## Elliptic Curve Factorization Method: Towards Better Exploitation of Reconfigurable Hardware

### BibTeX

@MISC{Meulenaer_ellipticcurve,

author = {Giacomo De Meulenaer and François Gosset and Guerric Meurice De Dormale and Jean-jacques Quisquater},

title = {Elliptic Curve Factorization Method: Towards Better Exploitation of Reconfigurable Hardware},

year = {}

}

### OpenURL

### Abstract

Currently, the best known algorithm for factorizing modulus of the RSA public key cryptosystem is the Number Field Sieve. One of its important phases usually combines a sieving technique and a method for checking smoothness of mid-size numbers. For this factorization, the Elliptic Curve Method (ECM) is an attractive solution. As ECM is highly regular and many parallel computations are required, hardware-based platforms were shown to be more cost-effective than software solutions. The few papers dealing with implementation of ECM on FPGA are all based on bit-serial architectures. They use only general-purpose logic and low-cost FPGAs which appear as the best performance/cost solution. This work explores another approach, based on the exploitation of embedded multipliers available in modern FPGAs and the use of high-performances FPGAs. The proposed architecture – based on a fully parallel and pipelined modular multiplier circuit – exhibits a 15-fold improvement over throughput/hardware cost ratio of previously published results.

### Citations

2925 | A method for obtaining digital signatures and public-key cryptosystems
- Rivest, Shamir, et al.
- 1983
(Show Context)
Citation Context ...alities appeared such as digital signature, public key encryption, key agreement, ... For those needs, the most deployed scheme remains RSA, co-invented in 1977 by R. Rivest, A. Shamir and L. Adleman =-=[17]-=-. The security of this cryptosystem relies on the intractability of the factorization of big composite integers. This mathematical hard problem experiences therefore a renewed interest. It is believed... |

416 |
Modular multiplication without trial division
- Montgomery
- 1985
(Show Context)
Citation Context ...ECM units in a Xilinx FPGA together with an external ARM microcontroller. Each unit embeds a memory, a controller and an ALU able to perform addition/subtraction and radix-2 Montgomery multiplication =-=[12]-=-. Carry propagate adders were chosen. An improved pipelined version of this design was later used in [5]. This proof of concept was deeply improved by Gaj et al. in 2006 [4]. They removed the external... |

233 |
Factoring integers with elliptic curves
- Lenstra
- 1987
(Show Context)
Citation Context ...nt at infinity O. In this work, elliptic curves with Montgomery form in homogeneous coordinates are used. 3.2 ECM Algorithm The elliptic curve method for integer factorization was invented by Lenstra =-=[10]-=-. It is an improvement of the p − 1 method of Pollard. Its description follows [13]. The p − 1 method tries to find a prime factor p of n. The first phase of the algorithm selects an integer a and com... |

186 |
Speeding the Pollard and elliptic curve methods of factorization
- Montgomery
- 1987
(Show Context)
Citation Context ... coordinates are used. 3.2 ECM Algorithm The elliptic curve method for integer factorization was invented by Lenstra [10]. It is an improvement of the p − 1 method of Pollard. Its description follows =-=[13]-=-. The p − 1 method tries to find a prime factor p of n. The first phase of the algorithm selects an integer a and computes b ≡ ak mod n with k > 0 divisible by all prime powers below a bound B1. If p ... |

126 |
The Development of the Number Field Sieve
- Lenstra, Lenstra
- 1993
(Show Context)
Citation Context ...by Pollard in 1991. It is composed of a sieving and a matrix step, the former being the most expensive part for 1024-bit keys [6]. The reader is referred to [16] for an introduction to the NFS and to =-=[11]-=- for the details. This paper focuses on the sieving step and more precisely on the relation collection step. This task is usually performed by a combination of a sieving technique and a method for fac... |

40 | A Tale of Two Sieves - Pomerance - 1996 |

21 | Recent Progress and Prospects for Integer Factorization Algorithms, D.-Z. Du et al
- Brent
- 2000
(Show Context)
Citation Context ...is a probabilistic method for integer factorization which uses elliptic curves. It is the best known method to factorize mid-sized numbers together with the Multiple Polynomial Quadratic Sieve (MPQS) =-=[2]-=-. ECM seems to be the best choice for hardware implementation since it is highly regular, not too I/O intensive and many parallel computations are required [15]. 3.1 Elliptic Curves Let Zp be the set ... |

13 | SHARK : A realizable special hardware sieving device for factoring 1024-bit integers
- Franke, Kleinjung, et al.
- 2005
(Show Context)
Citation Context ...ing mid-size numbers [8]. While those numbers are easily factorizable, the challenge lies in the amount of computation: factorization of 1014 125-bit numbers for a 1024-bit modulus is required (using =-=[3]-=-). For this task, the Elliptic Curve Method (ECM) appears as an attractive solution. Up to now, the best successful factorization attempts were for RSA-200 (663-bit) and RSA-640, solved in 2005 by Bah... |

11 | Implementing the elliptic curve method of factoring in reconfigurable hardware - Gaj, Kwon, et al. - 2006 |

11 |
Precise bounds for Montgomery modular multiplication and some potentially insecure RSA moduli
- Walter
- 2002
(Show Context)
Citation Context ... it forces the complete propagation of the carry pipeline. To avoid this problem, a convenient solution is to work mod 2n. Provided that 4n < R, the without final subtraction version of the algorithm =-=[20]-=- ensures a bounded output (< 2n) if bounded inputs x, y < 2n are applied. This technique is used in this paper. The Montgomery multiplication works in the Montgomery domain: it computes xyR−1 mod n in... |

10 | Long modular multiplication for cryptographic applications
- Hars
- 2004
(Show Context)
Citation Context ...← A − n (A < n) return(A) In addition to the removal of the final subtraction, a modified version of the Montgomery multiplication introduced by Orup in [14] and called “Montgomery Tail Tailoring” in =-=[7]-=- is used (cf. Algorithm 6). It supposes a radix b (equal to 2 17 ) and inputs represented by their digits: i.e. n = (nd−1 · · · n1n0)b. Compared with the original algorithm of Orup, the last iteration... |

9 | Area-time efficient hardware architecture for factoring integers with the elliptic curve method
- Pelzl, Šimka, et al.
- 2005
(Show Context)
Citation Context ... migrated to ASIC using standard library and IPs for multipliers and RAMs. 2.1 Hardware Implementations The first published hardware implementation of ECM was proposed by Pelzl, ˇSimka et al. in 2005 =-=[15]-=-. The aim of this circuit was to check the smoothness of sieving reports of the SHARK device [3]. It is formed by a collection of parallel ECM units in a Xilinx FPGA together with an external ARM micr... |

8 | Scalable hardware for sparse systems of linear equations, with applications to integer factorization
- Geiselmann, Shamir, et al.
- 2005
(Show Context)
Citation Context ...m for factorizing RSA modulus is the Number Field Sieve (NFS), introduced by Pollard in 1991. It is composed of a sieving and a matrix step, the former being the most expensive part for 1024-bit keys =-=[6]-=-. The reader is referred to [16] for an introduction to the NFS and to [11] for the details. This paper focuses on the sieving step and more precisely on the relation collection step. This task is usu... |

8 | Modular exponentiation using parallel multipliers
- Tang, Tsui, et al.
(Show Context)
Citation Context ...r a parallel (fully unrolled) architecture. A good choice for an iterative architecture is a digitserial by parallel multiplier. It can be built with a pipelined row of ⌈log 2 17 n⌉ multipliers (e.g. =-=[19]-=-). For this work, it SHARCS ’07 Workshop Record 24Elliptic Curve Factorization Method: Towards Better Exploitation of Reconfigurable Hardware means a 17 × 136 multiplier is required. The computation ... |

5 |
Cofactorisation strategies for the number field sieve and an estimate for the sieving step for factoring 1024-bit integers
- Kleinjung
(Show Context)
Citation Context ...er focuses on the sieving step and more precisely on the relation collection step. This task is usually performed by a combination of a sieving technique and a method for factorizing mid-size numbers =-=[8]-=-. While those numbers are easily factorizable, the challenge lies in the amount of computation: factorization of 1014 125-bit numbers for a 1024-bit modulus is required (using [3]). For this task, the... |

2 |
A Simpler Sieving Device
- Geiselmann, Januszewski, et al.
- 2006
(Show Context)
Citation Context ... are the TWINKEL device, mesh-based sieving, TWIRL and SHARCS (see [18] for an overview and references). ECM is one of the building block of SHARCS [3] and it was proposed to combine it with TWIRL in =-=[5]-=-. For the design of a hardware machine a platform has first to be chosen. The two main possibilities are ASICs (application-specific integrated circuits) or FPGAs (field programmable gate arrays). Whi... |

2 |
Simplifying Quotient Determination
- Orup
- 1995
(Show Context)
Citation Context ... + xi · y + ui · n)/b (A < 2n) if A ≥ n then A ← A − n (A < n) return(A) In addition to the removal of the final subtraction, a modified version of the Montgomery multiplication introduced by Orup in =-=[14]-=- and called “Montgomery Tail Tailoring” in [7] is used (cf. Algorithm 6). It supposes a radix b (equal to 2 17 ) and inputs represented by their digits: i.e. n = (nd−1 · · · n1n0)b. Compared with the ... |

2 |
on Special Purpose Hardware for Attacking Cryptographic Systems
- SHARCS’05
- 2005
(Show Context)
Citation Context ...pose hardware came out to lower the cost of both machine and power consumption. Such proposals in the context of the NFS sieving step are the TWINKEL device, mesh-based sieving, TWIRL and SHARCS (see =-=[18]-=- for an overview and references). ECM is one of the building block of SHARCS [3] and it was proposed to combine it with TWIRL in [5]. For the design of a hardware machine a platform has first to be ch... |

1 |
Breaking Ciphers with COPACOBANA - A
- Kumar, Paar, et al.
- 2006
(Show Context)
Citation Context ... same computations (135-bit inputs) – with about 1148 phases 1 and 1075 phases 2 per second – give an overall cost of roughly $25.8 M. To provide a more realistic cost estimate, the COPACOBANA engine =-=[9]-=- could be used. It embeds 120 low-cost Spartan3-1000 FPGAs and cost $10k. It was estimated that such an engine could be fitted with 60 Virtex4SX25FF66810 with an amount of $9.5k, including a power sup... |