Non-Wafer-Scale Sieving Hardware for the NFS: Another Attempt to - PowerPoint PPT Presentation

Non-Wafer-Scale Sieving Hardware for the NFS: Another Attempt to Cope with 1024-bit Willi Geiselmann Rainer Steinwandt

The Number Field Sieve  Precomputation  Relation collection  Linear Algebra (Matrix step)  Postprocessing 23.5.2007 Sieving with Small Chips (Geiselmann, Steinwandt) 2

Relation Collection  Given F 1 (x,y), F 2 (x,y) ∈ Z[x,y] , homogeneous polynomials, e.g. of degree 5 and 1  Find (a,b) ∈ Z x N with F 1 (a,b) and F 2 (a,b) smooth, gcd (a,b) = 1 23.5.2007 Sieving with Small Chips (Geiselmann, Steinwandt) 3

Parameters for 1024 Bit (identical with TWIRL, 2003)  Smoothness bounds: B 1 = 2.6 • 10 10 (algebraic), B 2 = 3.5 • 10 9 (rational).  Sieving region: A = 5.5 • 10 14 , - A < a < A ; B = 2.7 • 10 8 , 0 < b < B . 23.5.2007 Sieving with Small Chips (Geiselmann, Steinwandt) 4

Previous work  TWINKLE [Shamir 1999; Shamir, Lenstra 2000] not designed for 1024 bit numbers  TWIRL [Shamir, Tromer 2003] full wafer design  Mesh-based sieving [G., St. 2003, 2004] not feasible for 1024 bit numbers  SHARK [Franke et al. 2005] elaborated butterfly transport system 23.5.2007 Sieving with Small Chips (Geiselmann, Steinwandt) 5

Sieving (Eratosthenes) 37 31 29 T 23 19 i 17 m 13 e 11 7 5 3 2 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Memory 23.5.2007 Sieving with Small Chips (Geiselmann, Steinwandt) 6

Sieving (TWINKLE/TWIRL) Counter 37 Counter 31 Counter 29 Counter 23 Counter 19 Counter 17 Counter 13 Counter 11 Counter 7 Counter 5 Counter 3 Counter 2 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Σ Time 23.5.2007 Sieving with Small Chips (Geiselmann, Steinwandt) 7

Sieving (mesh / here) ? 37 ? 31 29 ? ? 23 ? 19 17 ? 13 ? ? 11 ? 7 5 Counter Counter 3 Counter 2 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 Σ Σ Σ Σ Σ Σ Σ Σ (S = 2 26 ) Σ Σ Σ Σ Σ Σ Σ Σ Memory 23.5.2007 Sieving with Small Chips (Geiselmann, Steinwandt) 8

Different Types of Primes  Largish primes I: 2 27.2 < p < B 1 < 2 35 1.5 • 10 7 < p < 2 27.2 ...Type II/III:  Medium primes: 2 13 < p < 1.5 • 10 7  Smallish primes: p < 2 13 23.5.2007 Sieving with Small Chips (Geiselmann, Steinwandt) 9

Largish Stations - - - control logic & adder control logic & adder . . . DRAM for ( p , r )-pairs DRAM for ( p , r )-pairs − A ≤ r < − A + S − A + S ≤ r < − A + 2 S - - - control logic & adder control logic & adder DRAM for ( p , r )-pairs DRAM for ( p , r )-pairs 23.5.2007 Sieving with Small Chips (Geiselmann, Steinwandt) 10

Largish Stations (Type I)  DRAM holds < 100,000 ( p,r )-pairs  3 < #DRAMs < 389 ( p max / S)  256 stations for p > 1.5 • 10 7 ≈ 2 27.2  Distributed on 32 chips: size: 472 mm 2 (0.13 µ m process) output: 448 bit per clock cycle memory: 99%, logic: 1% 23.5.2007 Sieving with Small Chips (Geiselmann, Steinwandt) 11

Collection Unit  Distributed on 4 input part input part input part chips, each holding counting counting counting  4 arrays of 32 x 32 unit unit unit counting counting counting counting units. unit unit unit  Each unit is in charge of 2 12 sieve locations,  and adding up the counting counting counting log( p ) values. unit unit unit 23.5.2007 Sieving with Small Chips (Geiselmann, Steinwandt) 12

Medium and Smallish Primes  Medium Primes:  Calculated close to the Counting Units  Smallish Primes:  calculated in the Counting Parts  stored (added) in separate DRAM 23.5.2007 Sieving with Small Chips (Geiselmann, Steinwandt) 13

Collection Unit (area estimates) Distributed on 2 M sta 2 mm 2 2 M sta 2 mm 2 16 L sta array array Type 3 4 chips: 50 mm 2 50 mm 2 46 mm 2 size: 493 mm 2 2,2 cm 22 L sta 22 L sta (0.13 µ m process) 20 M sta 20 mm 2 Type 2 Type 2 90 mm 2 input: 3584 bit / cc 90 mm 2 memory: 94% 16 L sta array array 2 M sta 2 mm 2 Type 3 2 M sta 2 mm 2 logic: 6% 50 mm 2 50 mm 2 46 mm 2 23.5.2007 Sieving with Small Chips (Geiselmann, Steinwandt) 14

Performance  Total silicon area 172 cm 2  One subinterval (S=2 26 ) in 53,000 cc  One sieve line in 25 min (600 MHz)  Sieving of a 1024 bit number with 8300 devices in one year  3.5 x more silicon area than TWIRL  or 2.0 x more after modification 23.5.2007 Sieving with Small Chips (Geiselmann, Steinwandt) 15