Step 1 · the playing field
A genuine curve over Fp
Pick a field size. We generate a real curve
y² = x³ + ax + b (mod p) whose group order
n is prime (so every point generates the group), choose a generator G, pick a secret
k, and publish only Q = kG — exactly the data an attacker sees.
p ≈
curve
field prime p
group order n (prime)
generator G
public point Q = kG
secret khidden — recover it below
Step 2 · solver A
Baby-Step / Giant-Step
Build a table of
jG for j<√n (baby steps), then leap by √n·G
(giant steps) until Q lands in the table. Deterministic, O(√n) time and memory.baby table size m=⌈√n⌉
steps taken
steps / √n
recovered k
verify kG = Q
Step 2 · solver B
Pollard's rho
A pseudo-random walk that mixes
+G, +Q, doubling. It must eventually
revisit a point — the path makes a ρ shape — and the collision solves for k.
O(√n) time, O(1) memory.tail + cycle length
steps to collision
recovered k
verify kG = Q
Step 3 · scale it up
Why 256 bits is a wall
Both solvers cost about
√n operations. Slide the key size and watch that number — and the
time to run it — explode. The curves you just cracked sit at the far left; Bitcoin's secp256k1 sits at 256.key size48 bits
group order n
operations ≈ √n
time to recover one key
vs age of the universe
status
Reference points: 2¹³–2²⁰ = the curves cracked above (milliseconds).
2⁸⁰ ≈ the largest ECDLP ever solved publicly (years of a global effort).
2²⁵⁶ = secp256k1 → ~2¹²⁸ operations. There is no known generic shortcut
under the √n law — which is the whole reason the curve was chosen.