a2, \u03c6-orbits alone 1.52 vs \u221a3; fruitless cycles \u2264 0.11 per 1000 iterations. Wall-clock speed-up only 0.95 (order-6) and 0.73 (negation) because canonicalisation costs 56\u201383 ns vs 38 ns per plain iteration in this engine.", "evidence": ["results/synthetic_ecdlp/scaling_j0_M2U64.json", "results/synthetic_ecdlp/analysis.json"], "logged_utc": "2026-11-01T07:04:09+00:00"}5{"id": "H05", "title": "The automorphism orbit set cannot be made a group of order n/6 (rejected conjecture)", "axis": "A", "kind": "algebraic", "status": "evaluated", "classification": "rejected", "verdict": "Compatibility fails for 1500/1500 random pairs; proof: a congruence would make the orbit of O a subgroup H with cosets the other orbits, but orbits have size 6 \u2260 |H| = 1.", "evidence": ["results/theory/orbit_quotient_counterexample.json"], "logged_utc": "2026-11-01T07:04:09+00:00"}6{"id": "H06", "title": "No known algebraic attack applies to secp256k1; prime-field index calculus with m = 2 costs \u226b \u221an", "axis": "A", "kind": "algebraic", "status": "evaluated", "classification": "known_reproduced", "verdict": "All exclusion criteria verified; measured decomposition rates match the Poisson prediction within sampling error; even with a free decomposition oracle the relation stage costs \u2265 2.4\u221an and the linear algebra |F|\u00b2 \u226b \u221an.", "evidence": ["results/baselines/secp256k1_facts.json", "results/synthetic_ecdlp/index_calculus_probe.json"], "logged_utc": "2026-11-01T07:04:09+00:00"}7{"id": "H07", "title": "An exhaustive small-coefficient identity search finds only CM-explained relations and no cross-modulus or generator-specific relation", "axis": "A", "kind": "algebraic", "status": "evaluated", "classification": "empirical_observation", "verdict": "22 identities found, 22 explained, 0 unexplained, 0 false positives (expected chance hits 10^-73).", "evidence": ["results/automated_discovery/identity_search.json"], "logged_utc": "2026-11-01T07:04:09+00:00"}8{"id": "H08", "title": "Measured ECDLP cost scales as n^0.5 with constants matching random-mapping theory", "axis": "B", "kind": "algorithmic", "status": "evaluated", "classification": "known_reproduced", "verdict": "3 840 verified instances, 20\u201356 bits: fitted \u03b1 \u2208 [0.478, 0.500] (\u2265 32 bits) for all seven configurations with CIs touching 0.5; pooled rho constant 1.254\u00b7\u221an [1.21, 1.30] on 480 runs vs \u221a(\u03c0/2) = 1.2533; BSGS 1.50\u00b7\u221an (x-keyed \u00b1j table); kangaroo 1.94\u00b7\u221an; Floyd 2.67\u00b7\u221an, Brent 1.65\u00b7\u221an.", "evidence": ["results/synthetic_ecdlp/scaling_generic_M3U96a.json", "results/synthetic_ecdlp/scaling_j0_M2U64.json", "results/synthetic_ecdlp/analysis.json"], "logged_utc": "2026-11-01T07:04:09+00:00"}9{"id": "H09", "title": "Automated search over iteration-function designs cannot beat the random-mapping constant for a given class size", "axis": "B", "kind": "algorithmic", "status": "evaluated", "classification": "rejected", "verdict": "25 configurations \u00d7 80 instances: r = 2 and r = 3 walks cost 3.77\u00b7\u221an and 2.26\u00b7\u221an (negative control), r \u2265 8 cluster at 1.1\u20131.5\u00b7\u221an with CIs overlapping \u221a(\u03c0/2); mixed walks indistinguishable; best cell r32 at 1.10 [0.92, 1.28] not significantly below the random-mapping constant. No generic iteration design beats the random-mapping floor.", "evidence": ["results/synthetic_ecdlp/sweep_r_M3U96a.json", "results/synthetic_ecdlp/analysis.json"], "logged_utc": "2026-11-01T07:04:09+00:00"}10{"id": "H10", "title": "Parallel distinguished-point collision search has near-linear speed-up up to 28 threads", "axis": "B", "kind": "algorithmic", "status": "evaluated", "classification": "known_reproduced", "verdict": "56-bit instances on an Apple M3 Ultra: 14.8\u00d7 on 16 threads (efficiency 0.93), 22.1\u00d7 on 28 threads (0.79, P+E cores); total group operations within a factor 1.0 of single-thread.", "evidence": ["results/synthetic_ecdlp/parallel_M3U96a.json", "results/synthetic_ecdlp/analysis.json"], "logged_utc": "2026-11-01T07:04:09+00:00"}11{"id": "H11", "title": "Time\u2013memory trade-off: BSGS with memory m costs m + n/m operations; rho with DP density \u03b8 stores \u2248 \u03b8\u00b7\u221a(\u03c0n/2) points", "axis": "B", "kind": "algorithmic", "status": "evaluated", "classification": "known_reproduced", "verdict": "BSGS cost matches m + n/(2m) within 7.8 % for m from 2^10 to 2^20 at 36 bits; DP-rho at 40 bits spans 1.17\u20134.95 M operations as the DP density goes from 2^-12 (optimum, \u2248 \u221a(\u03c0n/2)) to 2^-2 (restart-dominated) and 2^-14 (overshoot-dominated).", "evidence": ["results/synthetic_ecdlp/tmto_M2U64.json", "results/synthetic_ecdlp/analysis.json"], "logged_utc": "2026-11-01T07:04:09+00:00"}12{"id": "H12", "title": "Discrete logarithms with preprocessing: online cost \u2248 1.5\u00b7\u221a(n/T) after storing T distinguished points", "axis": "B", "kind": "algorithmic", "status": "evaluated", "classification": "known_reproduced", "verdict": "Online/\u221a(n/T) ratio 1.48\u20131.67 across T = 2^4 \u2026 2^12 at 22 and 26 bits; per-instance speed-up 2.6\u00d7 \u2192 42\u00d7 as predicted by \u221aT scaling.", "evidence": ["results/synthetic_ecdlp/preprocessing_python.json"], "logged_utc": "2026-11-01T07:04:09+00:00"}13{"id": "H13", "title": "BIP340 batch verification reduces per-signature cost by a factor that grows with batch size and saturates", "axis": "B", "kind": "algorithmic", "status": "evaluated", "classification": "known_reproduced", "verdict": "Per-signature cost falls from 24.5 \u00b5s (single, k256) to 7.9 \u00b5s at b = 2048 with Pippenger (S = 3.10 [3.05, 3.16]; 1.67\u00d7 vs libsecp256k1 single verify); Straus plateaus at \u2248 2\u00d7; \u2248 3 \u00b5s/sig of non-MSM work (lift_x, tagged hash) caps the gain; negative control rejected; same shape on M3 Ultra.", "evidence": ["results/signature_benchmarks/summary.json", "results/signature_benchmarks/bench_MacBookPro-de-simon-pierre-2.json", "results/signature_benchmarks/bench_MacStudnpierre2.json"], "logged_utc": "2026-11-01T07:04:09+00:00"}14{"id": "H14", "title": "Implementation choice dominates signature performance: three orders of magnitude between pure Python and libsecp256k1", "axis": "B", "kind": "algorithmic", "status": "evaluated", "classification": "empirical_observation", "verdict": "Schnorr verify: 7.4 ms (pure Python) vs 24.5 \u00b5s (k256) vs 13.2 \u00b5s (libsecp256k1): 560\u00d7 spread; libsecp256k1 verifies 1.9\u00d7 faster than k256 while k256 signs 1.8\u00d7 faster (table-based generator multiplication 8.3 \u00b5s vs blinded ecmult_gen 19.8 \u00b5s); ECDSA and Schnorr verification within 5 % in libsecp256k1.", "evidence": ["results/signature_benchmarks/summary.json"], "logged_utc": "2026-11-01T07:04:09+00:00"}15{"id": "H15", "title": "A single-bit message difference reaches full avalanche within a small number of steps", "axis": "C", "kind": "sha256", "status": "running", "classification": "pending", "verdict": "pending", "evidence": [], "logged_utc": "2026-11-01T07:04:09+00:00"}16{"id": "H16", "title": "Statistically detectable input\u2013output correlations vanish after a small number of steps", "axis": "C", "kind": "sha256", "status": "running", "classification": "pending", "verdict": "pending", "evidence": [], "logged_utc": "2026-11-01T07:04:09+00:00"}17{"id": "H17", "title": "SAT preimage search on step-reduced SHA-256 scales exponentially in the number of steps and in the number of free bits", "axis": "C", "kind": "sha256", "status": "running", "classification": "pending", "verdict": "pending", "evidence": [], "logged_utc": "2026-11-01T07:04:09+00:00"}18{"id": "H18", "title": "Generic SAT encodings find step-reduced collisions only far below the published dedicated-tool records", "axis": "C", "kind": "sha256", "status": "running", "classification": "pending", "verdict": "pending", "evidence": [], "logged_utc": "2026-11-01T07:04:09+00:00"}19{"id": "H19", "title": "The 9-step local collision holds with probability 1 in the XOR-linearised model and with low, position-dependent probability in the real step function", "axis": "C", "kind": "sha256", "status": "running", "classification": "pending", "verdict": "pending", "evidence": [], "logged_utc": "2026-11-01T07:04:09+00:00"}20{"id": "H20", "title": "The SHA-256 step is a bijection on the state and the message schedule is invertible, so free-start and pseudo-preimage problems on the compression function are trivial", "axis": "C", "kind": "sha256", "status": "evaluated", "classification": "known_reproduced", "verdict": "Machine-checked: stepInv \u2218 step = id and step \u2218 stepInv = id (per-component SAT lemmas, AIG 2048/2420), steps_bijective for any number of rounds, scheduleStep_inv and schedule_backward; executable demonstration in tests/test_core.py. Consequence (pseudo-preimages of the feed-forward-free compression function are free) stated informally.", "evidence": ["formal/README.md", "formal/build.log", "tests/test_formal_lean.py", "tests/test_core.py"], "logged_utc": "2026-11-01T07:04:09+00:00"}21{"id": "H21", "title": "Lean 4 bv_decide machine-checks the SHA-256 word-level identities used by optimised implementations", "axis": "D", "kind": "formal", "status": "evaluated", "classification": "known_reproduced", "verdict": "Lean 4.35 bv_decide (LRAT certificates re-checked in Lean): Ch_opt, Maj_opt_or, Maj_opt_xor, GF(2)-linearity of \u03a30, \u03a31, \u03c30, \u03c31, injectivity and explicit inverses (\u03a30\u207b\u00b9 = XOR of 17 rotations) hence bijectivity; clean build 32 s, no sorry, no user axiom, no Mathlib.", "evidence": ["formal/README.md", "formal/build.log", "tests/test_formal_lean.py"], "logged_utc": "2026-11-01T07:04:09+00:00"}22{"id": "H22", "title": "\u03c30 and \u03c31 are not injective on 32-bit words (kernel of positive dimension), unlike \u03a30 and \u03a31", "axis": "D", "kind": "formal", "status": "evaluated", "classification": "rejected", "verdict": "Conjecture refuted: \u03c30 and \u03c31 are bijective (bv_decide UNSAT certificates for injectivity; GF(2) rank 32 by two independent eliminations; explicit 32\u00d732 inverse matrices verified in Lean). The shift makes each summand singular (x\u226b3 has rank 29; rotr7\u2295rotr18 kills 0xFFFFFFFF) but the sum is a unit. A wrong belief caught by the formal layer.", "evidence": ["formal/README.md", "formal/build.log", "tests/test_formal_lean.py", "formal/scripts/gf2_rank.py"], "logged_utc": "2026-11-01T07:04:09+00:00"}23{"id": "H23", "title": "Cross-implementation agreement is a necessary gate: every arithmetic component is checked against at least one independent implementation", "axis": "D", "kind": "methodology", "status": "evaluated", "classification": "empirical_observation", "verdict": "11 reference tests pass; agreement with 5 independent implementations; two development bugs caught by the gate (kangaroo retry loop, PARI output parsing).", "evidence": ["tests/test_core.py", "tests/test_dlp_reference.py"], "logged_utc": "2026-11-01T07:04:09+00:00"}24{"id": "H24", "title": "The six-stage pipeline rediscovers known structure at a high rate and reports zero validated novel shortcuts", "axis": "D", "kind": "methodology", "status": "running", "classification": "pending", "verdict": "pending", "evidence": [], "logged_utc": "2026-11-01T07:04:09+00:00"}25{"id": "H25", "title": "ECDSA malleability and Schnorr correctness follow from the abstract group axioms alone (formalised)", "axis": "D", "kind": "formal", "status": "evaluated", "classification": "known_reproduced", "verdict": "Machine-checked in an axiomatised CyclicGroup structure (fields listed in formal/README.md): schnorr_correct (s = k + e\u00b7d mod n \u27f9 s\u2022G = R + e\u2022P), ecdsa_correct, ecdsa_malleable ((r,s) valid \u27f9 (r, n\u2212s) valid, modular inverse as witness). Only propext/Quot.sound used.", "evidence": ["formal/README.md", "formal/build.log", "tests/test_formal_lean.py"], "logged_utc": "2026-11-01T07:04:09+00:00"}26