Special Purpose Hardware for Factoring: The Linear Algebra Part. Eran Tromer and Adi Shamir Applied Math Dept The Weizmann Institute of Science SHARCS 2005. Cryptanalysis is Evil. A simple mathematical proof: The definition of throughput cost implies that cryptanalysis = time x money
Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.
Eran Tromer and Adi Shamir
Applied Math Dept
The Weizmann Institute of Science
cryptanalysis = time x money
cryptanalysis = money2
Government organizations used to dominate cryptography, but over the last 25 years they faced increasing competition from academia and industry:
Totally impractical hardware designs?
Other nonstandard models of computation?
Optimized implementations of cryptosystems?
Small improvements in constants?
Low level hardware details?
Attack hardware or hardware attacks?
Optimizing some general tools in cryptanalysis:
Cryptanalysis of block ciphers:
Promising research directions in block ciphers deal primarily with cryptanalytic countermeasures:
Stream ciphers tend to be weaker, and there are several ways to use hardware assistance in their cryptanalysis:
Hash algorithm collisions are a hot new topic:
Public key algorithms seem to be the best targets for hardware-assisted attacks:
Some of the lesser known public key schemes may be vulnerable to hardware attacks:
We now turn to our main topic, which is an we have to consider the scope of the field:efficient hardware implementation of modern factoring algorithms. This talk will deal with the linear algebra part, and will present an improved version of the hardware first proposed in:
Analysis of Bernstein’s Factorization Circuit
Arjen Lenstra, Adi Shamir, Jim Tomlinson, Eran Tromer
ASIACRYPT, December 2002
multiplication is easy
factorization is hard
100M PCs with 170GB RAM each: $5£1012
Bicycle chain sieve [D. H. Lehmer, 1928] key within 1 year were around a trillion dollars:
(This is the harder part, described in the next talk)
(This is the easier part, described here.)
To factor n:
r12 r22 (mod n)
How to find Ssuch that is a square?
Look at the factorization of smooth f1(a) which factor completely into a product of small primes:
This is a square, because all exponents are even.
How to find Ssuch that is a square?
We look for elements from the kernel of asparse matrix over GF(2). Using Wiedemann’s algorithm, this can be reduced to the following:
Σ algorithms)Matrix-by-vector multiplication
Model: two-dimensional mesh, nodes connected to ·4 neighbours.
Preprocessing: load the non-zero entries of A into the mesh, one entry per node. The entries of each column are stored in a square block of the mesh, along with a “target cell” for the corresponding vector bit.
To perform a multiplication:
If the original sparse matrix A has size DxD, we have to fold the D vector entries into a mxm mesh where m=sqrt(D).
Routing dominates cost, so the choice of algorithm (time, circuit area) is critical.
There is extensive literature about mesh routing. Examples:
None of these are ideal.
3Clockwise transposition routing on the mesh
Compared to Bernstein’s original design, this reduces the throughput cost by a constant factor
The original matrix-vector product:
Sum of some matrix rows:
V ’i+j=AjV ’i=Aj(Vi+E)=AjVi+AjE=Vi+j+AjE
and thus the difference between the correct and erroneous Vi develops as AjE from time i onwards
First error detection
No more detectableerrors