The Influence of Lot Size on Production Performance in Wafer Fabrication Based on Simulation

Tu, Ying-Mei; Lu, Chun-Wei

doi:10.1016/j.proeng.2017.01.180

Cited by 9 publications

(5 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…MPW runs uses Multi Layer Reticule technic to reduce the overall cost of the mask and additional dies. For our purposes, we consider a small scale project to be a project with at most 25 wafers [20] . For large scale projects, a market study published at the FDSOI Forum in 2018 showed that the die manufacturing cost per 40 mm 2 is 0.9 USD for the 28nm technology [8].…”

Section: Asic Fabrication and Running Costmentioning

confidence: 99%

On the Cost of ASIC Hardware Crackers: A SHA-1 Case Study

Chattopadhyay

Khairallah

Leurent

et al. 2021

Topics in Cryptology – CT-RSA 2021

View full text Add to dashboard Cite

In February 2017, the SHA-1 hashing algorithm was practically broken using an identical-prefix collision attack implemented on a GPU cluster, and in January 2020 a chosen-prefix collision was first computed with practical implications on various security protocols. These advances opened the door for several research questions, such as the minimal cost to perform these attacks in practice. In particular, one may wonder what is the best technology for software/hardware cryptanalysis of such primitives. In this paper, we address some of these questions by studying the challenges and costs of building an ASIC cluster for performing attacks against a hash function. Our study takes into account different scenarios and includes two cryptanalytic strategies that can be used to find such collisions: a classical generic birthday search, and a state-of-the-art differential attack using neutral bits for SHA-1. We show that for generic attacks, GPU and ASIC poses a serious practical threat to primitives with security level ∼ 64 bits, with rented GPU a good solution for a one-off attack, and ASICs more efficient if the attack has to be run a few times. ASICs also pose a non-negligible security risk for primitives with 80-bit security. For differential attacks, GPUs (purchased or rented) are often a very cost-effective choice, but ASIC provides an alternative for organizations that can afford the initial cost and look for a compact, energy-efficient, reusable solution. In the case of SHA-1, we show that an ASIC cluster costing a few millions would be able to generate chosen-prefix collisions in a day or even in a minute. This extends the attack surface to TLS and SSH, for which the chosen-prefix collision would need to be generated very quickly.

show abstract

Section: Asic Fabrication and Running Costmentioning

confidence: 99%

On the Cost of ASIC Hardware Crackers: A SHA-1 Case Study

Chattopadhyay

Khairallah

Leurent

et al. 2021

Topics in Cryptology – CT-RSA 2021

View full text Add to dashboard Cite

show abstract

“…For small scale projects with more than 100 die, the price for a lot of 100 extra die is between 21,120 and 38,500 USD depending on the die area. For our purposes, we consider a small scale project to be a project with at most 25 wafers [15] . For large scale projects, a market study published at the FDSOI Forum in 2018 showed that the die manufacturing cost per 40 mm 2 is 0.9 USD for the 28 nm technology [16].…”

Section: Asic Fabrication and Running Costmentioning

confidence: 99%

On the Cost of ASIC Hardware Crackers

Khairallah

2021

Hardware Oriented Authenticated Encryption Based on Tweakable Block Ciphers

View full text Add to dashboard Cite

Setting security goals requires understanding the current possibilities and limitations in terms of attacks can be considered practical and what cannot. To do so, this chapter discusses the hardware implementation of a group of cryptanalytic attacks against SKE primitives. As a case study, we consider attacks against once of the recently broken primitives, SHA-1. It is an attempt at answering three important research questions:• Can the cost of the collision attacks against SHA-1 be reduced? There has been major breakthroughs in the cryptanalysis of SHA-1 over the past few years, with the first practical identical-prefix collision (IPC) found in February 2017 [1] and the first chosen-prefix collision (CPC) found in January 2020 [2]. While these attacks are practical on general-purpose GPUs, they still take a few months to generate one collision, by both academic and industrial entities. Interestingly, the authors of [2] remarked that TLS and SSH connections using SHA-1 signatures to authenticate the handshake could be attacked with the SLOTH attack [3] if the chosen-prefix collision can be generated quickly. Hence, we would like to check if ASIC can provide a better alternative to speed up the attacks, using larger budgets.We actually show that chosen-prefix collisions could be generated within a day or even a minute using an ASIC cluster costing a few dozen Million USD (the amortized cost per chosen-prefix collision is then much lower). • What is the difference between generic search-based attacks and cryptanalyticattacks in terms of cost and implementation? When analyzing a new cipher, any algorithm that has a theoretical time and data complexities lower than the generic attacks is considered a successful attack and the cipher is considered broken. For example, an n-bit hash function that is collision resistant up to the birthday bound is considered insecure if there is a cryptanalytic attack that requires less than 2 0.9n/2 hash calls. Most of the time, researchers only measure time complexity in terms of function calls and ignore other operations required to perform the attack if

show abstract

“…However, there still exists a trade-off between the resolution capability and the throughput. 13,14) Here, in general, the wet process is a batch process, 15) and it is a great benefit to handle several wafers at one time and thus, both high resolution capability and high throughput can be expected at the same time because of the improvement of the resolution capability by this method.…”

Section: Introductionmentioning

confidence: 99%

Resolution capability of resist patterns and throughput using alkaline treatment under ultrasonic irradiation

Onishi¹,

Miyake²,

Shirai³

2022

Jpn. J. Appl. Phys.

View full text Add to dashboard Cite

Alkaline treatment of the photoresist under ultrasonic irradiation has been investigated to improve the resolution capability of resist patterns with higher throughput. The selectively dissolved phenol resin for the combination of the alkaline treatment with ultrasonic irradiation was increased by 2.3 times compared to the solely alkaline treatment. The sensitizing effect of naphthoquinone diazide (sensitizer) based on phenol was increased to 0.46 against dip treatment of 0.31. As a result, resist sensitivity was increased to 26% and the resolution capability was drastically improved. Consequently, the 0.5 μm line and space resist patterns were resolved completely with fine profile by using the photoresist with a 0.7　μm resolution limit together with g-line exposure machine with a 0.6 μm resolution limit. As a consequence, a high throughput of 25 wafers/min was achieved, which was more than 25 times higher than that of electron beam (EB) lithography.

show abstract

The Influence of Lot Size on Production Performance in Wafer Fabrication Based on Simulation

Cited by 9 publications

References 6 publications

On the Cost of ASIC Hardware Crackers: A SHA-1 Case Study

On the Cost of ASIC Hardware Crackers: A SHA-1 Case Study

On the Cost of ASIC Hardware Crackers

Resolution capability of resist patterns and throughput using alkaline treatment under ultrasonic irradiation

Contact Info

Product

Resources

About