1---2id: H083title: Measured ECDLP cost scales as n^0.5 with constants matching random-mapping theory4axis: B5kind: algorithmic6statement: Fitting T(n) = a n^α (log n)^β to measured group-operation counts for BSGS, rho (Floyd/Brent/DP) and kangaroo on7 20–48-bit prime-order curves gives α = 0.50 ± 0.02 and constants ≈ 2 (BSGS), ≈ √(π/2) ≈ 1.25 (rho), ≈ 2 (kangaroo on the8 full interval).9motivation: Reproducible baseline before any novel algorithm (mandate §9).10assumptions: Teske r = 20 walk; distinguished-point fraction tuned per size.11expected_contribution: Baseline table and log–log scaling figure with bootstrap confidence intervals.12related_work:13- pollard1978monte14- teske2001random15- vanoorschot1999parallel16- shanks1971class17- pollard2000kangaroos18- flajolet1990random19possible_counterexamples: α significantly different from 0.5, or a rho constant below √(π/2) (which would contradict the random-mapping20 model).21verification_strategy: experiments/synthetic_ecdlp/run_scaling.py on the cluster; analysis script fits and bootstraps.22computational_budget: ≈ 4 node-hours23status: evaluated24classification: known_reproduced25evidence:26- results/synthetic_ecdlp/scaling_generic_M3U96a.json27- results/synthetic_ecdlp/scaling_j0_M2U64.json28- results/synthetic_ecdlp/analysis.json29verdict: '3 840 verified instances, 20–56 bits: fitted α ∈ [0.478, 0.500] (≥ 32 bits) for all seven configurations with CIs30 touching 0.5; pooled rho constant 1.254·√n [1.21, 1.30] on 480 runs vs √(π/2) = 1.2533; BSGS 1.50·√n (x-keyed ±j table);31 kangaroo 1.94·√n; Floyd 2.67·√n, Brent 1.65·√n.'32---3334# H08 — Measured ECDLP cost scales as n^0.5 with constants matching random-mapping theory3536Fitting T(n) = a n^α (log n)^β to measured group-operation counts for BSGS, rho (Floyd/Brent/DP) and kangaroo on 20–48-bit prime-order curves gives α = 0.50 ± 0.02 and constants ≈ 2 (BSGS), ≈ √(π/2) ≈ 1.25 (rho), ≈ 2 (kangaroo on the full interval).37