Post
Topic
Board Development & Technical Discussion
Re: Pollard's kangaroo ECDLP solver
by
Tamarindei
on 03/06/2020, 00:14:16 UTC
I am working on pool to solve keys together.
-----
So far, the biggest problem is the verification of DP. The CPU is not able to check every DP, it simply does not have enough resources for this.
As an option, in order to prevent forged DPs, HelpServer can check a few percent of the sent.
And send to the ban if the client sends the wrong points.
Maybe someone knows how to easily and effectively check points, because multiplying the distance by G is a resource-intensive process.

Are you sure?

key #110 was solved with 2^30.55 DP in 2 days

A normal cpu can compute consecutive keys very fast, my cpu computes almost 30 Mkeys/s, let's say 2^24 keys/s; it would take less than 2 minutes to check 2^30 points

computing random points is slower, but even if it takes x100, we are talking about 3 hours for the entire hash table.

With a simple python script I can get 2^12 keys/s, but it is not tailored for the public keys with private keys so short (under 128 bit) it could reach at least 2^13 keys/s with keys so short.

If you need it I can put together a C program, I think at least 100k key/s are possible, then 2^30 points in less than 3 hours; what speed do you think you need? How much DPs you want to check per hour?

You would need to check that the DP is actually valid though. That involves performing the entire walk. If you did this for every DP you would be re-doing the entire computation.



One way to do this would to include a checksum with the DP whete the checksum is the count of each jump point that makes up the DP. To verify it the server multiplies and adds the counts and the jump points together. This would involve more work for the client since it would need to keep count for every walk.

Is it really that important a DP was generated by a walk? Why aren't any points that satisfy the DP criteria (bitmask) valid and usefull?

Maybe different approach for parallalelizing the work:

Q = our target pubkey in 115 bit range

If you have 16 GPUs prepare a new set S of pubkeys:

for n = 0 to 16
  S[n] = (Q-n)/16

Now you have a set S with 16 new derived pubkeys where only one is in the range targetBitrange-4 (for 115 they are now in 111 bit range).
So it is true that 15 GPUs will work on pubkeys that are in a different range and this work is useless. But one GPU is working in the correct 111 bit range.

Would this be a benefit?