Hardware Factorization Based on Elliptic Curve Method

Abstract

The security of the most popular asymmetric cryptographic scheme RSA depends on the hardness of factoring large numbers. The best known method for factorization large integers is the General Number Field Sieve (GNFS). Recently, architectures for special purpose hardware for the GNFS have been proposed [5,12]. One important step within the GNFS is the factorization of mid-size numbers for smoothness testing, an efficient algorithm for which is the Elliptic Curve Method (ECM). Since the smoothness testing is also suitable for parallelization, it is promising to improve ECM via special-purpose hardware. We show that massive parallel and cost efficient ECM hardware engines can improve the cost-time product of the RSA moduli factorization via the GNFS considerably. The computation of ECM is a classical example for an algorithm that can be significantly accelerated through special-purpose hardware. In this work, we present an efficient hardware implementation of ECM to factor numbers up to 200 bits, which is also scalable to other bit lengths. For proof-ofconcept purposes, ECM is realized as a softwarehardware co-design on an FPGA and an embedded microcontroller. This appears to be the first pub-lication of a realized hardware implementation of ECM, and the first description of GNFS acceleration through hardware-based ECM.

Cofactorization on Graphics Processing Units

“…Related work on stage 1 of ECM for cofactoring on constrained devices can be found in [53,45,17,14,19,32,58,7,5,10]. Unlike these publications, the GPU-implementation presented here includes stage 2 of ECM, as it significantly improves the performance of ECM.…”

“…Most previous work in this direction focussed on offloading the elliptic curve integer factoring (ECM, [31]), which is only part of this follow-up stage. For graphics processing units (GPUs) this is considered in [7,5,10] and for reconfigurable hardware such as field-programmable gate arrays in [53,45,17,14,19,32,58]. To allow the CPUs to keep sieving, thus optimally using their memory, in this paper the possibility is explored to offload the entire follow-up stage to GPUs.…”

Implementing the Elliptic Curve Method of Factoring in Reconfigurable Hardware

“…We describe in detail how to optimize the design and compare our work both to an existing hardware implementation [16,18] and a software implementation (GMP-ECM) [7,15].…”

“…Instead, one usually determines B 1 first (which is more or less close to e √ 1 2 log q log log q ) and set B 2 between 50B 1 and 100B 1 depending on the computational resources for Phase 2. For example, Simka et al [18] …”

ECM on Graphics Cards

“…It was used, for example, in the following factorizations: A 1024-bit RSA factorization by NFS would be considerably more difficult than the factorization of the special integer 2 1039 − 1 but has been estimated to be doable in a year of computation using standard PCs that cost roughly $1 billion or using ASICs that cost considerably less. See [43], [35], [19], [22], [44], and [29] for various estimates of the cost of NFS hardware. Current recommendations for RSA key sizes -2048 bits or even larger -are based directly on extrapolations of the speed of NFS.…”