1. 1 Factoring Large Numbers with the TWIRL Device Adi Shamir, Eran Tromer

2. 2 Bicycle chain sieve [D. H. Lehmer, 1928]

3. 3 The Number Field Sieve Integer Factorization Algorithm Best algorithm known for factoring large integers. Subexponential time, subexponential space. Successfully factored a 512-bit RSA key in 1999 (hundreds of workstations running for many months). Record: 530-bit integer factored in 2003.

4. 4 NFS: Main steps Relation collection (sieving) step: Find many numbers satisfying a certain (rare) property. Matrix step: Find a linear dependency among the numbers found.

5. 5 NFS: Main steps Relation collection (sieving) step: Find many numbers satisfying a certain (rare) property. Matrix step: Find a linear dependency among the numbers found. This work Cost dramatically reduced by [Bernstein 2001] followed by [LSTT 2002] and [GS 2003].

6. 6 Cost of sieving for RSA-1024 in 1 year Traditional PC-based: [Silverman 2000] 100M PCs with 170GB RAM each: $ 5  10 12 TWINKLE: [Lenstra,Shamir 2000][Silverman 2000] * 3.5M TWINKLEs and 14M PCs: ~ $ 10 11 Mesh-based sieving [Geiselmann,Steinwandt 2002] * Millions of devices, $ 10 11 to $ 10 10 (if at all?) Multi-wafer design – feasible? Our design: $10M using standard silicon technology (0.13um, 1GHz).

7. 7 The Sieving Problem Input: a set of arithmetic progressions. Each progression has a prime interval p and value log p. OOO OOO OOOOO OOOOOOOOO OOOOOOOOOOOO Output: indices where the sum of values exceeds a threshold.

8. 8 1024-bit NFS sieving parameters Total number of indices to test: 3  10 23. Each index should be tested against all primes up to 3.5  10 9.

9. 9 Three ways to sieve your numbers... O 41 37 O 31 29 O 23 O 19 O 17 OO 13 OOO 11 OOO 7 OOOOO 5 OOOOOOOOO 3 OOOOOOOOOOOO 2 2423222120191817161514131211109876543210 primes indices ( a values)

10. 10 Time O 41 37 O 31 29 O 23 O 19 O 17 OO 13 OOO 11 OOO 7 OOOOO 5 OOOOOOOOO 3 OOOOOOOOOOOO 2 2423222120191817161514131211109876543210 Memory One contribution per clock cycle. PC-based sieving, à la Eratosthenes 276–194 BC

11. 11 Counters TWINKLE: time-space reversal O 41 37 O 31 29 O 23 O 19 O 17 OO 13 OOO 11 OOO 7 OOOOO 5 OOOOOOOOO 3 OOOOOOOOOOOO 2 2423222120191817161514131211109876543210 Time One index handled at each clock cycle. The Weizmann Institute Key Locating Engine [Shamir 99]

12. 12 Various circuits TWIRL: compressed time O 41 37 O 31 29 O 23 O 19 O 17 OO 13 OOO 11 OOO 7 OOOOO 5 OOOOOOOOO 3 OOOOOOOOOOOO 2 2423222120191817161514131211109876543210 Time s=5 indices handled at each clock cycle. (real: s=32768 ) The Weizmann Institute Relation Locator

13. 13 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Parallelization in TWIRL TWINKLE-like pipeline a =0,1,2, …

14. 14 Parallelization in TWIRL TWINKLE-like pipeline Simple parallelization with factor s a =0, s,2 s, … TWIRL with parallelization factor s a =0, s,2 s, … a =0,1,2, … 0 1 2 s-1s-1 3 s+1s+1 s+2s+2 2s-12s-1 s+3s+3 s 0 1 2 s-1s-1 3 s+1s+1 s+2s+2 2s-12s-1 s+3s+3 s 0 1 2 s-1s-1 3 2s2s 2 s +1 2 s +2 2 s +3 3 s -1

15. 15 Example (simplified): handling large primes Each prime makes a contribution once per 10,000’s of clock cycles (after time compression); inbetween, it’s merely stored compactly in DRAM. Each memory+processor unit handles 10,000’s of progressions. It computes and sends contributions across the bus, where they are added at just the right time. Timing is critical. Memory Processor Memory Processor

16. 16 Handling large primes (cont.) Memory Processor

17. 17 Implementing a priority queue of events The memory contains a list of events of the form ( p i, a i ), meaning “a progression with interval p i will make a contribution to index a i ”. Goal: implement a priority queue. 1. Read next event ( p i, a i ). 2. Send a log p i contribution to line a i ( mod s ) of the pipeline. 3. Update a i à a i +p i 4. Save the new event ( p i, a i ) to the memory location that will be read just before index a i passes through the pipeline. To handle collisions, slacks and logic are added. The list is ordered by increasing a i. At each clock cycle:

18. 18 Handling large primes (cont.) The memory used by past events can be reused. Think of the processor as rotating around the cyclic memory: Processor

19. 19 Handling large primes (cont.) The memory used by past events can be reused. Think of the processor as rotating around the cyclic memory: By assigning similarly-sized primes to the same processor (+ appropriate choice of parameters), we guarantee that new events are always written just behind the read head. There is a tiny (1:1000) window of activity which is “twirling” around the memory bank. It is handled by an SRAM-based cache. The bulk of storage is handled in compact DRAM. Processor

20. 20 Rational vs. algebraic sieves In fact, we need to perform two sieves: rational (expensive) and algebraic (even more expensive). We are interested only in indices which pass both sieves. We can use the results of the rational sieve to greatly reduce the cost of the algebraic sieve. algebraic rational

21. 21 Notes TWIRL is a hypothetical and untested design. It uses a highly fault-tolerant wafer-scale design. The following analysis is based on approximations and simulations.

22. 22 TWIRL for 512-bit composites One silicon wafer full of TWIRL devices (total cost ~$15,000) can complete the sieving in under 10 minutes. This is 1,600 times faster than the best previous design.

23. 23 TWIRL for 1024-bit composites Operates in clusters of 3 almost independent wafers. Initial investment (NRE): ~$20M To complete the sieving in 1 year Use 194 clusters (~600 wafers). Silicon cost: ~$2.9M Total cost: ~$10M (compared to ~$1T). A R R R R R R R R

24. 24.