1
$\begingroup$

First of all, I apologize in advance if I use any incorrect terminology. I am just getting my feet wet when it comes to cryptography and there is a lot to learn.

For the past 12 months, we have been developing an application infrastructure for a Cloud and Mobile Application (iOS/Android). As part of the infrastructure, we require the ability to encrypt $\text{SHA-}256$ hashes using asymmetric encryption and in some cases, encrypt multiple hashes at one time. A non-decryptable digital signature is not sufficient for our requirements. The simple explanation for this is, the digital signatures we have been using thus far, allows anyone with a corresponding public key, to review the contents to ensure they align with corresponding data in the database row. Ownership of the row of data cannot be transferred or duplicate rows created, without the correct signature. Rows have a signature and an owner and two digital signatures validating the product serial number is valid and that the declared owner, does, in fact, own the serial number.

We have built a working prototype that was built on top of our existing framework, which uses PostgreSQL and PHP and preliminary testing using $\text{SHA-}256$ and RSA 2048 has yielded the results of being able to encrypt and insert/update 10,000 unique rows of data every 40 seconds. When inserting 10,000 rows of data, there are 10,000 unique digital signatures that have to be created. The bulk of the work is in creating these digital signatures.

We are wondering what the best way to speed this up is? Ultimately, we need to be able to drastically reduce this time and it would be ideal if we could get 10,000 rows signed and inserted in under 5 seconds.

Is there a faster solution for signing digital signatures with a private key? We have discussed writing this component in C#. We are also wondering if Bitcoin mining hardware (ASIC) could be used for asymmetric encryption? If not mining hardware, would GPU based processing be better? Acquiring specialized hardware, should improve the processing time, which is not a problem.

We eventually need to generate in excess of 1 billion digital signatures per month. Any guidance or help would be greatly appreciated.

EDIT: I forgot to mention we are using OpenSSL with our current prototype.

Improve this question
$\endgroup$
9
  • $\begingroup$ When you talk about "unique digital signatures", does that mean "a different private key for each signature"? $\endgroup$
    – SEJPM
    Apr 10, 2016 at 9:20
  • $\begingroup$ My apologies, I made a mistake in the original post. I meant to say non-decryptable digital signatures are not sufficient. Our current signatures are decryptable with a public key so that anyone can verify the contents and ensure the align with the data they are attached to. We are using the same private key, not multiples, so it's 10,000 unique signatures, on 10,000 unique pieces of data, creates with one private key, all verifiable that the data is accurate and we approved it using he public key. $\endgroup$
    – LiveWithPassion
    Apr 10, 2016 at 18:25
  • 1
    $\begingroup$ "Acquiring specialized hardware, should it improve the processing time, is not a problem." - This can be the answer, just get a cryto accelerator (as a PCIe card or something, for example the Luna PCI-E 7000 can do 1200 RSA-2048 operations per second). And an additional request: Can you please abstract what you're doing and what your threat model is? (F.Ex.: We have data A and B, and sign both individually, now an attacker must not be able to learn A,...) $\endgroup$
    – SEJPM
    Apr 10, 2016 at 18:49
  • $\begingroup$ I would agree with SEJPM; it would be good if you would explain exactly what your threat model is; what operations do you need to allow various people to perform, and what do you wish them not be able to do. $\endgroup$
    – poncho
    Apr 10, 2016 at 19:16
  • $\begingroup$ I have added the detail to the original post as it was to long for the comments field. Cheers $\endgroup$
    – LiveWithPassion
    Apr 10, 2016 at 21:04

1 Answer 1

Reset to default
0
$\begingroup$

I would explore the GPU option before spending money on specialized hardware.

I have done something similar using CUDA where I was doing many ECC operations in parallel. The GPU was about 30x - 50x faster than the CPU.

You could probably hash the data on the CPU and then use the GPU for the RSA exponentiation.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.