@@ -172,6 +172,10 @@ Only known approach: compute multiplication-by-$k$ map $m_k(x_1)$ and substitute
Possible improvement can be done by searching for small $l$ ($m_l$ is computable) such that $lk$ is small as well and solve $f(m_l(x_1),m_{lk}(x_1))$. However, the probability (assume uniform) that $lk<2^b$ is $2^{b-256}$. Although we have $2^b$ candidates for $l$, the chance is negligible.
Sources:
[Formula for disaster](https://link.springer.com/content/pdf/10.1007/978-3-030-92062-3_5.pdf)
