5-7 kangaroo approach

I was revisiting Pollard's 3 kangaroo method and came across this interesting paper: Kangaroo Methods for Solving the Interval Discrete Logarithm Problem https://www.math.auckland.ac.nz/~sgal018/AFhons.pdf The author is trying to improve the running times compared to the 4-kangaroo method that Pollard and his team introduced back in 2011. They claim to have made progress with a 5-kangaroo method. There's also a 7-kangaroo algorithm presented, but its run-time seems pretty similar to the 5-kangaroo method, not exactly an improvement. Now, maybe I'm missing something or just not getting it. The author uses some clever approximation techniques to find certain constants for the Tame and Wild kangaroos' exponents. But here's the catch: these constants aren't whole numbers, so the author suggests rounding them to the nearest integers when multiplied by N, which is the size of the interval. The whole analysis hinges on the idea that these Wild kangaroos start within the interval. But if we receive a public key and know it's in a specific interval of size N, the only points we can really confirm are: - the public key itself - its negative counterpart (between -N and -1) - integer multiples of either of those - adding or subtracting known deltas from any of those three points So how did the author come to the conclusion of creating better algorithms when there’s no guarantee that using an exponentiation like that would keep the resulting point within a known interval just based on N and the private key?

Regarding this very specific problem, one limited approach I can think of is to subtract G from your initial pubkey and keep them both; the initial and the offset resulting from this subtraction. Now one of these two is sure to have an even private key, as some pubkey minus G = its private key minus 0x1. Then you "divide" them both and at least one resulting offset will be within the desired interval. Maybe you could find a similar work around for your specific problem

Yes, that approach works, but what are the consequences? First, let's say the private key is 0x1. So, we would rather add G and then divide, otherwise we need to add a special condition check in the algorithm ("is P the point at infinity"), making it slower. But after division, we have two resulting points: [1/2]P [1/2](P + G) and we don't know which one of these two is the one that sits in the lower interval, and which one sits in another interval (points starting at keys [1/2 mod n] = (n+1)/2 onward). So we must look for either of them. Since we now have two keys to search for, any algorithm will require two times more work at some stage, in an interval that is half in size (either the lower interval, or the [1/2 + k] interval) Let's say our algorithm has an average run-time of C * sqrt(N) where C is some (any) constant factor and N is the size of the interval. Let's simplify C to be 1 (we'll have the same end-result if C is either lower or greater then 1). If we look for the private key in the original interval, average run-time is then sqrt(N) If we look for 2 private keys in a half-range interval, average run-time is then 2 * sqrt(N/2) = sqrt(2) * sqrt(N) = 1.41 sqrt(N) My conclusion (non-definitive and open for debates): the average run-time increases by 41% every time we  "divide public key by 2" and attempt to work-around the parity problem. Now, the cited study uses values for the exponent as 6-decimal digit figures. Following the same logic, I would think that this means the predicted results of his analysis are only valid if the private key that is beaing searched is a multiple of 1.000.000. Otherwise, his wild starting points (the exponents are being used to compute initial wild kangaroo positions) are not really guaranteed to lie in the search interval, but rather in 1.000.000 different intervals.

Such papers is just a way to get a degree, zero new ideas. And all this is not important actually. The main problem that you won't get better than K=1.7 this way even if you use 1000 instead of 3-4-5-7 kangs. K=1.7 is boring, really. It's like solving puzzles #6x  Why don't you try this? https://www.iacr.org/archive/pkc2010/60560372/60560372.pdf Going this way (a long way btw) you can "invent" something interesting and get real K (not in theory but real) around 1.2 if you are smart enough I call this approach "mirrored" kangs. But, of course, this way is not so easy as "normal" kangs that always jump in one direction. Just a tip for you because it seems you read some papers instead of creating magic circles/code as most people here Though I doubt that you will break #135, it's always fun to invent and discover so you can spend a lot of time having fun...

Thanks, we all already know about that paper, and I discussed it a few times in some of my posts. I also implemented it (even in my public Python kangaroo script) and it indeed brings C to ~ 1.25 - 1.45 but at the expense of much more complex logic, since we can have cycles in the side by side walks, which need to be handled. In addition, that method completely ignores the cost of having to create new starting points, which is not something to be ignored (in fact, is very very costly). This problem is also mentioned in the 3 & 4 kangaroo methods paper (which was actually a follow up to the paper you cited). There is also a more recent "fix" to the Gaudry-Schost method (but it is written in Chinese) which brings down C a little bit more, by refining the wild set bounds. However even though C is lower than 1.7, the actual runtime is worse, because of the additional restarts, and cycle detection logic. That means it requires more computing power and additional registers, at the machine level. If well optimized, it can beat 4-Kangaroo on a CPU + RAM, but on a GPU the added requirements (cycle detection, more registers) do not reach the efficiency (throughput) of Kangaroo method, which is simple and direct: jump forward, check if DP, repeat. I don't intend on ruining someone's tenure, but I also highly suspect that the paper about 5 and 7 kangaroos was not reviewed by supervisors or even by the peer community.. I also discovered that C can go as low as 1.05 if we also allow 1.05 sqrt(N) stored items, with 3 kangaroos alone, and only addition group operations. And still people believe BSGS would work faster. for whatever reason, with TB of RAM.. I let them continue believing that. Oh and BTW 3 & 4-kang methods are already "mirrored", this is basically the reason why C was brought down from 2.0 to 1.72.

OK, I don't insist, see no reasons to do that if you are happy with 1.7

Can you provide a link?

https://bitcointalk.org/index.php?topic=1306983.msg64515007#msg64515007 I only have experimental proofs (e.g "it works as advertised"). Don't ask why though. I'm not a number theorist. It's basically the 3 kangaroo method combined with the van Oorschot parallelization method, without using DPs.

BSGS algorithm  applied to secp256k1 curve only need 1.0 sqrt(N) operations (on average) and 1.5 sqrt(N) operations in the worst case: https://eprint.iacr.org/2015/605.pdf You only need to store 0.5 sqrt(N) keys (the baby steps) : from 1*G to 0.5*sqrt(N)*G and compute in the worst case 1.0 * sqrt(N) keys (the giant steps) Only additions and subtractions, no multiplications.

And next step is to calculate required memory for 0.5*sqrt(2^134) points. After this calculation you will lose all your interest in BSGS   Or may be you are going to break a lot of <64bit points? Even so, kang is faster because you can have precomputed db of DPs and reduce time in 10 times or even more.

If the goal is to retrieve a private key in a 2^134 interval, there is no doubt: BSGS is not the algorithm to use. But in a 2^64 interval, BSGS can be faster.

BSGS is faster, but Kangaroo is very good at aiming, how good will he be?

Kangaroo doesn't need fast memory. Or any memory at all. I'd say it's a good trade-off.

Kangaroo is only probabilistic, don't lose focus, Kangaroo doesn't need much power to play the birthday paradox puzzles. Be careful not to ruin the birthday paradox in the search for more speed.

How does that matter? You can't have fast memory in the order of 2**67 elements, and likely not in the lifetime of our grand-grand children. Don't confuse fast memory with storage capacity, the difference between these two is in the order of 5 magnitudes or more. So the only option is to use whatever can be applied to the constraints we're having, no matter if it's probabilistic or not. Kangaroo doesn't require fast memory at all, it requires zero memory actually, and whatever slow storage, only for the offline step (matching), which doesn't influence at all the computation parts. BSGS directly depends on having access to fast memory and this is part of the algorithm itself.

Stop promoting garbage. If you precompute certain values, you might lose the effect of the birthday paradox in the sense that you are reducing randomness and possible combinations. Precomputation can make the problem more deterministic and less dependent on the random coincidences that make the birthday paradox so surprising. You are leading people into a void.

Excellent!  I think now it's time for some magic circles, don't hesitate!

The birthday paradox is based on probability and randomness, which allows for finding collisions more efficiently than with brute force. By modifying the kangaroo algorithm in a more deterministic way, this probabilistic advantage is lost, and it becomes an approach closer to brute force. The essence of the birthday paradox is that, with enough randomness, it is more likely to find collisions in a large set of data. By eliminating or reducing randomness, this property is lost, and the algorithm become less efficient.

I don't understand why certain people prefer to create new accounts and troll around serious discussions. @ElonMusk, if you are who I believe to be - you may need some professional help - friendly advice. It's obvious no amount of evidence, common sense, or explanations can treat certain issues. This is like a dick contest: I show you that kangaroo with precomputed DPs can break any 80 bits or so key in a couple of seconds (random, sequential, you name it, as long as its in the range), there is always someone that brings up the "but its probabilistic" argument, however has nothing even remotely similar to offer, wtf?! Maybe I missed the day where everyone uses a super-computer and runs BSGS with a few PB of RAM (not that it would suffice). This topic was concluded already: the 4 kangaroo method remains the fastest method of the kangaroo family, 5 kangaroos or more are sub-optimal, just as suggested in the original paper. Anything else is off-topic. EOF. You are completely and utterly unaware of how Kangaroo works, please stop now. There is no randomness in the algorithm, ZERO randomness. I repeat: there is no usage of any random features, random functions, or random generators in the Kangaroo algorithm. In contrast, it is actually very well deterministic in nature, otherwise the collisions will not occur. . Having more DPs simply means there are more traps to be hit, increasing the chances. So please go back to the drawing board.

John M. Pollard: “Randomness in these algorithms is crucial for their functioning.”