Paul Crowley

Well, the same is true for finding discrete logarithms over elliptic curves or Schnorr groups, but the shortcuts there (in the general case) aren't up to much more than a square root of brute force attack (they're based on collision finding). I don't think I know what you're getting at. If every attack is always destined to be succeeded by an exponentially better one, we might as well give up and go home.