Accelerating Pollard Rho with GPU Field Arithmetic on NVIDIA Blackwell

What it is

A preprint (Buran and Nguyen, ePrint 2026/2469) that measures how fast Pollard rho can run on current NVIDIA GPUs when its field arithmetic is rebuilt around the hardware. The benchmark is Certicom ECC2K-130, a Koblitz curve over F_{2^131} with an expected cost of 2^60.9 iterations. The algorithm is unchanged, and the paper makes no claim against the generic-group bound.

How it works

The 17.2x on one RTX PRO 6000 Blackwell (0.85 to 14.64 Giter/s) is attributed step by step across sixteen paired steps, each held to a rule written before it ran:

Three-input logic instructions handle the work around the multiply. A later build reaches 15.88 Giter/s. Measured pipe rates put the upper bound at 24-26 Giter/s for any walk with one addition per step, so about 1.5x of headroom remains on this card.

Preconditions / Affected

• The gains depend on the die. clmad issues 10-18x faster per SM-clock on data-centre parts than on the workstation part. The same change can win on one Blackwell part and lose on another, so do not assume the RTX PRO 6000 results carry over.
• The paper reports twelve GPUs from Turing to Blackwell, per card, per SM and per dollar, plus the CPU instruction sets that play the same role. That is the table to use for hardware planning.
• The Blackwell-specific path needs CUDA 13.3.

What to do

• For capacity planning against binary-field Koblitz curves of this size, use the paper's figures. The whole challenge is under five GPU-years. Five cards expect a solution within a year, and a thousand cards take about three days.
• To reproduce, use the Dockerfile in https://github.com/aburan28/rho-blackwell. The image starts the ECC2K-130 walk, and every number cites an evidence record in the repo.
• For prime-field curves, nothing here changes the threat picture. P-256 gets 1.52x (1.632 Giter/s) and P-384 gets 2.61x (0.548 Giter/s). P-256 is still about 6·10^21 card-years away.

Caveats

• A table walk's 20.08 Giter/s was measured under a cycle rule later found unsound. The exact rule runs at 8.24, so the sigma-walk figure is the one to trust.
• The 14.64 figure is the "audited campaign build". The 15.88 build is later and not described as audited.
• The walk constant is measured at 2^60.91 to 2^60.92 iterations.
• The FPGA engine on one AWS F2 reaches 8.25 Giter/s.
• The campaign walked 2^56.68 iterations, 5.4% of the expected work. It did not solve the challenge.
• The "about 230x the best published 2010 GPU kernel per card" comparison is against a 2010 kernel, so it mixes hardware generations with algorithmic gains.