introduction
play

Introduction The MP Problem Solving a system of m multivariate - PowerPoint PPT Presentation

Fast Exhaustive Search for Quadratic Systems in F 2 on FPGAs Charles Bouillaguet, Chen-Mou Cheng, Tung Chou, Ruben Niederhagen, Bo- Yin Yang August 15, 2013 Introduction The MP Problem Solving a system of m multivariate polynomial equations in


  1. Fast Exhaustive Search for Quadratic Systems in F 2 on FPGAs Charles Bouillaguet, Chen-Mou Cheng, Tung Chou, Ruben Niederhagen, Bo- Yin Yang August 15, 2013

  2. Introduction The MP Problem Solving a system of m multivariate polynomial equations in n variables over F q is called the MP problem . The MP problem is an NP-hard problem even for multivariate quadratic systems and q ✏ 2. Introduction August 15, 2013 1 / 13

  3. ➓ ➓ ➓ Introduction Multivariate Public-Key Cryptography: e.g. HFE, SFLASH, and QUARTZ Provably-Secure Stream Ciphers: e.g. QUAD Introduction August 15, 2013 2 / 13

  4. Introduction Multivariate Public-Key Cryptography: e.g. HFE, SFLASH, and QUARTZ Provably-Secure Stream Ciphers: e.g. QUAD Algebraic Cryptanalysis: Obtain a system of multivariate polynomial equations with the secret among the variables. ➓ Naturally breaks the above, ➓ does not break AES as first advertised, ➓ but does break, e.g., KeeLoq. Complexity? Introduction August 15, 2013 2 / 13

  5. Introduction Most Efficient Algorithm for F 2 : Brute-force search, testing all 2 n possible inputs. Previous Work: On GPUs we can solve a quadratic system of 48+ equations in 48 variables in 21min . Introduction August 15, 2013 3 / 13

  6. Introduction Most Efficient Algorithm for F 2 : Brute-force search, testing all 2 n possible inputs. Previous Work: On GPUs we can solve a quadratic system of 48+ equations in 48 variables in 21min . Research Question: How would specifically designed hardware perform on this task? We approach the answer by solving multivariate quadratic systems on reconfigurable hardware ( FPGAs ). Introduction August 15, 2013 3 / 13

  7. ➓ ➓ ➓ ♣ q ➓ ♣ q ➓ Gray-Code Approach Full-Evaluation Approach ➓ Evaluate the whole equation for each possible input. ➓ Time Complexity: O ♣ 2 n n 2 q ➓ Memory Complexity: O ♣ n q Exhaustive Search August 15, 2013 4 / 13

  8. Gray-Code Approach Full-Evaluation Approach ➓ Evaluate the whole equation for each possible input. ➓ Time Complexity: O ♣ 2 n n 2 q ➓ Memory Complexity: O ♣ n q Gray-Code Approach ➓ Only re-compute those parts of the equation that have changed. ➓ Enumerate input vector in Gray-code order. ➓ Update solution using the derivatives of the involved variables. ➓ Time Complexity: O ♣ 2 n m q ➓ Memory Complexity: O ♣ n 2 m q Trade computation for memory. Exhaustive Search August 15, 2013 4 / 13

  9. ✏ ✏ ✏ ✏ ✏ ✏ ✏ � � � � � � ✏ ☎ � ☎ � ☎ � � � � Gray-Code Approach k ✏ 01010 b ; x 4 ✏ 0 , x 3 ✏ 1 , x 2 ✏ 0 , x 1 ✏ 1 , x 0 ✏ 0 f ✏ x 4 x 2 � x 3 x 0 � x 2 x 1 � x 3 � x 1 � x 0 � 1 f ✏ 0 ☎ 0 � 1 ☎ 0 � 0 ☎ 1 � � � � 1 1 1 0 Exhaustive Search August 15, 2013 5 / 13

  10. Gray-Code Approach k ✏ 01010 b ; x 4 ✏ 0 , x 3 ✏ 1 , x 2 ✏ 0 , x 1 ✏ 1 , x 0 ✏ 0 f ✏ x 4 x 2 � x 3 x 0 � x 2 x 1 � x 3 � x 1 � x 0 � 1 f ✏ 0 ☎ 0 � 1 ☎ 0 � 0 ☎ 1 � � � � 1 1 1 0 k ✏ 01011 b ; x 4 ✏ 0 , x 3 ✏ 1 , x 2 ✏ 0 , x 1 ✏ 1 , x 0 ✏ 1 f ✏ x 4 x 2 � x 3 x 0 � x 2 x 1 � x 3 � x 1 � x 0 � 1 f ✏ 0 ☎ 0 � 1 ☎ 1 � 0 ☎ 1 � � � � 1 1 1 1 Exhaustive Search August 15, 2013 5 / 13

  11. Gray-Code Approach k ✏ 01010 b ; x 4 ✏ 0 , x 3 ✏ 1 , x 2 ✏ 0 , x 1 ✏ 1 , x 0 ✏ 0 f ✏ x 4 x 2 � x 3 x 0 � x 2 x 1 � x 3 � x 1 � x 0 � 1 f ✏ 0 ☎ 0 � 1 ☎ 0 � 0 ☎ 1 � � � � 1 1 1 0 k ✏ 01011 b ; x 4 ✏ 0 , x 3 ✏ 1 , x 2 ✏ 0 , x 1 ✏ 1 , x 0 ✏ 1 f ✏ x 4 x 2 � x 3 x 0 � x 2 x 1 � x 3 � x 1 � x 0 � 1 f ✏ 0 ☎ 0 � 1 ☎ 1 � 0 ☎ 1 � � � � 1 1 1 1 k ✏ 01100 b ; x 4 ✏ 0 , x 3 ✏ 1 , x 2 ✏ 1 , x 1 ✏ 0 , x 0 ✏ 0 f ✏ x 4 x 2 � x 3 x 0 � x 2 x 1 � x 3 � x 1 � x 0 � 1 f ✏ 0 ☎ 1 � 1 ☎ 0 � 1 ☎ 0 � � � � 1 1 0 0 Exhaustive Search August 15, 2013 5 / 13

  12. ✏ ♣ q ✁ ☎ ✁ � ☎ � ❇ ✏ ♣ q � ♣ q ❇ Gray-Code Approach k ✏ 01010 b ; x 4 ✏ 0 , x 3 ✏ 1 , x 2 ✏ 0 , x 1 ✏ 1 , x 0 ✏ 0 f ✏ x 4 x 2 � x 3 x 0 � x 2 x 1 � x 3 � x 1 � x 0 � 1 f ✏ 0 ☎ 0 � 1 ☎ 0 � 0 ☎ 1 � � � � 1 1 1 0 k ✏ 01011 b ; x 4 ✏ 0 , x 3 ✏ 1 , x 2 ✏ 0 , x 1 ✏ 1 , x 0 ✏ 1 f ✏ x 4 x 2 � x 3 x 0 � x 2 x 1 � x 3 � x 1 � x 0 � 1 f ✏ 0 ☎ 0 � 1 ☎ 1 � 0 ☎ 1 � � � � 1 1 1 1 k ✏ 01001 b in Gray-code order f ✏ x 4 x 2 � x 3 x 0 � x 2 x 1 � � x 1 � x 0 � 1 x 3 f ✏ 0 ☎ 0 � 1 ☎ 1 � 0 ☎ 0 � � � � 1 1 0 1 Exhaustive Search August 15, 2013 5 / 13

  13. ❇ ✏ ♣ q � ♣ q ❇ Gray-Code Approach k ✏ 01010 b ; x 4 ✏ 0 , x 3 ✏ 1 , x 2 ✏ 0 , x 1 ✏ 1 , x 0 ✏ 0 f ✏ x 4 x 2 � x 3 x 0 � x 2 x 1 � x 3 � x 1 � x 0 � 1 f ✏ 0 ☎ 0 � 1 ☎ 0 � 0 ☎ 1 � � � � 1 1 1 0 k ✏ 01011 b ; x 4 ✏ 0 , x 3 ✏ 1 , x 2 ✏ 0 , x 1 ✏ 1 , x 0 ✏ 1 f ✏ x 4 x 2 � x 3 x 0 � x 2 x 1 � x 3 � x 1 � x 0 � 1 f ✏ 0 ☎ 0 � 1 ☎ 1 � 0 ☎ 1 � � � � 1 1 1 1 k ✏ 01001 b in Gray-code order f ✏ x 4 x 2 � x 3 x 0 � x 2 x 1 � � x 1 � x 0 � 1 x 3 f ✏ 0 ☎ 0 � 1 ☎ 1 � 0 ☎ 0 � � � � 1 1 0 1 f ✏ f ♣ 01011 b q ✁ 0 ☎ 1 ✁ � 0 ☎ 0 � 0 1 Exhaustive Search August 15, 2013 5 / 13

  14. Gray-Code Approach k ✏ 01010 b ; x 4 ✏ 0 , x 3 ✏ 1 , x 2 ✏ 0 , x 1 ✏ 1 , x 0 ✏ 0 f ✏ x 4 x 2 � x 3 x 0 � x 2 x 1 � x 3 � x 1 � x 0 � 1 f ✏ 0 ☎ 0 � 1 ☎ 0 � 0 ☎ 1 � � � � 1 1 1 0 k ✏ 01011 b ; x 4 ✏ 0 , x 3 ✏ 1 , x 2 ✏ 0 , x 1 ✏ 1 , x 0 ✏ 1 f ✏ x 4 x 2 � x 3 x 0 � x 2 x 1 � x 3 � x 1 � x 0 � 1 f ✏ 0 ☎ 0 � 1 ☎ 1 � 0 ☎ 1 � � � � 1 1 1 1 k ✏ 01001 b in Gray-code order f ✏ x 4 x 2 � x 3 x 0 � x 2 x 1 � � x 1 � x 0 � 1 x 3 f ✏ 0 ☎ 0 � 1 ☎ 1 � 0 ☎ 0 � � � � 1 1 0 1 f ✏ f ♣ 01011 b q ✁ 0 ☎ 1 ✁ � 0 ☎ 0 � 0 1 ❇ f f ✏ f ♣ 01011 b q � ❇ x 1 ♣ 01001 b q Exhaustive Search August 15, 2013 5 / 13

  15. Gray-Code Approach Full-Evaluation Approach ➓ Evaluate the whole equation for each possible input. ➓ Time Complexity: O ♣ 2 n n 2 q ➓ Memory Complexity: O ♣ n q Gray-Code Approach ➓ Only re-compute those parts of the equation that have changed. ➓ Enumerate input vector in Gray-code order. ➓ Update solution using the derivatives of the involved variables. ➓ Time Complexity: O ♣ 2 n m q ➓ Memory Complexity: O ♣ n 2 m q Trade computation for memory. Exhaustive Search August 15, 2013 6 / 13

  16. Xilinx Spartan6 FPGA Lookup Table (LUT) – LUT-6 Can be seen as ➓ logic: compute any logical expression in 6 variables, ➓ ROM: store 64bit, addressed by 6 address ports. Can be used as two LUT-5 with identical input wires and independent output wires. Exhaustive Search on FPGAs August 15, 2013 7 / 13

  17. Xilinx Spartan6 FPGA Resources ➓ 50% SLICEX ➓ 4 LUT-6 ➓ 8 Flip-Flops ➓ 25% SLICEL + wide multiplexers + carry logic for large adders ➓ 25% SLICEM + LUT can be used as shift registers + LUT can be used as RAM sharing the same write address ➓ Block RAM, DSPs, IO, ... Exhaustive Search on FPGAs August 15, 2013 7 / 13

  18. Gray-Code Algorithm 24: function EVAL( s ) while s . i ➔ 2 n do 25: s . i Ð s . i � 1 ; 26: k 1 Ð BIT 1 ♣ s . i q ; 27: k 2 Ð BIT 2 ♣ s . i q ; 28: if k 2 valid then 29: s . d ✶ r k 1 s Ð s . d ✶ r k 1 s ❵ s . d ✷ r k 1 , k 2 s ; 30: end if 31: s . y Ð s . y ❵ s . d ✶ r k 1 s ; 32: if s . y ✏ 0 then 33: return shr ♣ s . i , 1 q ❵ s . i ; 34: end if 35: end while 36: 37: end function Exhaustive Search on FPGAs August 15, 2013 8 / 13

  19. Parallelization Fix i Variables for 2 i Parallel Instances: ✏ � � x 2 x 1 � x 3 � x 1 � x 0 � 1 f x 4 x 2 x 3 x 0 e.g. i ✏ 2 : f 00 b ✏ 0 ☎ x 2 � 0 ☎ x 0 � x 2 x 1 � � x 1 � x 0 � 1 0 f 01 b ✏ 0 ☎ x 2 � 1 ☎ x 0 � x 2 x 1 � � x 1 � x 0 � 1 1 f 10 b ✏ 1 ☎ x 2 � 0 ☎ x 0 � x 2 x 1 � 0 � x 1 � x 0 � 1 f 11 b ✏ 1 ☎ x 2 � 1 ☎ x 0 � x 2 x 1 � 1 � x 1 � x 0 � 1 2 i independent equations (systems) Exhaustive Search on FPGAs August 15, 2013 9 / 13

  20. Parallelization Fix i Variables for 2 i Parallel Instances: ✏ � � x 2 x 1 � x 3 � x 1 � x 0 � 1 f x 4 x 2 x 3 x 0 e.g. i ✏ 2 : f 00 b ✏ 0 ☎ x 2 � 0 ☎ x 0 � x 2 x 1 � � x 1 � x 0 � 1 0 f 01 b ✏ 0 ☎ x 2 � 1 ☎ x 0 � x 2 x 1 � � x 1 � x 0 � 1 1 f 10 b ✏ 1 ☎ x 2 � 0 ☎ x 0 � x 2 x 1 � 0 � x 1 � x 0 � 1 f 11 b ✏ 1 ☎ x 2 � 1 ☎ x 0 � x 2 x 1 � 1 � x 1 � x 0 � 1 2 i independent equations (systems) sharing the same quadratic terms! Exhaustive Search on FPGAs August 15, 2013 9 / 13

  21. Instance sol buffer buffer LUT-6 or RAM d' new_y new_d' flip new_d' = d' ⊕ d''; flop new_y = d' ⊕ d'' ⊕ y; y inst j,k inst j,k+1 inst j,k+2 inst j,k+3 inst j,k...k+3 d'' k1 Exhaustive Search on FPGAs August 15, 2013 10 / 13

  22. Instance sol buffer buffer LUT-6 Program a LUT-6 or RAM d' directly new_y as two LUT-5. new_d' flip new_d' = d' ⊕ d''; flop new_y = d' ⊕ d'' ⊕ y; y inst j,k inst j,k+1 inst j,k+2 inst j,k+3 inst j,k...k+3 d'' k1 Exhaustive Search on FPGAs August 15, 2013 10 / 13

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend