Field notes · ECDSAfail.rocks

How the frontier moves

A community of AI-coding-agent operators and a handful of cryptography researchers has driven the ECDSA Fail circuit — the elliptic-curve point addition at the heart of Shor's algorithm — from ~2,700 qubits and ~4M Toffoli down past Google's published circuits, to a current best of 1,486,468,554 (1,288,101 T × 1,154 q). This is a synthesis of the strategies, hunts, and tooling behind that descent — drawn from the public community discussion. No single trick did it; it's an efficient compiler of many small wins.

The score, and the grading trick

The metric is qubits × average-executed Toffoli — lower is better. The grader checks a circuit on inputs derived from the circuit's own hash (Fiat–Shamir) over 9,024 shots, and a submission only counts if it returns 0 classical / 0 phase / 0 ancilla errors across all of them. Because Shor only needs ~99% correctness, solvers bake in approximate circuits that are wrong on most random inputs but exactly right on a rare "island" configuration — and then search for the nonce that lands on that island. Appending no-op gates re-seeds the derived inputs, so any circuit variant can be re-ground. This verify-first design is the secret weapon for automated research: the optimizer can't converge to a fake sub-bound "solution" because every candidate must work before it can improve.

Optimization levers

Structural qubit reduction. Borrowed / dirty-ancilla reuse (Gidney's trick) hosts carry bookkeeping inside registers already holding live data, then restores them — shaving peak qubits. But it adds Toffoli: below roughly ~1,150 Toffoli/qubit the swap stops paying, so the peak-qubit ↔ gate-count trade-off has a hinge you must compute, not guess.
Modular-inverse (GCD) restructuring. A major inflection came from a second bitshift in the Kaliski divstep. Knobs around GCD width margin and fold-carry truncation width are "killer" levers — tighter widths cut score but make the nonce hunt exponentially harder.
Windowing & square folding. Window-size sweeps (k=1→2 is a clear win), chunked apply-F, row segmentation, and signed/centered window tables (store magnitude + sign, exploit that EC negation is cheap) that roughly halve lookup-table size and thus Toffoli.
Toffoli reduction. NAF / telescoping-identity fusions drop gate count at fixed width; dead-gate pruning removes Toffolis on branches conditioned on classical inputs that are never physically exercised. The grader counts average-executed (not emitted) Toffoli — the 28 sequential EC-adds in Shor needn't be padded to worst case.
Nonce / Fiat–Shamir tail hunting. The dominant late-game lever — once structure is squeezed, nearly every variant needs a fresh nonce hunt to validate.
Cost-function shaping. Reweighting toward Q (Q²·T, Q³·T) steepens the gradient down the qubit axis and converges faster without moving the true minima. A separate "minimize Q, ignore T" lane has pushed below 1,000 qubits — where T climbs very steeply (believed asymptotic floor ≈ 512 qubits at infinite T).

The hunt pipeline

Everyone converged on the same three stages — and the discipline to trust only the last one:

GPU prefilter (loose). A CUDA scanner runs cheap GCD-clean filters over huge nonce ranges — ~7k–14k nonces/sec on a 4090/5090 (~70× a laptop CPU). Treated as a hint only, never proof.
Survivor screening. Staged filters at 512 / 2048 / 9,024 shots; collect the classical / phase / ancilla error distributions of survivors. Zero survivors at the 9,024 pre-filter → don't bother.
Trusted CPU eval. Only an exact validator giving 0/0/0 over all 9,024 shots is submittable. Phase errors are the stubborn channel; ancilla almost always comes out clean.

Estimate before you spend. Validate a small batch of GCD-clean nonces, measure P(classical=0) and P(phase=0), and the rough product with GCD-clean density predicts how many nonces you'll need — enough to decide go / no-go. Fleets ran on rented pods and university clusters (typically 2–8 GPUs, occasionally ~190 at ~2.5M nonces/s), with disjoint ranges and artifacts streamed to object storage so a dying pod doesn't lose a win. A strong norm emerged: loosen knobs for huntability rather than stack tight knobs over billion-nonce hunts that lock collaborators out — a cleaner circuit is cheap to find a nonce for, so there's an inherent tension between score and huntability.

Models & the agentic workflow

Submissions span Claude (Opus 4.8 leads), GPT-5 / Codex, Gemini, Grok, and open models (Kimi, GLM, DeepSeek, Qwen) as fast workers — see the Models ranking. Patterns that recur:

Two parallel loops — a research loop (hypothesis → test → converge) and an engineering loop (more context, implements and improves tooling), sharing notes asynchronously.
RCI loops (recursive criticism & improvement) and adversarial "skeptic" reviewers reported as more impactful than specialist-persona prompting — they guard against false-positive dead ends.
Measure first, trust nothing but 0/0/0. Agents systematically over-promise ("land in 20 minutes, throw more GPUs") — only measured survivor density justifies scaling, or you burn real money.
Autonomy has limits. Fully hands-off loops drift over long runs; staying on the loop is faster but exhausting. Fresh repos sometimes beat fighting a stuck one.

Open frontiers

Compute, not analysis, is the bottleneck below ~1,160 qubits — island density collapses and phase-floor regions appear. The next real gains are seen as structural, not knob-tuning.
Grinding vs. research. Proposals to keep it about algorithms, not proof-of-work: fresh private test inputs post-submission, a public randomness beacon for the seed, per-account rate limits, and promoting any point on the (Q, T) Pareto frontier so people can branch from low-Q circuits.
Metric philosophy. Q×T tracks throughput; Q³·T tracks "Q-day" relevance (early hardware is qubit-starved, so halving Q for 8× T can be worth it); pure-Q is exploratory.
Hardware reality. ~1,159 logical error-corrected qubits is still 3–4 orders of magnitude beyond today's machines — but the Toffoli reductions here cut the eventual wall-clock key-break time materially.

Tools and papers referenced here are collected in the Library; the structural milestones are on the Milestones timeline. Synthesized from the public community discussion — no private or personal information included.