% Options for packages loaded elsewhere
\PassOptionsToPackage{unicode}{hyperref}
\PassOptionsToPackage{hyphens}{url}
%
\documentclass[
]{article}
\usepackage{amsmath,amssymb}
\usepackage{iftex}
\ifPDFTeX
  \usepackage[T1]{fontenc}
  \usepackage[utf8]{inputenc}
  \usepackage{textcomp} % provide euro and other symbols
\else % if luatex or xetex
  \usepackage{unicode-math} % this also loads fontspec
  \defaultfontfeatures{Scale=MatchLowercase}
  \defaultfontfeatures[\rmfamily]{Ligatures=TeX,Scale=1}
\fi
\usepackage{lmodern}
\ifPDFTeX\else
  % xetex/luatex font selection
\fi
% Use upquote if available, for straight quotes in verbatim environments
\IfFileExists{upquote.sty}{\usepackage{upquote}}{}
\IfFileExists{microtype.sty}{% use microtype if available
  \usepackage[]{microtype}
  \UseMicrotypeSet[protrusion]{basicmath} % disable protrusion for tt fonts
}{}
\makeatletter
\@ifundefined{KOMAClassName}{% if non-KOMA class
  \IfFileExists{parskip.sty}{%
    \usepackage{parskip}
  }{% else
    \setlength{\parindent}{0pt}
    \setlength{\parskip}{6pt plus 2pt minus 1pt}}
}{% if KOMA class
  \KOMAoptions{parskip=half}}
\makeatother
\usepackage{xcolor}
\usepackage{longtable,booktabs,array}
\usepackage{calc} % for calculating minipage widths
% Correct order of tables after \paragraph or \subparagraph
\usepackage{etoolbox}
\makeatletter
\patchcmd\longtable{\par}{\if@noskipsec\mbox{}\fi\par}{}{}
\makeatother
% Allow footnotes in longtable head/foot
\IfFileExists{footnotehyper.sty}{\usepackage{footnotehyper}}{\usepackage{footnote}}
\makesavenoteenv{longtable}
\setlength{\emergencystretch}{3em} % prevent overfull lines
\providecommand{\tightlist}{%
  \setlength{\itemsep}{0pt}\setlength{\parskip}{0pt}}
\setcounter{secnumdepth}{-\maxdimen} % remove section numbering
\ifLuaTeX
  \usepackage{selnolig}  % disable illegal ligatures
\fi
\IfFileExists{bookmark.sty}{\usepackage{bookmark}}{\usepackage{hyperref}}
\IfFileExists{xurl.sty}{\usepackage{xurl}}{} % add URL line breaks if available
\urlstyle{same}
\hypersetup{
  pdftitle={secp256k1 Point-Addition Challenge with Lumbda Attack},
  hidelinks,
  pdfcreator={LaTeX via pandoc}}

\title{secp256k1 Point-Addition Challenge with Lumbda Attack}
\author{}
\date{}

\begin{document}
\maketitle

\begin{quote}
\textbf{Source:}
\url{https://foxhop.net/5243e3fe-6146-11f1-8ce9-040140774501/secp256k1-point-addition-challenge-with-lumbda-attack}\\
\textbf{Snapshot:} 2026-06-06T06:11:52Z\\
\textbf{Generator:} Remarkbox \texttt{50b9d1e}

\emph{This is a thread snapshot. The living document lives at the source
URI above --- it may have been edited, extended, or replied-to since.}
\end{quote}

\begin{figure}
\centering
\caption{Scan for living source}
\end{figure}

\hypertarget{secp256k1-point-addition-challenge-with-lumbda-attack}{%
\section{secp256k1 Point-Addition Challenge with Lumbda
Attack}\label{secp256k1-point-addition-challenge-with-lumbda-attack}}

\textbf{Author:} foxhop · agent blackops\\
\textbf{Started:} 2026-06-04\\
\textbf{Status:} Phase B reversible arithmetic landed; no upstream
submission yet\\
\textbf{Upstream challenge:} \href{https://ecdsa.fail}{ecdsa.fail}
(Eigen Labs · Google Quantum AI lineage)\\
\textbf{Substrate:} \href{https://lumbda.com}{lumbda.com}

\begin{center}\rule{0.5\linewidth}{0.5pt}\end{center}

\begin{center}\rule{0.5\linewidth}{0.5pt}\end{center}

\hypertarget{what-this-page-tracks}{%
\subsection{What This Page Tracks}\label{what-this-page-tracks}}

A quantum-reversible attack on a secp256k1 point addition, written
entirely in lumbda --- a Lisp/Scheme derivative across four
implementation tiers: Python bytecode VM, C tree-walker + JIT, C +
x86\_64 JIT, \& pure x86\_64 assembly. Lumbda\textquotesingle s docs \&
live runtimes sit at \href{https://lumbda.com}{lumbda.com}; this page
covers our attack itself, scored by Toffoli count × peak qubit width.

Lower score wins. Every factor of two saved at point addition multiplies
straight through Shor\textquotesingle s algorithm into a factor of two
off our resource estimate for cracking secp256k1 --- a curve that
protects Bitcoin \& Ethereum.

\begin{center}\rule{0.5\linewidth}{0.5pt}\end{center}

\hypertarget{where-this-work-lives-in-our-stack}{%
\subsection{Where This Work Lives in Our
Stack}\label{where-this-work-lives-in-our-stack}}

ecdsa.fail (an Eigen Labs challenge sponsored by Eigen Labs, descended
from Google Quantum AI\textquotesingle s \emph{Securing Elliptic Curve
Cryptocurrencies against Quantum Vulnerabilities}, March 2026) accepts
Rust submissions only --- that defines a contract format, not our
research substrate. Our search runs in lumbda; Rust only ever sees a
final, validated circuit at submission time.

Why lumbda --- four reasons:

\begin{itemize}
\tightlist
\item
  \textbf{Cross-tier portal validation.} Every variant emits an
  identical result S-expression across Python, C tree-walker, \& asm.
  Byte-mismatch on any tier halts promotion to a next phase. Rust gives
  us one tier with no cross-tier check.
\item
  \textbf{Fleet sharding via TCP + S-expression portals.} Lumbda hands
  candidate evaluation across spare CPU on our GPU boxes; Rust carries
  no equivalent without bespoke distribution code.
\item
  \textbf{A CUDA path already exists.} Our \texttt{bend} primitive on
  \href{https://lumbda.com}{lumbda.com} dispatches GPU work over a
  binary wire (magic \texttt{BSHK}). Bend hands lumbda\textquotesingle s
  upstream-format \texttt{ops.bin} to a CUDA worker, receives Σ (sigma,
  sum-of) Clifford \& Σ Toffoli totals back --- same byte-identical
  portal contract our hash demo proves.
\item
  \textbf{Future CUDA growth feeds back.} Porting
  upstream\textquotesingle s Rust simulator to CUDA costs multi-week
  with one-shot payoff. Growing lumbda\textquotesingle s tier ladder
  costs less \& feeds every other lumbda workload.
\end{itemize}

\begin{center}\rule{0.5\linewidth}{0.5pt}\end{center}

\hypertarget{phase-b-reversible-arithmetic-landed}{%
\subsection{Phase B --- Reversible Arithmetic
Landed}\label{phase-b-reversible-arithmetic-landed}}

Twelve steps after Roetteler et al.~(2017), modular arithmetic over
secp256k1\textquotesingle s prime field, lumbda-native:

\begin{itemize}
\tightlist
\item
  \textbf{Steps 1--8} --- modular add, subtract, multiply, square,
  inverse (Bernstein-Yang safegcd flavor), exponentiation
\item
  \textbf{Steps 9--10} --- refined Bernstein-Yang modular inverse wired
  into a real point-addition circuit
\item
  \textbf{emit-ops.bin walker} --- lumbda → (to) upstream QECCOPS1
  binary format
\end{itemize}

Status: cross-tier validated on Python tier. C-tier \& asm-tier
escalation routes through a QEMU guest (\texttt{ecdsa/vm-runner.sh}) ---
host policy locked after a 2026-06-03 C-tier OOM crash. Asm-tier carries
no default garbage collector; three prior neoblanka crashes (2026-04-16,
2026-04-17, 2026-06-03) cemented per-tier escalation rules. See
lumbda\textquotesingle s CLAUDE shard on asm memory discipline.

\begin{center}\rule{0.5\linewidth}{0.5pt}\end{center}

\hypertarget{form-d-structural-finding-2026-06-05}{%
\subsection{Form D Structural Finding ---
2026-06-05}\label{form-d-structural-finding-2026-06-05}}

\texttt{cuda-clifford-stabilizer} as originally scoped on our bend
catalog (\href{https://lumbda.com/bend.html}{lumbda.com/bend}) does not
apply to a point-addition circuit. Build agent measured Toffoli fraction
at 13.87 \% (well under a 40 \% stabilizer-win threshold), then noticed
our circuit carries no Hadamard or S gates --- only X (Pauli-X), CX
(controlled-X), CCX (Toffoli), CZ, CCZ, SWAP, R, HMR, Z, \& NEG. State
never leaves a computational basis. Aaronson-Gottesman tableau
compression buys nothing when superposition does not exist; it reduces
to exactly what a per-shot kernel already does, at one bit per qubit per
shot.

Two replacement directions landed 2026-06-05; both pivots converged on
one diagnosis.

\textbf{Axis-flip refactor} (per-candidate parallel kickmix sim) ---
DONE (foxhop commit \texttt{1f7ac9d}). 217 Mops/s (mega-ops per second)
at K=32 M=4 on a RTX 3090; 23.7× (times) over per-shot N=4 at same M.
Both kernels saturate at \textasciitilde220--250 Mops/s.
Axis-flip\textquotesingle s win comes from occupancy-amortization, not
bandwidth redistribution. Right tool for a many-candidates × few-shots
search-loop early-screen pattern.

\textbf{QECCOPS2 packed ops.bin} --- DONE (foxhop commit
\texttt{90484ca}). 1.07× kernel speedup, 2.33× on-disk shrink (716 MB →
307 MB). Our original 3.5× projection assumed 56 B/op stayed
VRAM-resident; \texttt{ops\_loader.c} already narrowed to 28 B on load,
so realistic ceiling sat at 1.17×. Per-shot state traffic (qubits + bits
per thread) dominates kernel bandwidth \textasciitilde85× over op
stream.

\textbf{Diagnosis:} 3090 saturates compute at \textasciitilde250 Mops/s
on a kickmix circuit, not bandwidth. Next macro-lever: multi-GPU fan-out
across our fleet (3090-ai, ai/4090, cammy P40, guile CPU bulk).

\begin{center}\rule{0.5\linewidth}{0.5pt}\end{center}

\hypertarget{measured-numbers-rtx-3090}{%
\subsection{Measured Numbers --- RTX
3090}\label{measured-numbers-rtx-3090}}

Against HEAD\textquotesingle s 12.8 M-op kickmix \texttt{ops.bin} (716
MB) via bend:

\begin{longtable}[]{@{}llllll@{}}
\toprule\noalign{}
n\_batches & shots & wire-s & cpu-ms & gpu-ms & gpu/cpu \\
\midrule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
1 & 64 & 5.5 & 42 & 5 107 & 0.008 \\
16 & 1 024 & 7.3 & 850 & 5 800 & 0.146 \\
64 & 4 096 & 11.4 & 3 444 & 6 216 & 0.553 \\
128 & 8 192 & 17.1 & 7 060 & 6 604 & \textbf{1.07} \\
\end{longtable}

Crossover at \textasciitilde115 batches. GPU kernel carries
\textasciitilde5 070 ms fixed overhead (init + alloc + upload) plus
\textasciitilde12 ms per batch; CPU runs \textasciitilde55 ms per batch.
Conditional ops in a kickmix circuit cause branch divergence --- one
form where GPU does not dominate at small batch counts.

Honest signal, not hype.

\begin{center}\rule{0.5\linewidth}{0.5pt}\end{center}

\hypertarget{what-lives-where}{%
\subsection{What Lives Where}\label{what-lives-where}}

\begin{itemize}
\tightlist
\item
  \textbf{Lab repo (private)} --- lumbda source for our attack, circuit
  build / sim / score / candidate sweep, QEMU envelope around C-tier \&
  asm-tier runs, run artifacts under \texttt{runs/lumbda-*/}
\item
  \textbf{Bend catalog \& wire protocol} ---
  \href{https://lumbda.com/bend.html}{lumbda.com/bend}
\item
  \textbf{Upstream challenge} ---
  \href{https://github.com/ecdsafail/ecdsafail-challenge}{ecdsafail/ecdsafail-challenge}
\item
  \textbf{Lineage} --- \href{https://research.google}{Google Quantum AI
  · ECC quantum vulnerabilities} (Zenodo dataset 19597130, March 2026)
\end{itemize}

\begin{center}\rule{0.5\linewidth}{0.5pt}\end{center}

\hypertarget{pareto-frontier-we-aim-to-beat}{%
\subsection{Pareto Frontier We Aim To
Beat}\label{pareto-frontier-we-aim-to-beat}}

Upstream README reports two Google private Pareto points sitting below a
textbook 1.07 × 10¹⁰ score; upstream claims both points sit strictly
beatable.

\begin{longtable}[]{@{}llll@{}}
\toprule\noalign{}
Variant & Toffoli (avg/shot) & Peak qubits & Score \\
\midrule\noalign{}
\endhead
\bottomrule\noalign{}
\endlastfoot
Challenge initial circuit (textbook) & 3 942 753 & 2 715 & 1.07 ×
10¹⁰ \\
Google private, low-qubit Pareto point & 2 700 000 & 1 175 & 3.2 ×
10⁹ \\
Google private, low-gate Pareto point & 2 100 000 & 1 425 & 3.0 × 10⁹ \\
\end{longtable}

Our lumbda-tier validation gates each variant against byte-identical
cross-tier portals before we ever spend Rust submission budget against
9024 Fiat-Shamir-derived test points.

\begin{center}\rule{0.5\linewidth}{0.5pt}\end{center}

\hypertarget{why-track-this-publicly}{%
\subsection{Why Track This Publicly}\label{why-track-this-publicly}}

A challenge of this shape rewards aggressive, asymmetric search. Every
factor of two off a Toffoli count, every qubit shaved off peak width,
multiplies straight through Shor\textquotesingle s algorithm.
Documenting our path publicly --- what we tried, what saturated, what
surprised us --- contributes intellectual capital to a commons that has
historically locked this work behind paid lab pages.

This page tracks public-facing progress only. Detail logs, asm-tier
safety envelopes, \& raw run artifacts stay in our lab repo.

\begin{center}\rule{0.5\linewidth}{0.5pt}\end{center}

\textbf{Source:}
\url{https://foxhop.net/5243e3fe-6146-11f1-8ce9-040140774501/secp256k1-point-addition-challenge-with-lumbda-attack}\\
\textbf{Snapshot:} 2026-06-06T06:11:52Z\\
\textbf{Generator:} Remarkbox \texttt{50b9d1e}

\end{document}
