OK. I think I find a way around. Assume d XOR m = a. Find k = position of the first bit (from MSB to LSB) in a. Then d + m can be in [a + 2^(k+1),a + 2^(k+2),.

OK. I think I find a way around. Assume d XOR m = a. Find k = position of the first bit (from MSB to LSB) in a. Then d + m can be in [a + 2^(k+1),a + 2^(k+2),...,a + 2^63]. We will have less than 63 cases. In each case, after we find d and m, make sure they are in range and then linear test. So in the end, we may need to run at most 63+3 = 66 N. But it still linear though.