Implementing the Elliptic Curve Method of Factoring in Reconfigurable Hardware

Abstract

A novel portable hardware architecture of the Elliptic Curve Method of factoring, designed and optimized for application in the relation collection step of the Number Field Sieve, is described and analyzed. A comparison with an earlier proof-of-concept design by Pelzl, Simka, et al. has been performed, and a substantial improvement has been demonstrated in terms of both the execution time and the area-time product. The ECM architecture has been ported across five different families of FPGA devices in order to select the family with the best performance to cost ratio. A timing comparison with the highly optimized software implementation, GMP-ECM, has been performed. Our results indicate that low-cost families of FPGAs, such as Spartan-3 and Spartan-3E, offer at least an order of magnitude improvement over the same generation of microprocessors in terms of the performance to cost ratio.

Cofactorization on Graphics Processing Units

“…Related work on stage 1 of ECM for cofactoring on constrained devices can be found in [53,45,17,14,19,32,58,7,5,10]. Unlike these publications, the GPU-implementation presented here includes stage 2 of ECM, as it significantly improves the performance of ECM.…”

“…Most previous work in this direction focussed on offloading the elliptic curve integer factoring (ECM, [31]), which is only part of this follow-up stage. For graphics processing units (GPUs) this is considered in [7,5,10] and for reconfigurable hardware such as field-programmable gate arrays in [53,45,17,14,19,32,58]. To allow the CPUs to keep sieving, thus optimally using their memory, in this paper the possibility is explored to offload the entire follow-up stage to GPUs.…”

ECM on Graphics Cards

“…As a proof of concept Pelzl et al present in [40] an FPGA-based implementation of ECM for numbers up to 200 bits and state "We show that massive parallel and cost-efficient ECM hardware engines can improve the areatime product of the RSA moduli factorization via the GNFS considerably." Gaj et al [20] consider the same task and improve upon their results.…”

CAIRN 2: An FPGA Implementation of the Sieving Step in the Number Field Sieve Method

“…The core sieving speed of the developed device is comparable to the lattice sieving software implementation. As far as the authors know, this is the first FPGA implementation and experiment of the sieving step (while implementational results of the minifactoring and the linear algebra step have been reported [GKB+06,BMGG04]). …”

“…On the other hand, Franke et al proposed a sophisticated design SHARK by using a butterfly-sorting [FKP+05]. In order to accelerate the sieving step, FPGA implementations of the mini-factoring were discussed in [FKP+05,SPK+05,GKB+06]. In spite of these theoretical efforts, no implementational results of the whole sieving part on ASIC or FPGA have been known up to the present.…”