I have to respect the PoC, this parallel Pollard's rho is really cool! It's a good reminder that a hash isn't a perfect barrier separating the outputs from the

I have to respect the PoC, this parallel Pollard's rho is really cool! It's a good reminder that a hash isn't a perfect barrier separating the outputs from the inputs, if the inputs are sufficiently bad! The fact that this is a valid way to do a Pollard's rho: public function iterate(string $publicKey): array { $sk = $this->uniformToBiased($publicKey); $pk = sodium_crypto_scalarmult_ristretto255_base( sodium_crypto_generichash($sk) ); return [$sk, $pk]; } ... is probably not something most people would have thought of. You don't want to solve the DLP, just a fancy birthday attack to get a collision. Lovely stuff.