# Which cryptographic operations can be optimized with a GPU? When shouldn't it be done?

I'm under the impression that GPUs are only used to optimize some (not all) of a given cryptographic operation. Furthermore, I've only seen this GPU optimization done in Bitcoin.

This observation unleashed a number of rhetorical questions that relate closely to each other.

Rhetorical questions (answer if you like)

• Outside of Bitcoin, are general purpose cryptography operations offloaded to GPUs in general when native CPU instructions don't exist (CMUL/PCLMULQDQ)?

• Which cryptographic operations? (BigInt^BigInt? * BigInt)?

• Is only some of the cryptographic work offloaded, or is all of the work? E.g. an entire AES/PGP runtime embedded in the GPU?

• What prevents security risks? E.g. WebGL might be isolated from other processes.

• Is the physical RAM in a GPU different? Exploits in the past describe how neighboring CPU banks can have their value inferred by the active process. Not to mention physical shielding of the RAM.

• If any of the above could cause a security risk, is there any benefit with a platform that restricts access to the GPU? For example, the Metal graphics API is constrained in function and doesn't expose a "raw" GPU mode. (I think)

Real Question

As a hobbyist, should I explore porting cryptographic code to Apple's GPU? This is the Bouncy Castle function that is slowing me down: StackOverflow -- How can I improve performance of BigInteger as compiled to Objective C by Xamarin.iOS / Mono?

What would a professional do to make that effort worthwhile and more secure?

• I honestly doubt that you can significantly speed-up big-integer operations with a GPU. It's made to process many simple arithmetic operations in parallel (think for example a full matrix-matrix or matrix-vector multiplication for each thread). However big-integer operations are pretty much inherently linear (unless you need to do many at which point one may consider it, but would probably try harder to optimize the CPU code). – SEJPM May 19 '17 at 17:01
• If you were to tell the good folk here which cryptographic operation you're trying to speed up, they might be able to assess whether there's any likely benefit to be had. Something like optimisation efforts in brute forcing an AES key would be simple to answer. – Paul Uszak May 19 '17 at 20:34
• Your "real question" points to the fact you want to speed up BigInteger operations, which has a rather general use and is less of a crypto-only thing. So, to clarify while bluntly ignoring that this might just be nothing but a primarily opinion based question you're asking here ---Which cryptographic function(s) are you thinking about when asking if you should explore porting cryptographic code to Apple's GPU? – e-sushi May 20 '17 at 3:15
• @e-sushi I'm trying to get a conceptual baseline on what can a GPU do for cryptography. Based on the comment above, if a GPU is only beneficial for math functions that can be made multi threaded, then that simplifies my question to: "which crypto has functions that may leverage the many threads of a GPU?" – random65537 May 20 '17 at 13:24
• There really aren't many crypto functions that benefit very greatly. Almost all modern ciphers and related primitives cannot be parallelized all that much. The only thing I can think of is using it for key stretching (multiple instances of PBKDF2 in parallel with the final hashes combined, for example). Other than that, even when a slight improvement may be found, the latency and bandwidth of the PCI channels becomes the bottleneck. – forest Feb 23 '18 at 4:52