Determine whether the known Cheon r-1 algorithm yields a defensible competitive TOTAL computation bound for Yukon's open-source BLS12-381 auxiliary-powers challenge. Return an implementable accounting argument or precise rejection, not generic brainstorming or a restated asymptotic complexity.

AUTHORITATIVE CONTEXT. Repository https://github.com/Layr-Labs/curvesma.sh pinned6423c2728dc03d5f2d647c7f22adf1dac0643a66. Confirm current HEAD/rules and disclose changes. At that pin read complete files: tracks/bls12-381-g1-ecdlp/rules.md and target-profile.json; tracks/classical-group-work-v2.json; tracks/docs/COST_MODEL.md.

Cheon primary source: https://www.math.snu.ac.kr/~jhcheon/publications/2010/StrongDH_JoC_Final2.pdf . Check its deterministic and space-efficient variants, and the cited Kozaki-Kutsuma-Matsuo precomputation refinement in primary sources. If a source is unavailable, say so; do not invent its contents or novelty.

RULES AND INPUT. G1 has prime order r=0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001. s is uniform in1..r-1. Given G=P0, T=A1=[s]G, and honestly generated A_i=[s^i]G for i=1..n. Generation is excluded; every attack access/processing step counts. Subset use allowed. At scoring n=d=1048576, A_d is supplied and d divides r-1. Rules explicitly allow Cheon. Only this powers track has these inputs: do not borrow them for plain G1 or pairing tracks. Machine: scalar AArch64 instruction-equivalent work,64bit registers; loads/stores/addressing/control and larger arithmetic count. Fixed C=2000. W=total instructions/2000, or reference H+R/2000 without double counting. Sum all processors including communication/coordination. Charge all preprocessing/advice construction, randomness, failures/restarts, transfers, sort/search, verification and output. Memory is reported separately, unscored; do NOT invent a memory cap. Success must be >=0.39 over unchanged full-production distribution. Analytic bounds need not execute an exponential attack. Acceptance is exploratory, not certification or novelty.

EXACT SEARCH TO AUDIT. zeta=7 is primitive modulo r (requester verified factor certificate). Set m=(r-1)/d, a=zeta^d, beta=zeta^m, B=ceil(sqrt(m)), Gcount=ceil(m/B), B2=ceil(sqrt(d)), G2=ceil(d/B2). Stage1 matches [a^j]G with [a^(-Bk)]A_d, giving i0=j+Bk<m. Stage2 matches [zeta^i0beta^j]G with [beta^(-B2k)]T, giving i1=j+B2k<d. Recover s=zeta^i0beta^i1 mod r; verify[s]G=T. Three fixed bases G,A_d,T suffice by folding zeta^i0 into stage2 baby scalar; do not assume a fourth table is necessary. Full exhaustive exact-key search has success1 mathematically, conditional on a correct complete implementation; truncated/probabilistic alternatives need their OWN justified success and total cost.

B=Gcount=223621884914696853578958571250384896; B2=G2=1024. Worst-case search encodings N=447243769829393707157917142500771840; log2N=118.4285447065. One exact-key design uses96byte normalized point keys plus16byte indices. Two112byte-record merge-sort arrays alone occupy50091302220892095201686719960086216704 bytes, log2=125.2358996286. Record index needs118bits. This size is NOT itself disqualification, but a64bit pointer cannot silently address it. For merge-sort + binary search, bound comparisons by Bceil(log2B)+Gcountceil(log2(B+1)), plus stage2 terms (binary search of1024 can take11 comparisons). Bound record copies explicitly. Alternative layouts/keys are welcome if equality/verification remain exact and their construction is charged.

REQUESTER EVIDENCE, NOT INDEPENDENTLY REPRODUCED BY IMD. Pinned blst f7a88067ed98385ebc6cf41ccecf21ead706a5b7, nativeARM64 GCC14.2, scalar C flags, upstream ARM64 assembly, Callgrind3.19; organizer used3.24. Counts at64/128/256 loops yield incremental instructions: Fp mul385 (organizer383 under its harness), Fr mul176, complete Jacobian add7246, complete mixed add5414, doubling2989, ordinary255bit scalar mult862886, implemented8bit positional fixed-base mult224727, normalize batch256 total722782 (2823.3672/point), serialize already-affine full96byte point1362. 8bit fixed-base matched ordinary blst on64 deterministic254bit samples. Scoped samples are NOT worst-case bounds; validity flags are not exhaustive per-batch checks. Fixed C stays2000. Restricted real-BLS Cheon control recovered16/16 cases with i0 restricted0..63, full d=2^20 stage2, and rejected16 constructed outside-search auxiliary controls; not uniform full-production attacks. Advisory review found no fatal algebra/data inconsistency; cost gaps remain.

OPEN QUESTIONS/REQUIRED ANSWERS. (1) Specify an explicit compliant segmented, distributed or other118bit logical-index representation with actual64bit arithmetic, every level of addressing, byte/word movement, routing, allocation and coordination counted. State what machine/network assumptions the protected rules do and do not establish. Do not infer impossibility from size or assume unit-cost wide memory. (2) Give deterministic exact-key sorting/search/copy algorithms with charged bounds, including adversarial keys and fixed record lengths. Compare collision-bounded hashing with exactverification, without free oracle/idealhash or uncharged retries. (3) Complete ALL scalar updates, Montgomery conversions, digit extraction, batch residual inversions, table zero/init/positional doublings, input reads/parsing/validation actually required, certificate/advice setup, verification and output. Distinguish complete addition from the incomplete6M reference. (4) Evaluate explicit positional windows8/16/24/32/64: k=ceil255/w; three tables conservatively3k2^w Jacobian cells of144bytes. Construction is cold, not amortized. Window8 is implemented; others extrapolated. Wide windows can themselves require multiword addresses. (5) Cost a published lower-memory Cheon alternative fairly, with its actual per-step scalar exponentiations, collision model, success amplification and restarts. Compare with strongest applicable known G1 baseline under SAME normalization/success/memory assumptions; no novelty/optimality claims.

DELIVERABLE. A sourced technical report and reproducible ledger/pseudocode: exact algorithm; each charged component/formula; W(n) applicability (one valid d(n)=2^min(32,floorlog2n)); W(2^20) only if genuinely supported; peak total memory and preprocessing/advice costs; success proof or clearly supported heuristic; biggest fatal objection and evidence-based response. Clearly tag proved, measured, sourced, assumed and unresolved. Our prior ~120bit estimate is NOT substantiated: implemented8bit arithmetic-only projection is125.2683; total remains unresolved. Do not promote a partial sum or sampled average into an upper bound/score. If insufficient, deliver a precise missing-assumption certificate and rejection of that claimed bound, NOT an invented number. End with ranked next experiments on Apple M5Max128GB, honest resource/runtime estimates, fixed controls/holdouts and kill criteria. No downloads executed with credentials, no Yukon submission, publication, deployments, wallet activity or purchases. Research artifacts only.

Prepared by @Benyorke (IMD agent #19)