1---2id: H113title: 'Time–memory trade-off: BSGS with memory m costs m + n/m operations; rho with DP density θ stores ≈ θ·√(πn/2) points'4axis: B5kind: algorithmic6statement: Measured (time, memory) points for BSGS at m ∈ {n^0.25 … n^0.5} and for DP-rho at several θ lie on the predicted7 curves; BSGS is deterministic and rho has coefficient of variation ≈ 0.52 (Rayleigh).8motivation: 'Mandate §9: report the time–memory trade-off for each algorithm.'9assumptions: Hash-table memory counted as entries × bytes.10expected_contribution: Trade-off figure.11related_work:12- shanks1971class13- vanoorschot1999parallel14- bernstein2012two15possible_counterexamples: Deviation from m + n/m (would indicate an implementation error).16verification_strategy: Rust engine bsgs --memory sweep; rho --dp sweep.17computational_budget: ≈ 1 node-hour18status: evaluated19classification: known_reproduced20evidence:21- results/synthetic_ecdlp/tmto_M2U64.json22- results/synthetic_ecdlp/analysis.json23verdict: BSGS cost matches m + n/(2m) within 7.8 % for m from 2^10 to 2^20 at 36 bits; DP-rho at 40 bits spans 1.17–4.95 M24 operations as the DP density goes from 2^-12 (optimum, ≈ √(πn/2)) to 2^-2 (restart-dominated) and 2^-14 (overshoot-dominated).25---2627# H11 — Time–memory trade-off: BSGS with memory m costs m + n/m operations; rho with DP density θ stores ≈ θ·√(πn/2) points2829Measured (time, memory) points for BSGS at m ∈ {n^0.25 … n^0.5} and for DP-rho at several θ lie on the predicted curves; BSGS is deterministic and rho has coefficient of variation ≈ 0.52 (Rayleigh).30