FPGAs in cryptanalysis: Key search machine 2 interface

The registers available to the programmer are:

[H]

Address	Name	Description	Read/write
0	BUFFER	See text	Read/write
1	CTEXT	Sets the ciphertext to use	Write only
2	PTEXT	Sets the plaintext to use	Write only
3	IV	Sets the initialisation vector to use	Write only

The BUFFER register has the following format:

Bits	Name	Description
0–3	VERSION	Protocol version (2)
4	DVALID	Set when the machine is ready for a new command
5	unused
6	RW	Specifies whether this command describes a read or write operation
7	unused
8–15	ADDR	Specifies the target address for the write or read
16–63	DATA	See text

VERSION and DVALID function identically to the original key search machine. In this version of the machine the BUFFER register indirectly controls the search bus. A write is performed by setting RW to 1 and specifying the data in the DATA register. A read is performed by writing a word with RW set to 0 and then polling the BUFFER register until DVALID goes high. The data will be contained in the space allocated to the DATA field.

A read or write through the BUFFER register always sets or retrieves the key in use by a search unit. The exact interpretation of the DATA field depends on the key generator in use. The intended purpose is for DATA to be interpreted as a block number during a write, and treated as the key number (least significant 32 bits) during a read.

When reading through the BUFFER register, 32 bits are used by the key value. The other 8 bits are used by the search unit to report status information:

Bits	Name	Description
0	KEYVALID	Set when the search unit has a key block to search through
1	RUNNING	Set when the search unit is searching its key block
2–7	unused
8–47	KEY	The least significant 32 bits of the key value

Software checks presence and version of board by reading BUFFER register
If VERSION is 0, program complains that FPGA has not been programmed
If VERSION is not 2, program complains that software version does not match or FPGA is incorrectly programmed
For each address where a search unit is believed to exist
1. Software performs a read-through-BUFFER operation on the appropriate address
2. If the key returned is 1, a search unit exists at that address
Software writes CTEXT, PTEXT and IV registers
For each search unit:
1. Software writes initial key into search unit with a write-through-BUFFER operation
Until correct key is located:
1. Software polls the RUNNING bit of each known search unit in turn.
2. If RUNNING on a search unit is 0:
  1. Record the key value as a potential key
  2. Write the block number to the search unit so that it continues searching from the same point

The key that is read from the key buffer is the value that was in the key generator at the time the search unit was halted, not the key that caused the search unit to halt. The software must be aware of the number of clock cycles required to process a single key and subtract that value from the retrieved value. This value is algorithm dependent.

Ian Howson