Draw at random from a space of N things and the first repeat arrives after about √N draws, not N — a coincidence that lands quadratically sooner than anyone guesses. This portal walks three checked layers that are the same √N read three ways: 23 people share a birthday (you meet it as luck), a hash needs 256 bits to keep only 128 bits of collision safety (you build against it), and Pollard’s method pulls a factor from a number in ~N^(1/4) steps (you weaponise it). The claim none states alone: the last two are one algorithm — a tortoise-and-hare collision search — aimed at two different spaces, and the birthday problem is that same search with the hunt removed. Two constants, kept honest: √(2 ln 2)·√N ≈ 1.177√N for "more likely than not" (the 23), √(π/2)·√N ≈ 1.253√N for the average wait (the hash bound, the rho length). Every operable number recomputes offline (verify.mjs).
Ask someone how many random draws it takes, from a bag of N equally likely tokens, before two come up the same. Almost everyone answers something near N — half of it, most of it. The true answer is about √N. The collision arrives quadratically sooner than the intuition, and that single fact — met once as a coincidence, once as a wall, once as a weapon — is the whole of this portal.
Pick a space. Draw from it at random, one token at a time, until a token repeats. Watch where the first repeat lands — and how little the answer cares which space you chose, once you measure it in units of √N.
Whatever the space, the first collision lands near √N — never near N. Two prefactors, and the portal keeps them apart because they answer different questions: the point where a collision becomes more likely than not is √(2 ln 2)·√N ≈ 1.177·√N; the average number of draws you wait is √(π/2)·√N ≈ 1.253·√N. Both are √N; neither is N. Below, the same number is met three times.
The space is the 365 days of a year. You are not searching for anything; you just let people walk into a room and watch a shared birthday appear far sooner than feels possible.
At 23 people the chance of some shared birthday is already 50.7% — the median crossing sits at √(2 ln 2·365) ≈ 22.5, realised at 23. The trap is that people answer a different question — “does someone share my birthday?” — whose curve needs 253. And 253 is exactly the number of pairs among 23 people (23·22/2): the same number, once as people, once as the pairs a collision can use. (All three curves verified in Twenty-Three People.)
Now the space is a hash's outputs, and someone is hunting a collision — two inputs with the same digest is a forgery. The defence is to make the space so large that even √N is out of reach. Truncate a real SHA-256 to b bits and watch the birthday bound bite.
The collision arrives near 1.253·√(2ᵇ) inputs — the birthday bound — not 2ᵇ. That is why security is half the bits: a 256-bit hash has its collision wall at 2¹²⁸ = √(2²⁵⁶), exactly the square root of the output space. Double the output bits and you buy only half of them as safety. (The from-scratch SHA-256 and its avalanche are pinned to the FIPS vectors in Half the Bits, Every Time.)
Here the collision is the prize. To factor you walk a silly loop — square, add one, take the remainder — and take the gcd of two walkers' gap with the number. The gcd sits at 1, then leaps to a factor. It is fast because of a birthday hiding in plain sight.
The walk mod would take about √N ≈ 10⁶ steps to close. But it is secretly a walk mod the hidden prime p, and that walk collides after only √p ≈ 1000 steps — the birthday bound on p's residues. The gcd catches that early collision and hands you the factor. Factoring cost is √p ≈ N^(1/4). (The ρ shape, the two forbidden c values, and the √(π/2) constant — which this member itself calls “the birthday constant” — are in The Shape of the Rho.)
Line them up and the same square root is doing all the work — you only change your relationship to the collision:
The deepest seam none of the three states alone: defending a hash and factoring a number run the same search. Both iterate a pseudorandom map and hunt a collision with a tortoise and a hare — one walker stepping once, one twice — which finds the repeat in ~√N steps and, crucially, no stored table. That memoryless collision-finder is the letter ρ; it is what makes a birthday attack practical and what makes Pollard's method fast. Point it at a hash's outputs and you forge; point it at the residues mod a secret prime and you factor.
One honest footnote, kept in view: a naïve birthday attack that stores every hash it sees needs ~√N memory as well as ~√N time. Pollard's cycle-detection ρ (Floyd, later Brent, later van Oorschot–Wiener in parallel) is exactly the trick that drops the memory to almost nothing while keeping the √N time. The shared fact across all three is the time, √N; the ρ is what the two active cases additionally share to make that time cheap to spend.
This portal reuses three layers already on the ground; it invents no new probability, cryptography, or number theory. Its claim is the reading — that one √N is a coincidence, a wall, and a weapon, and that the wall and the weapon are one algorithm. Every operable number recomputes offline:
node research/the-square-root-of-a-coincidence/verify.mjs → a seeded Monte-Carlo confirms the first collision lands at √(π/2)·√N (mean) and √(2 ln 2)·√N (median) across three spaces; the birthday landmarks match the member's own curve.json; a truncated SHA-256 (via node:crypto) collides on the birthday schedule and 2¹²⁸=√(2²⁵⁶) exactly; the imported Pollard engine factors the worked semiprime with the hidden mod-p rho closing ≥100× sooner; and one generic tortoise-and-hare driver finds a real 24-bit hash collision memoryless and traces the mod-p walk — the two weapons, demonstrably one algorithm. 49/49.