Breaking Ciphers with COPACOBANA –A Cost-Optimized Parallel Code Breaker

Abstract

Abstract. Cryptanalysis of symmetric and asymmetric ciphers is computationally extremely demanding. Since the security parameters (in particular the key length) of almost all practical crypto algorithms are chosen such that attacks with conventional computers are computationally infeasible, the only promising way to tackle existing ciphers (assuming no mathematical breakthrough) is to build special-purpose hardware. Dedicating those machines to the task of cryptanalysis holds the promise of a dramatically improved cost-performance ratio so that breaking of commercial ciphers comes within reach.This contribution presents the design and realization of the COPA-COBANA (Cost-Optimized Parallel Code Breaker) machine, which is optimized for running cryptanalytical algorithms and can be realized for less than US$ 10,000. It will be shown that, depending on the actual algorithm, the architecture can outperform conventional computers by several orders in magnitude. COPACOBANA hosts 120 low-cost FPGAs and is able to, e.g., perform an exhaustive key search of the Data Encryption Standard (DES) in less than nine days on average. As a real-world application, our architecture can be used to attack machine readable travel documents (ePass). COPACOBANA is intended, but not necessarily restricted to solving problems related to cryptanalysis.The hardware architecture is suitable for computational problems which are parallelizable and have low communication requirements. The hardware can be used, e.g., to attack elliptic curve cryptosystems and to factor numbers. Even though breaking full-size RSA (1024 bit or more) or elliptic curves (ECC with 160 bit or more) is out of reach with COPA-COBANA, it can be used to analyze cryptosystems with a (deliberately chosen) small bitlength to provide reliable security estimates of RSA and ECC by extrapolation 1 .

Experiments on the Multiple Linear Cryptanalysis of Reduced Round Serpent

“…Open questions include the optimal exploitation of multiple approximations using algorithm 2 when good estimations of the bias values are not available or the extension of these experiments towards more cipher rounds, e.g. using [9].…”

Sparse Boolean equations and circuit lattices

“…Common approaches to the key search [2,6,7,13,14,17,22] are based on the parallelization of the job to many special purpose chips, which efficiently implement the encryption. The best reported speed for one DES encryption with COPACOBANA is about 0.1 GHz per chip, [13].…”

“…The best reported speed for one DES encryption with COPACOBANA is about 0.1 GHz per chip, [13]. Approximately the same speed per each of its SPU is achieved by Cell Processor, see [14].…”

Collision Search for Elliptic Curve Discrete Logarithm over GF(2 m ) with FPGA

“…Chris Monico's challenge results for GF(2 109 ) will therefore be used for further comparisons. For the hardware cost assessment on FPGA, the COPACOBANA engine [17] was chosen. It embeds 120 low-cost Spartan3-1000 FPGAs.…”

“…As a result, its flexibility and performance over cost (for low volume) makes FPGAs an attractive solution. In particular, the FPGA-based COPACOBANA engine [17] was used for the cost assessment of this work.…”