1\section{Experimental Design}2\label{sec:design}34\subsection{Environment}56All computations ran on Apple-silicon machines of the author's laboratory cluster (Table~\ref{tab:env} in7Appendix~\ref{app:env}): a laptop (Apple M5 Max, 18 cores, 48~GB) for development, reference checks, SymPy/PARI8verification and figure generation; two Mac Studio nodes (Apple M3 Ultra, 28 cores, 96~GB) and one Mac Studio9(Apple M2 Ultra, 24 cores, 64~GB) for the ECDLP studies, the SAT/SMT grids and the second hardware point of the10signature benchmarks. No GPU was used. Toolchains: Python~3.12 with exact integer arithmetic (SymPy~1.14, NumPy~2.5,11python-sat~1.9 with CaDiCaL bindings, Z3~4.15), native CaDiCaL and Kissat binaries, PARI/GP~2.19 for point counting,12Rust~1.95/1.96 for the ECDLP engine and the signature harness (\kk{}~0.14, rust-secp256k1~0.33 binding \libsecp{}),13Lean~4.35 for the formal layer. Every result file records the host, versions, seed and command line.1415\subsection{Baselines and validation}1617Before any novel configuration was tried, the standard algorithms were implemented twice and cross-validated18(Hypothesis~\Hname{H23}): a pure-Python reference (\code{src/wp34}, affine coordinates, one inversion per group19operation, explicit operation counters) and a Rust engine (\code{rho\_engine}: Montgomery arithmetic for $p<2^{62}$,20simultaneous inversion across batched walks, ChaCha20-seeded multipliers, per-thread counters and CPU timers). The21engine passes 8 Rust unit/integration tests (including $1\,052$ brute-forced small-curve instances) and 553 Python22tests on a fixture of 60 prime-order curves of 20--32 bits, every answer being re-verified by the Python reference as23$[d]G=Q$; each engine result additionally carries an \code{ok} flag set by an in-process re-verification. The signature24harness passes the 19 BIP340 vectors with both libraries, $1\,000$ cross-library checks per scheme and 200 checks25against the Python reference. SHA-256 is verified against \code{hashlib} for ten message lengths spanning the padding26boundaries, and the CNF encoder against the reference for $r\in\{1,4,16,64\}$ steps.2728\subsection{Synthetic ECDLP instances}2930Instances are random prime-order curves $y^2=x^3+ax+b$ over random primes of the target bit length, counted with31PARI/GP's \code{ellcard} (SEA) and retained only if $\#E(\F_p)$ is prime and $\ne p$; the $j=0$ family uses $a=0$ and32$p\equiv 1\pmod 3$, with $\beta$ and $\lambda$ computed and checked ($\phi(G)=[\lambda]G$) before use. Targets are33$Q=[d]G$ for uniformly random $d$. Five studies were run (Table~\ref{tab:ecdlp-config}); all jobs are single-threaded34except the parallel-efficiency study, so that operation counts are deterministic given the seed. The35distinguished-point density follows the engine default $2^{-(\lfloor\text{bits}/4\rfloor-2)}$ and each thread runs36128 interleaved walks, which fixes the post-collision overhead at about $128\cdot 2^{\lfloor \text{bits}/4\rfloor-2}$37extra iterations---negligible above 44 bits ($<3\%$) but visible at 20--28 bits, which is why pooled constants are38computed on $\ge 44$ bits and empirical exponents are also fitted on $\ge 32$ bits only.3940\begin{table}[htbp]41 \centering\footnotesize42 \caption{ECDLP experimental configuration (seed 34; all instances verified).}43 \label{tab:ecdlp-config}44 \resizebox{\textwidth}{!}{%45 \begin{tabular}{@{}llllp{5.6cm}@{}}46 \toprule47 Study & Curves & Sizes (bits) & Instances/size & Configurations \\48 \midrule49 scaling, generic & random $a,b$ & 20--56 step 4 & 60 & BSGS ($\le 48$); rho Floyd, Brent ($\le 48$); rho DP $r=20$, $r=128$; rho DP + negation ($r=128$); kangaroo on $[0,n)$ \\50 scaling, $j=0$ & $a=0$, $p\equiv 1\ (3)$ & 24--52 step 4 & 60 & rho DP $r=128$; + negation; + $\phi$-orbits; + both ($r=128$ and $r=20$) \\51 iteration-function sweep & random & 36, 40 & 40 & $r\in\{2,3,4,8,16,20,32,64,128\}$ $\times$ mixed walk $\in\{$none$,2,4\}$ \\52 parallel efficiency & random & 56 & 12 & rho DP + negation, threads $\in\{1,2,4,8,16,28\}$ (M3 Ultra, 28 cores) \\53 time--memory & random & 36 (BSGS), 40 (rho) & 20 & BSGS memory $m\in\{2^{10},\dots,2^{20}\}$; rho DP density $2^{-2},\dots,2^{-14}$ \\54 preprocessing (Python) & random & 22, 26 & 60 & $T\in\{2^4,\dots,2^{12}\}$ stored distinguished points \\55 \bottomrule56 \end{tabular}57 }58 \par\smallskip{\footnotesize Nodes: generic scaling, sweep and parallel study on M3U96a (Apple M3 Ultra); $j=0$ scaling and time--memory on M2U64 (Apple M2 Ultra); preprocessing on the laptop. A 20-instance pilot of the two scaling studies (kept in \code{results/synthetic\_ecdlp/pilot20/}) was used to size the final runs.}5960\end{table}6162\subsection{Measurement and statistics}6364For every run we record group additions and doublings (and their sum, the \emph{group operations}), field inversions65and multiplications, iterations of the walk, distinguished points stored and their bytes, fruitless cycles detected,66wall-clock time, CPU time summed over threads and peak resident memory. Means are reported with bootstrap 95\%67confidence intervals (2\,000 resamples); speed-ups between configurations on the same instances use paired68resampling. Empirical exponents come from least squares on $\log T = \log a + \alpha\log n\ (+\beta\log\log_2 n)$ with69bootstrap intervals over the size-level means. Negative controls: an $r=2$ walk (far from a random mapping) in the70sweep; a random oracle in the SHA-256 diffusion and bias tests; a batch containing one invalid signature in the batch71verification; and the control spaces Q4/Q5 of the identity search.7273\subsection{Signature and SHA-256 protocols}7475Signature benchmarks use ChaCha20-seeded synthetic keys, prehashed 32-byte messages, single-threaded timing with76medians and interquartile ranges over 7 repetitions of 2\,000 operations, and our own instrumented Straus and77Pippenger multi-scalar multiplications for batch verification (operation counts recorded). The SHA-256 experiments78use the reference implementation with $r$-step compression, seeded random messages, $2\,000$ samples per diffusion79configuration and $20\,000$ per bias configuration, Tseitin CNF with ripple-carry adders, and solver time limits of80300~s (preimage) and 600~s (collision) with three seeds per cell; every satisfying assignment is re-hashed with the81reference implementation before being counted.82