1
$\begingroup$

First of all, I apologize in advance if I use any incorrect terminology. I am just getting my feet wet when it comes to cryptography and there is a lot to learn.

For the past 12 months we have been developing an application infrastructure for a Cloud and Mobile Application (iOS/Android). As part of the infrastructure, we require the ability to encrypt $\text{SHA-}256$ hashes using asymmetric encryption and in some cases, encrypt multiple hashes at one time. A non-decryptable digital signature is not sufficient for our requirements. The simple explanation for this is, the digital signatures we have been using thus far, allows anyone with a corresponding public key, to review the contents to ensure they align with corresponding data in the database row. Ownership of the row of data cannot be transferred or duplicate rows created, without the correct signature. Rows have a signature and an owner and two digital signatures validating the product serial number is valid and that the declared owner, does in fact own the serial number.

We have built a working prototype that was built on-top of our existing framework, which uses PostgreSQL and PHP and preliminary testing using $\text{SHA-}256$ and RSA 2048 has yielded the results of being able to encrypt and insert/update 10,000 unique rows of data every 40 seconds. When inserting 10,000 rows of data, there are 10,000 unique digital signatures that have to be created. The bulk of the work is in creating these digital signatures.

We are wondering what the best way to speed this up is? Ultimately, we need to be able to drastically reduce this time and it would be ideal if we could get 10,000 rows signed and inserted in under 5 seconds.

Is there a faster solution for singing digital signatures with a private key? We have discussed writing this component in C#. We are also wondering if Bitcoin mining hardware (ASIC) could be used for asymmetric encryption? If not mining hardware, would GPU based processing be better? Acquiring specialized hardware, should it improve the processing time, is not a problem.

We eventually need to generate in excess of 1 billion digital signatures per month. Any guidance or help would be greatly appreciate.

EDIT: I forgot to mention we are using OpenSSL with our current prototype.

$\endgroup$
  • $\begingroup$ When you talk about "unique digital signatures", does that mean "a different private key for each signature"? $\endgroup$ – SEJPM Apr 10 '16 at 9:20
  • $\begingroup$ My apologies, I made a mistake in the original post. I meant to say non-decryptable digital signatures are not sufficient. Our current signatures are decryptable with a public key so that anyone can verify the contents and ensure the align with the data they are attached to. We are using the same private key, not multiples, so it's 10,000 unique signatures, on 10,000 unique pieces of data, creates with one private key, all verifiable that the data is accurate and we approved it using he public key. $\endgroup$ – LiveWithPassion Apr 10 '16 at 18:25
  • 1
    $\begingroup$ "Acquiring specialized hardware, should it improve the processing time, is not a problem." - This can be the answer, just get a cryto accelerator (as a PCIe card or something, for example the Luna PCI-E 7000 can do 1200 RSA-2048 operations per second). And an additional request: Can you please abstract what you're doing and what your threat model is? (F.Ex.: We have data A and B, and sign both individually, now an attacker must not be able to learn A,...) $\endgroup$ – SEJPM Apr 10 '16 at 18:49
  • $\begingroup$ I would agree with SEJPM; it would be good if you would explain exactly what your threat model is; what operations do you need to allow various people to perform, and what do you wish them not be able to do. $\endgroup$ – poncho Apr 10 '16 at 19:16
  • $\begingroup$ I have added the detail to the original post as it was to long for the comments field. Cheers $\endgroup$ – LiveWithPassion Apr 10 '16 at 21:04
0
$\begingroup$

I would explore the GPU option before spending money on specialized hardware.

I have done something similar using CUDA where I was doing many ECC operations in parallel. The GPU was about 30x - 50x faster than the CPU.

You could probably hash the data on the CPU and then use the GPU for the RSA exponentiation.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.