SHARK: A Realizable Special Hardware Sieving Device for Factoring 1024-Bit Integers

Frankē, Jens; Kleinjung, Thorsten; Paar, Christof; Pelzl, Jan; Priplata, Christine; Stahlke, Colin

doi:10.1007/11545262_9

Cited by 35 publications

(39 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It was used, for example, in the following factorizations: A 1024-bit RSA factorization by NFS would be considerably more difficult than the factorization of the special integer 2 1039 − 1 but has been estimated to be doable in a year of computation using standard PCs that cost roughly $1 billion or using ASICs that cost considerably less. See [43], [35], [19], [22], [44], and [29] for various estimates of the cost of NFS hardware. Current recommendations for RSA key sizes -2048 bits or even larger -are based directly on extrapolations of the speed of NFS.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

ECM on Graphics Cards

Bernstein

Chen

Cheng

et al. 2009

Advances in Cryptology - EUROCRYPT 2009

View full text Add to dashboard Cite

Abstract. This paper reports record-setting performance for the ellipticcurve method of integer factorization: for example, 926.11 curves/second for ECM stage 1 with B1 = 8192 for 280-bit integers on a single PC. The state-of-the-art GMP-ECM software handles 124.71 curves/second for ECM stage 1 with B1 = 8192 for 280-bit integers using all four cores of a 2.4 GHz Core 2 Quad Q6600.The extra speed takes advantage of extra hardware, specifically two NVIDIA GTX 295 graphics cards, using a new ECM implementation introduced in this paper. Our implementation uses Edwards curves, relies on new parallel addition formulas, and is carefully tuned for the highly parallel GPU architecture. On a single GTX 295 the implementation performs 41.88 million modular multiplications per second for a general 280-bit modulus. GMP-ECM, using all four cores of a Q6600, performs 13.03 million modular multiplications per second. This paper also reports speeds on other graphics processors: for example, 2414 280-bit elliptic-curve scalar multiplications per second on an older NVIDIA 8800 GTS (G80), again for a general 280-bit modulus. For comparison, the CHES 2008 paper "Exploiting the Power of GPUs for Asymmetric Cryptography" reported 1412 elliptic-curve scalar multiplications per second on the same graphics processor despite having fewer bits in the scalar (224 instead of 280), fewer bits in the modulus (224 instead of 280), and a special modulus (2 224 − 2 96 + 1).

show abstract

Section: Introductionmentioning

confidence: 99%

“…The SHARK design [19] for factoring 1024-bit RSA makes two suggestions for parameters of ECM -one uses it for 125-bit numbers, the other for 163-bit numbers. The SHARK designers remark that ECM could be used more intensively.…”

Section: Introductionmentioning

confidence: 99%

ECM on Graphics Cards

Bernstein

Chen

Cheng

et al. 2009

Advances in Cryptology - EUROCRYPT 2009

View full text Add to dashboard Cite

show abstract

“…[1,7,9,10]). -SHARK [3] imposes the use of an elaborate butterfly transport system, whose implementation is far from trivial. -TWIRL [16,14] seems to be the currently best-explored design.…”

Section: Introductionmentioning

confidence: 99%

Non-wafer-Scale Sieving Hardware for the NFS: Another Attempt to Cope with 1024-Bit

Geiselmann

Steinwandt

2007

Advances in Cryptology - EUROCRYPT 2007

View full text Add to dashboard Cite

Abstract. Significant progress in the design of special purpose hardware for supporting the Number Field Sieve (NFS) has been made. From a practical cryptanalytic point of view, however, none of the published proposals for coping with the sieving step is satisfying. Even for the best known designs, the technological obstacles faced for the parameters expected for a 1024-bit RSA modulus are significant. Below we present a new hardware design for implementing the sieving step. The suggested chips are of moderate size and the inter-chip communication does not seem unrealistic. According to our preliminary analysis of the 1024-bit case, we expect the new design to be about 2 to 3.5 times slower than TWIRL (a wafer-scale design). Due to the more moderate technological requirements, however, from a practical cryptanalytic point of view the new design seems to be no less attractive than TWIRL.

show abstract

“…Since the efficiency of TWIRL was not optimized, an improvement was proposed by Geiselmann et al [GJK+06], and a combination of TWIRL and YASD was discussed by Geiselmann and Steinwandt [GS07]. On the other hand, Franke et al proposed a sophisticated design SHARK by using a butterfly-sorting [FKP+05]. In order to accelerate the sieving step, FPGA implementations of the mini-factoring were discussed in [FKP+05,SPK+05,GKB+06].…”

Section: Introductionmentioning

confidence: 99%

“…On the other hand, Franke et al proposed a sophisticated design SHARK by using a butterfly-sorting [FKP+05]. In order to accelerate the sieving step, FPGA implementations of the mini-factoring were discussed in [FKP+05,SPK+05,GKB+06]. In spite of these theoretical efforts, no implementational results of the whole sieving part on ASIC or FPGA have been known up to the present.…”

Section: Introductionmentioning

confidence: 99%

CAIRN 2: An FPGA Implementation of the Sieving Step in the Number Field Sieve Method

Izu

Kogure

Shimoyama

Cryptographic Hardware and Embedded Systems - CHES 2007

View full text Add to dashboard Cite

Abstract. The hardness of the integer factorization problem assures the security of some public-key cryptosystems including RSA, and the number field sieve method (NFS), the most efficient algorithm for factoring large integers currently, is a threat for such cryptosystems. Recently, dedicated factoring devices attract much attention since it might reduce the computing cost of the number field sieve method. In this paper, we report implementational and experimental results of a dedicated sieving device "CAIRN 2" with Xilinx's FPGA which is designed to handle up to 768-bit integers. Used algorithm is based on the line sieving, however, in order to optimize the efficiency, we adapted a new implementational method (the pipelined sieving). In addition, we actually factored a 423-bit integer in about 30 days with the developed device CAIRN 2 for the sieving step and usual PCs for other steps. As far as the authors know, this is the first FPGA implementation and experiment of the sieving step in NFS.

show abstract

SHARK: A Realizable Special Hardware Sieving Device for Factoring 1024-Bit Integers

Cited by 35 publications

References 4 publications

ECM on Graphics Cards

ECM on Graphics Cards

Non-wafer-Scale Sieving Hardware for the NFS: Another Attempt to Cope with 1024-Bit

CAIRN 2: An FPGA Implementation of the Sieving Step in the Number Field Sieve Method

Contact Info

Product

Resources

About