We analyze a fairly standard idealization of Pollard's Rho algorithm for
finding the discrete logarithm in a cyclic group G. It is found that, with high
probability, a collision occurs in O(∣G∣log∣G∣loglog∣G∣) steps,
not far from the widely conjectured value of Θ(∣G∣). This
improves upon a recent result of Miller--Venkatesan which showed an upper bound
of O(∣G∣log3∣G∣). Our proof is based on analyzing an appropriate
nonreversible, non-lazy random walk on a discrete cycle of (odd) length |G|,
and showing that the mixing time of the corresponding walk is O(log∣G∣loglog∣G∣)