{"revision": {"id": "0e1cb332-6274-11f1-97ac-040140774501", "node_id": "5243e3fe-6146-11f1-8ce9-040140774501", "user_id": "680aec8e-3391-11f1-95d9-040140774501", "author": "russell", "data": ".. ecdsa.rst \u2014 public wiki page for https://www.foxhop.net/ecdsa\r\n.. CC0 / public domain content; lumbda runtime AGPLv3\r\n.. foxhop \u00b7 agent blackops \u00b7 2026-06-05\r\n\r\nsecp256k1 Point-Addition Challenge \u2014 Lumbda Attack\r\n====================================================\r\n\r\n| **Author:** foxhop \u00b7 agent blackops\r\n| **Started:** 2026-06-04\r\n| **Status:** Phase B reversible arithmetic landed; first lever sweep measured at p=11; no upstream submission yet\r\n| **Upstream challenge:** ecdsa.fail_ (Eigen Labs \u00b7 Google Quantum AI lineage)\r\n| **Substrate:** lumbda.com_\r\n\r\n.. _ecdsa.fail: https://ecdsa.fail\r\n.. _lumbda.com: https://lumbda.com\r\n\r\n----\r\n\r\n.. contents::\r\n   :depth: 2\r\n   :local:\r\n\r\n----\r\n\r\nWhat This Page Tracks\r\n---------------------\r\n\r\nA quantum-reversible attack on a secp256k1 point addition, written entirely in\r\nlumbda \u2014 a Lisp/Scheme derivative across four implementation tiers: Python\r\nbytecode VM, C tree-walker + JIT, C + x86_64 JIT, & pure x86_64 assembly.\r\nLumbda's docs & live runtimes sit at lumbda.com_; this page covers our attack\r\nitself, scored by Toffoli count \u00d7 peak qubit width.\r\n\r\nLower score wins. Every factor of two saved at point addition multiplies straight\r\nthrough Shor's algorithm into a factor of two off our resource estimate for\r\ncracking secp256k1 \u2014 a curve that protects Bitcoin & Ethereum.\r\n\r\n----\r\n\r\nWhere This Work Lives in Our Stack\r\n-----------------------------------\r\n\r\necdsa.fail (an Eigen Labs challenge sponsored by Eigen Labs, descended from\r\nGoogle Quantum AI's *Securing Elliptic Curve Cryptocurrencies against Quantum\r\nVulnerabilities*, March 2026) accepts Rust submissions only \u2014 that defines a\r\ncontract format, not our research substrate. Our search runs in lumbda; Rust\r\nonly ever sees a final, validated circuit at submission time.\r\n\r\nWhy lumbda \u2014 four reasons:\r\n\r\n- **Cross-tier portal validation.** Every variant emits an identical result\r\n  S-expression across Python, C tree-walker, & asm. Byte-mismatch on any tier\r\n  halts promotion to a next phase. Rust gives us one tier with no cross-tier\r\n  check.\r\n- **Fleet sharding via TCP + S-expression portals.** Lumbda hands candidate\r\n  evaluation across spare CPU on our GPU boxes; Rust carries no equivalent\r\n  without bespoke distribution code.\r\n- **A CUDA path already exists.** Our ``bend`` primitive on lumbda.com_\r\n  dispatches GPU work over a binary wire (magic ``BSHK``). Bend hands lumbda's\r\n  upstream-format ``ops.bin`` to a CUDA worker, receives \u03a3 (sigma, sum-of)\r\n  Clifford & \u03a3 Toffoli totals back \u2014 same byte-identical portal contract our\r\n  hash demo proves.\r\n- **Future CUDA growth feeds back.** Porting upstream's Rust simulator to CUDA\r\n  costs multi-week with one-shot payoff. Growing lumbda's tier ladder costs\r\n  less & feeds every other lumbda workload.\r\n\r\n----\r\n\r\nPhase B \u2014 Reversible Arithmetic Landed\r\n---------------------------------------\r\n\r\nTwelve steps after Roetteler et al. (2017), modular arithmetic over secp256k1's\r\nprime field, lumbda-native:\r\n\r\n- **Steps 1\u20138** \u2014 modular add, subtract, multiply, square, inverse\r\n  (Bernstein-Yang safegcd flavor), exponentiation\r\n- **Steps 9\u201310** \u2014 refined Bernstein-Yang modular inverse wired into a real\r\n  point-addition circuit\r\n- **emit-ops.bin walker** \u2014 lumbda \u2192 (to) upstream QECCOPS1 binary format,\r\n  full kind table 0..17 coverage, cross-validated against demo_ops\r\n  byte-identical on a real round trip\r\n\r\nCross-tier validated on Python tier. C-tier & asm-tier escalation routes\r\nthrough a QEMU guest (``ecdsa/vm-runner.sh``) \u2014 host policy locked after a\r\n2026-06-03 C-tier OOM crash. Asm-tier carries no default garbage collector;\r\nthree prior neoblanka crashes (2026-04-16, 2026-04-17, 2026-06-03) cemented\r\nper-tier escalation rules. See lumbda's CLAUDE shard on asm memory\r\ndiscipline.\r\n\r\n----\r\n\r\nFirst Lever Sweep \u2014 2026-06-05/06\r\n-----------------------------------\r\n\r\nA six-variant cartesian product of our active Phase B knobs, scored at\r\np=11 n+1=5 (point-add width small enough to fit a full sweep into one\r\nafternoon of CPU) through our closed-loop pipeline:\r\n\r\n::\r\n\r\n   lever-variants.lsp  \u2192  emit-ops-bin walker  \u2192  /tmp/variant-N.bin\r\n                                                          \u2193\r\n                                  bend wire \u2192 3090-ai gpu-worker\r\n                                                          \u2193\r\n                                       demo_ops portal \u2192 results.tsv\r\n\r\nThree boolean Phase B knobs surveyed produce six structurally distinct\r\ncircuits (refined-B-Y collapses when B-Y itself stays off):\r\n\r\n==  =========  =============  ======  ============  ===========\r\nid  mul       inv             n_ops   \u03a3 Toffoli     vs default\r\n==  =========  =============  ======  ============  ===========\r\n5   solinas    refined-B-Y    32 333  **475 648**   **\u221265.2 %**\r\n2   litinski   refined-B-Y    34 468  518 656       \u221262.0 %\r\n4   solinas    textbook-B-Y   48 763  749 056       \u221245.1 %\r\n1   litinski   textbook-B-Y   50 898  792 064       \u221242.0 %\r\n3   solinas    Fermat         77 439  1 027 584     \u221224.7 %\r\n0   litinski   Fermat (def.)  94 214  1 365 504     0.0 %\r\n==  =========  =============  ======  ============  ===========\r\n\r\n**Headline:** combined Solinas mod-mul + refined Bernstein-Yang mod-inv\r\ncuts \u03a3 Toffoli by 65.2 % versus our default lever stack (Litinski\r\nschoolbook mod-mul + Fermat inversion).\r\n\r\nKnob attribution\r\n~~~~~~~~~~~~~~~~~\r\n\r\n*Inversion knob* (refined-B-Y vs Fermat) dominates:\r\n\r\n- at Litinski mod-mul: 1 365 504 \u2192 518 656 = **\u221262.0 %**\r\n- at Solinas mod-mul:  1 027 584 \u2192 475 648 = **\u221253.7 %**\r\n\r\n*Multiplication knob* (Solinas vs Litinski) carries a non-additive\r\ninteraction with inv-knob choice:\r\n\r\n- at Fermat:        1 365 504 \u2192 1 027 584 = **\u221224.7 %**\r\n- at textbook-B-Y:    792 064 \u2192   749 056 =  \u22125.4 %\r\n- at refined-B-Y:     518 656 \u2192   475 648 =  \u22128.3 %\r\n\r\nFermat does repeated mod-muls so a faster mod-mul compounds; Bernstein-Yang\r\ncarries mod-mul-light arithmetic so a mul-knob contribution fades.\r\n**\u221262 % combined with \u22128 % rounds to \u221265 % rather than \u221270 %** \u2014 exactly\r\nour observed math.\r\n\r\nCross-scale prediction check\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nA small-fixture screen (p=5, n+1=4) ran during lever-space discovery\r\npredicted refined-B-Y at roughly \u221256 %; an independent p=251 ground-truth\r\nreference predicted \u221240 %. Our p=11 measurement landed at \u221236.5 % within a\r\nSolinas branch \u2014 within three percentage points of our p=251 prediction.\r\n**A cheap small-width screen survives a scale jump faithfully**, which\r\nlets future runs sweep wide at p=11 first, filter to winners, then spend\r\nexpensive p=251 budget only on a short list.\r\n\r\nA standalone refined-B-Y modular inverse at an intermediate width\r\n(n+1=13, p=4093 = 2\u00b9\u00b2 \u2212 3 Solinas-form) lands 12 908 Toffoli \u2014 a 2.74\u00d7\r\nmultiplier over our n+1=9 datapoint of 4 704. Theoretical n\u00b2 scaling\r\n(13/9)\u00b2 = 2.09; observed sits modestly above, consistent with width-\r\ndependent Solinas reduction overhead growing slower than n\u00b2. A separate\r\nclassical-helper probe at full secp256k1 width (p = 2\u00b2\u2075\u2076 \u2212 2\u00b3\u00b2 \u2212 977,\r\n77-digit prime) ran ``classical-mod-inv`` against a small input &\r\nroundtripped through 7 \u00d7 inv mod p = 1 \u2014 our build-time classical\r\nmachinery survives 256-bit Python bignums; only an emit-side substrate\r\nupgrade gates a full quantum build at that width.\r\n\r\nEnd-to-end GPU timing \u2014 refined vs textbook B-Y\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nOur refined-B-Y ``ops.bin`` for one p=11 point-add ran on a 3090-ai\r\n``gpu-worker`` against ``demo_ops`` for direct head-to-head wall measurement:\r\n\r\n==============  ===========  =========  =====================\r\npath            \u03a3 Toffoli    qec ops    GPU wall (1024 shots)\r\n==============  ===========  =========  =====================\r\ntextbook B-Y    11 704       48 763     14.4 ms\r\nrefined  B-Y     7 432       32 333      **8.8 ms**\r\n==============  ===========  =========  =====================\r\n\r\nRefined cuts 36.5 % off \u03a3 Toffoli (knob-attribution row) & shows up as\r\n**39 % GPU wall reduction at one shot batch** on real silicon. Step 10\r\nlands at our hardware layer & not only on a Scheme counter.\r\n\r\nSubstrate now closed-loop\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nEvery piece of an end-to-end research engine sits live:\r\n\r\n- ``lever-variants.lsp`` exposes ``(lever-permutations)`` for arbitrary\r\n  knob cartesians\r\n- ``emit-ops-bin.lsp`` walks any Phase B circuit form into a QECCOPS1\r\n  binary on disk\r\n- ``bend`` dispatches an ops.bin path to whichever fleet worker holds a\r\n  warm CUDA context\r\n- ``demo_ops`` returns \u03a3 Clifford & \u03a3 Toffoli via a portal\r\n- ``dispatch-sweep.py`` auto-resumes against new ``.bin`` files\r\n\r\nEmit pipeline went through two algorithmic rewrites & a Python-tier\r\nprimitive lift after our first p=251 host probe leaked 8 MB/sec to its\r\n``string-append`` tape until ``kill -9``:\r\n\r\n- **Body assembly** switched from an O(N\u00b2) recursive\r\n  ``(string-append acc op-bytes)`` accumulator to a list-of-strings +\r\n  single ``(apply string-append parts)`` pass \u2014 Python-tier emit phase\r\n  dropped 642 sec \u2192 49 sec on a 32 k-op p=11 case.\r\n- **Layout lookups** switched from an alist (linear ``assoc``) to a\r\n  hash-table \u2014 ``qid-of`` now resolves a register reference in O(1).\r\n- **Walk & serialize lifted into lumbda's host language** via two new\r\n  lumbda primitives, ``walk-circuit-ops`` & ``op-specs->bytes``\r\n  (lumbda.com_) \u2014 Python-tier walk dropped 252 sec \u2192 237 ms, serialize\r\n  dropped 49 sec \u2192 84 ms. Per-op Scheme interpreter cost vanishes;\r\n  dispatch by interned-symbol identity in pure Python lives at native\r\n  loop speed.\r\n\r\nEnd-to-end: one Python-tier p=11 emission now lands in ~4 sec wall on\r\nhost, byte-identical against our pre-rewrite reference file. A next\r\nsweep at wider p waits on quantum build cost rather than substrate\r\nplumbing.\r\n\r\n----\r\n\r\nLumbda Speedups Engineered For This Race\r\n-----------------------------------------\r\n\r\nOur research substrate has gone through several rounds of targeted\r\noptimization as we push circuit emit & dispatch throughput to a level\r\nwhere wide lever sweeps complete in minutes instead of afternoons. Each\r\nchange earns a measured wall delta on our canonical p=11 32 k-op circuit\r\n\u2014 our smallest scaling-faithful test case \u2014 & survives cross-tier as we\r\nport forward.\r\n\r\nAlgorithmic rewrites (foxhop ecdsa)\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nLever-agnostic. Same wins flow through Python, C tree-walker, & asm\r\ntier identically (commits ``55605d2``, ``f486a74``).\r\n\r\n- **Streaming body assembly** \u2014 emit-ops-bin's accumulator\r\n  switched from an O(N\u00b2) recursive ``(string-append acc op-bytes)`` to a\r\n  list-of-strings + single ``(apply string-append parts)`` pass.\r\n  Python-tier emit phase dropped 642 sec \u2192 49 sec on our 32 k-op case.\r\n  That win holds before any host primitive enters.\r\n- **Hash-table register layout** \u2014 point-add->ops's ``qid-of``\r\n  switched from a linear ``assoc`` over an alist to ``hash-table-ref``\r\n  on a hash-table. O(layout-size) per qubit reference \u2192 O(1).\r\n- **Cross-tier portability** \u2014 ``(string char)`` swapped to\r\n  ``(make-string 1 char)`` since our C-tier built-in set lacks\r\n  ``string``. Without that swap C-tier emit fails at parse with\r\n  ``undefined: string``.\r\n\r\nPython-tier host primitives (lumbda)\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nThree primitives (lumbda commit ``99701c8``) lift our emit pipeline out\r\nof our Scheme tree-walker. Each dispatches by interned-symbol identity\r\nin pure Python, packs binary fields via ``struct.Struct.pack``, & returns\r\nScheme-native lists / vectors. Per-iteration interpreter overhead\r\nvanishes; native loop speed replaces it.\r\n\r\n============================  ===========  ==========  ========  ====================================\r\nprimitive                     pre-Scheme   post-host   speedup   replaces\r\n============================  ===========  ==========  ========  ====================================\r\n``walk-circuit-ops``          252 sec      237 ms      1060\u00d7     emit-ops-bin's let-walk dispatch loop\r\n``op-specs->bytes``           49 sec       84 ms       580\u00d7      per-op string-append encoder\r\n``count-lumbda-ops``          ~200 sec     <50 ms      4000\u00d7+    pure-Scheme tag tally\r\n============================  ===========  ==========  ========  ====================================\r\n\r\nC-tier port \u2014 landed\r\n~~~~~~~~~~~~~~~~~~~~~\r\n\r\n``bi_walk_circuit_ops``, ``bi_op_specs_to_bytes``, ``bi_count_lumbda_ops``\r\nship in lumbda's ``c/builtins.c``. Direct translation of our Python\r\nalgorithm: hash-table layout via ``ht_set / ht_ref``, ``make_vector_from``\r\nfor op-spec records, hand-written little-endian byte packing in\r\n``pack_u64_slot``. ``VAL_FALSE`` carries our \"no slot\" sentinel inside\r\nop-spec vectors since C-tier fixnums cap at 48 bits & cannot hold\r\nNO_SLOT = 2\u2076\u2074\u22121 directly; ``op-specs->bytes`` writes\r\n``0xFFFFFFFFFFFFFFFF`` whenever it sees ``VAL_FALSE``.\r\n\r\nC-tier measurement (lumbda-c inside QEMU guest, same p=11 textbook+refined\r\npair our Python baseline ran):\r\n\r\n============  =========  =========  ============================\r\ntier          wall       speedup    note\r\n============  =========  =========  ============================\r\nPython        6.9 sec    baseline   walk+emit primitives lifted\r\nC tier        0.71 sec   **9.7\u00d7**   same primitives in native C\r\n============  =========  =========  ============================\r\n\r\nOutput verified byte-identical against our Python-tier reference files\r\nvia ``cmp`` on both textbook & refined paths.\r\n\r\nAsm-tier port \u2014 deferred\r\n~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nLumbda's asm tier ``lumbda-full`` (mark-sweep GC) delivers a 160\u00d7\r\nspeedup over Python on portal round-trip per lumbda's whitepaper \u00a76.6.4\r\n(six-point-six-point-four), serving our **bulk 9024-shot validation**\r\nworkload \u2014 simulator runs shots against an emitted ops.bin, not emit\r\nitself. Our emit pipeline targets Python tier (dev iteration) & C tier\r\ninside QEMU (production scale); asm tier consumes ops.bin, doesn't\r\nproduce it.\r\n\r\nPorting our three primitives into ``asm/lumbda.s`` would land roughly\r\n700-900 lines of hand-written x86_64 asm \u2014 hash-table mutation, list\r\ntraversal, vector construction with 7 slots, dispatch across 9 op\r\ntags \u2014 plus QEMU debug cycles. Two- to four-day effort matched against\r\nno current workflow that calls our primitives from an asm-tier process.\r\nPort lands when an asm-tier emit consumer materializes; until then our\r\nPython + C tier coverage saturates our pipeline.\r\n\r\nEnd-to-end measurement\r\n~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nOur canonical p=11 textbook+refined emit pair journey:\r\n\r\n==========================  ==========  ===========\r\nsubstrate                   wall        speedup\r\n==========================  ==========  ===========\r\npre-rewrite Python tier     ~10 min     baseline\r\npost-algorithmic rewrites   ~7 min      ~1.4\u00d7\r\npost-Python primitive lift  6.9 sec     ~85\u00d7\r\npost-C-tier port            0.71 sec    **~830\u00d7**\r\n==========================  ==========  ===========\r\n\r\nByte-identical output verified by ``cmp`` at every step. C tier matches\r\nPython tier byte-for-byte across both textbook & refined paths.\r\n\r\n----\r\n\r\nWhy CPU Produces & GPU Scores\r\n-------------------------------\r\n\r\nOur pipeline splits across two distinct hardware classes for reasons\r\nthat fall out of each step's structure.\r\n\r\nCandidate production runs on CPU\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nBuilding a reversible quantum circuit threads through a sequential\r\ndependency chain \u2014 each emitted gate references a hash-table layout\r\nthat every previous gate has mutated, every register allocation grows\r\na qubit-base counter consumed by everything downstream. Branchy\r\ncontrol flow & irregular memory access characterize our build phase:\r\ndispatch on op tag, lookup register in a hash table, cons onto a list,\r\nallocate a 7-slot vector, repeat across ~80 000 ops per candidate.\r\n\r\nGPUs starve on patterns like that. CUDA warps run 32 threads in\r\nlockstep; dispatch divergence \u2014 one thread executing a CCX branch\r\nwhile another walks an alloc branch \u2014 collapses our occupancy.\r\nLayouts & lists live in irregular memory; coalesced DRAM accesses\r\nrequire neighboring threads to touch adjacent addresses, which our\r\nhash-table mutations never do.\r\n\r\nCPUs handle exactly this pattern at native loop speed. Inside our\r\n2-vCPU QEMU guest, lumbda's C tree-walker carries our three host\r\nprimitives (``walk-circuit-ops``, ``op-specs->bytes``,\r\n``count-lumbda-ops``) at **~3.6 million native operations / second\r\non one thread** \u2014 one full candidate (~80 K op-spec records,\r\n~4.5 MB QECCOPS1 binary) finishes inside 350 ms. Per-candidate work\r\nscales roughly with circuit width: ~n\u00b2 at our Solinas mod-mul, ~n\r\nat our Bernstein-Yang inverse.\r\n\r\nCandidate scoring runs on GPU\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nScoring runs 64\u20131024 reversible shots against one candidate. Each\r\nshot starts with an independent input bit pattern, walks our same\r\nops.bin forward, & reports \u03a3 Toffoli & \u03a3 Clifford counts. Shots run\r\nwholly independent of each other \u2014 SIMT-perfect (single instruction\r\nmultiple thread, Nvidia's GPU execution model). Our ``demo_ops``\r\nkernel on a 3090 saturates at **~220\u2013250 Mops / second** consuming a\r\ncandidate in 8.8 ms for 1024 shots.\r\n\r\nA single CPU thread walking one shot at a time runs ~50 ms for that\r\nsame 1024-shot \u00d7 32 K-op workload \u2014 6\u00d7 slower than one 3090. Across\r\nour fleet (3090-ai, ai/4090, cammy P40, guile bulk), multi-GPU\r\nfan-out compounds on top.\r\n\r\nWhy our split matters now\r\n~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nBefore this session our emit phase ran at ~4 300 lumbda ops / second\r\ninside our Scheme tree-walker. A 3090 consuming Mops / second sat\r\nidle waiting for candidates. Now our emit primitives push 3.6M ops /\r\nsecond per CPU thread. A single CPU still trails a single 3090 by\r\n~60\u00d7 on raw op throughput, so multi-CPU production keeps GPU work\r\nflowing \u2014 saturation reaches matched throughput at roughly 60 CPU\r\nthreads per 3090. Our fleet's spare CPU on every GPU box (~12 vCPU\r\nper node, four nodes live) sits well above that ratio, which makes\r\nmulti-GPU fan-out throughput-meaningful rather than theoretical.\r\n\r\nWhat stays balanced. CPU produces ~3 candidates / second / thread;\r\none 3090 scores ~7.5 candidates / second at saturation (1024 shots \u00d7\r\n32 K ops). Three CPU threads keep one GPU fed; our 12-vCPU node\r\nkeeps four GPUs fed; our fleet covers a 16-GPU-equivalent ceiling\r\nbefore emit becomes our bottleneck again.\r\n\r\n----\r\n\r\nForm D Structural Finding \u2014 2026-06-05\r\n---------------------------------------\r\n\r\n``cuda-clifford-stabilizer`` as originally scoped on our bend catalog\r\n(`lumbda.com/bend <https://lumbda.com/bend.html>`__) does not apply to a\r\npoint-addition circuit. Build agent measured Toffoli fraction at 13.87 %\r\n(well under a 40 % stabilizer-win threshold), then noticed our circuit\r\ncarries no Hadamard or S gates \u2014 only X (Pauli-X), CX (controlled-X), CCX\r\n(Toffoli), CZ, CCZ, SWAP, R, HMR, Z, & NEG. State never leaves a\r\ncomputational basis. Aaronson-Gottesman tableau compression buys nothing\r\nwhen superposition does not exist; it reduces to exactly what a per-shot\r\nkernel already does, at one bit per qubit per shot.\r\n\r\nTwo replacement directions landed 2026-06-05; both pivots converged on one\r\ndiagnosis.\r\n\r\n**Axis-flip refactor** (per-candidate parallel kickmix sim) \u2014 DONE\r\n(foxhop commit ``1f7ac9d``). 217 Mops/s (mega-ops per second) at K=32 M=4\r\non a RTX 3090; 23.7\u00d7 (times) over per-shot N=4 at same M. Both kernels\r\nsaturate at ~220\u2013250 Mops/s. Axis-flip's win comes from\r\noccupancy-amortization, not bandwidth redistribution. Right tool for a\r\nmany-candidates \u00d7 few-shots search-loop early-screen pattern.\r\n\r\n**QECCOPS2 packed ops.bin** \u2014 DONE (foxhop commit ``90484ca``). 1.07\u00d7\r\nkernel speedup, 2.33\u00d7 on-disk shrink (716 MB \u2192 307 MB). Our original 3.5\u00d7\r\nprojection assumed 56 B/op stayed VRAM-resident; ``ops_loader.c`` already\r\nnarrowed to 28 B on load, so realistic ceiling sat at 1.17\u00d7. Per-shot\r\nstate traffic (qubits + bits per thread) dominates kernel bandwidth ~85\u00d7\r\nover op stream.\r\n\r\n**Diagnosis:** 3090 saturates compute at ~250 Mops/s on a kickmix circuit,\r\nnot bandwidth. Next macro-lever: multi-GPU fan-out across our fleet\r\n(3090-ai, ai/4090, cammy P40, guile CPU bulk).\r\n\r\n----\r\n\r\nMeasured Numbers \u2014 RTX 3090\r\n----------------------------\r\n\r\nAgainst HEAD's 12.8 M-op kickmix ``ops.bin`` (716 MB) via bend:\r\n\r\n=========  ======  =======  =======  =======  ===========\r\nn_batches  shots   wire-s   cpu-ms   gpu-ms   gpu/cpu\r\n=========  ======  =======  =======  =======  ===========\r\n1          64      5.5      42       5 107    0.008\r\n16         1 024   7.3      850      5 800    0.146\r\n64         4 096   11.4     3 444    6 216    0.553\r\n128        8 192   17.1     7 060    6 604    **1.07**\r\n=========  ======  =======  =======  =======  ===========\r\n\r\nCrossover at ~115 batches. GPU kernel carries ~5 070 ms fixed overhead\r\n(init + alloc + upload) plus ~12 ms per batch; CPU runs ~55 ms per batch.\r\nConditional ops in a kickmix circuit cause branch divergence \u2014 one form\r\nwhere GPU does not dominate at small batch counts.\r\n\r\nHonest signal, not hype.\r\n\r\n----\r\n\r\nWhat Lives Where\r\n----------------\r\n\r\n- **Lab repo (private)** \u2014 lumbda source for our attack, circuit build /\r\n  sim / score / candidate sweep, QEMU envelope around C-tier & asm-tier\r\n  runs, run artifacts under ``runs/lumbda-*/``\r\n- **Bend catalog & wire protocol** \u2014 `lumbda.com/bend\r\n  <https://lumbda.com/bend.html>`__\r\n- **Upstream challenge** \u2014 `ecdsafail/ecdsafail-challenge\r\n  <https://github.com/ecdsafail/ecdsafail-challenge>`__\r\n- **Lineage** \u2014 `Google Quantum AI \u00b7 ECC quantum vulnerabilities\r\n  <https://research.google>`__ (Zenodo dataset 19597130, March 2026)\r\n\r\n----\r\n\r\nPareto Frontier We Aim To Beat\r\n-------------------------------\r\n\r\nUpstream README reports two Google private Pareto points sitting below a\r\ntextbook 1.07 \u00d7 10\u00b9\u2070 score; upstream claims both points sit strictly\r\nbeatable.\r\n\r\n==========================================  ==================  ===========  ============\r\nVariant                                     Toffoli (avg/shot)  Peak qubits  Score\r\n==========================================  ==================  ===========  ============\r\nChallenge initial circuit (textbook)        3 942 753           2 715        1.07 \u00d7 10\u00b9\u2070\r\nGoogle private, low-qubit Pareto point      2 700 000           1 175        3.2  \u00d7 10\u2079\r\nGoogle private, low-gate Pareto point       2 100 000           1 425        3.0  \u00d7 10\u2079\r\n==========================================  ==================  ===========  ============\r\n\r\nOur lumbda-tier validation gates each variant against byte-identical\r\ncross-tier portals before we ever spend Rust submission budget against\r\n9024 Fiat-Shamir-derived test points.\r\n\r\n----\r\n\r\nWhy Track This Publicly\r\n-----------------------\r\n\r\nA challenge of this shape rewards aggressive, asymmetric search. Every\r\nfactor of two off a Toffoli count, every qubit shaved off peak width,\r\nmultiplies straight through Shor's algorithm. Documenting our path\r\npublicly \u2014 what we tried, what saturated, what surprised us \u2014\r\ncontributes intellectual capital to a commons that has historically locked\r\nthis work behind paid lab pages.\r\n\r\nThis page tracks public-facing progress only. Detail logs, asm-tier safety\r\nenvelopes, & raw run artifacts stay in our lab repo.\r\n\r\n----\r\n\r\n| *Updated 2026-06-06.*\r\n| *Cross-post anchor for lumbda.com/bend & external links.*", "source_format": "rst", "revision_number": 4, "created": 1780838601768}}