MIME-Version: 1.0
From: Luke Kenneth Casson Leighton <lkcl@lkcl.net>
Date: Mon, 25 Jan 2021 18:00:35 +0000
Message-ID: <CAPweEDx4wH_PG8=wqLgM_+RfTQEUSGfax=SOkgTZhe1FagXF9g@mail.gmail.com>
To: "bitcoin-dev@lists.linuxfoundation.org"
 <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="000000000000990b7405b9bd50e5"
Subject: [bitcoin-dev] Libre/Open blockchain / cryptographic ASICs
Precedence: list

--000000000000990b7405b9bd50e5
Content-Type: text/plain; charset="UTF-8"

folks, hi, please do cc me as i am subscribed "digest", apologies for the
inconvenience.

i've been speaking on and off with kanzure, asking his advice about a libre
/ transparently-developed ASIC / SoC, for some time, since meeting a very
interesting person at the Barcelona RISC-V Workshop in 2018.

this person pointed out that FIPS-approved algorithms, implemented in
FIPS-approved crypto-chips used in hardware wallets to protect billions to
trillions in cryptocurrency assets world-wide are basically asking for
trouble.  i heard 3rd-hand that the constants used in the original bitcoin
protocol were very deliberately changed from those approved by FIPS and the
NSA for exactly the reasons that drive people to question whether it is a
good idea to trust closed and secretive crypto-chips, no matter how
well-intentioned the company that manufactures them.  the person i met was
there to "sound out" interested parties willing to help with such a
venture, even to the extent of actually buying a Foundry, in order to
guarantee that the crypto-chip they would like to see made had not been
tampered with at any point during manufacturing.

at FOSDEM2019 i was also approached by a team that also wanted to do a
basic "embedded" processor, entirely libre-licensed, only in 350nm or
180nm, with just enough horsepower to do digital signing and so on.  since
then, fascinatingly, NLnet has obtained a new EU Horizon Grant and started
their "Assure" Programme:
https://nlnet.nl/assure/

(our application may be found here):
https://libre-soc.org/nlnet_2021_crypto_router/

in addition, betrusted (headed by Bunnie Huang) is also funded by NLnet and
is along similar lines:
https://betrusted.io/

NLnet is even funding LibreSOC with a 180nm test chip tape-out of the
LibreSOC Core, with help from Sorbonne University and
https://chips4makers.io
https://bugs.libre-soc.org/show_bug.cgi?id=199

and we also have funding to do Formal Correctness Proofs for the low-level
portions of the HDL (similar to c++ and python "assert", but for hardware)
https://bugs.libre-soc.org/show_bug.cgi?id=158

the point being that where even one year ago the idea of an open source
developer creating and paying for an actual ASIC was so ridiculous they
would be laughed at and viewed in a derisive fashion thereafter, reality is
that things are opening up to the point where even Foundry PDKs are now
open source:
https://github.com/google/skywater-pdk

technically it is possible to use Open Hardware to create commercial
(closed) products.  Richard Herveille, most well-known for his early
involvement in Opencores, was the Open Hardware developer responsible for
the HDL behind the first Antminer product by Bitmain, for example.  It used
his RV32 core and i believe he also developed the SHA256 HDL for them.
however that is different in that it was a closed product, not open for
independent public audit and review.

what i am therefore trying to say is that it is a genuinely achievable
goal, now, to create fully transparently-openly-developed ASICs that could
perform crytographic tasks such as mining and hardware wallet key
protection *and have a full audit trail* even to the extent of having
mathematical Formal Correctness Proofs.

my question is - therefore - with all that background in mind - is: is this
something that is of interest?

now, before getting all excited about the possibilities, it's critically
important to provide a reality-check on the costs involved:

* 350nm ASICs: https://chips4makers.io - EUR 1750 for 20 samples
* 180nm ASICs: EUR $600 per mm^2 MPW Shuttle (test ASICs) and EUR 50,000
for production masks
* ... exponential curve going through 130nm, 65nm, 45nm gets to around
$500k...
* 28nm ASICs: USD 100,000 for MPW and USD $1 million for production masks
* 22nm ASICs: double 28nm
* 14nm: double 22nm
* 7nm: quadruple 14nm

you get where that is going.  where higher geometries are now easily within
reach even of a hobbyist ASIC developer, USD 20 million is a bare minimum
to design, develop and bring to manufacture a 7nm Custom ASIC.  full-custom
silicon, as carried out regularly by Intel, is USD 100 million.

this is not to say that it is completely outside the realm of possibility
to do something in these lower geometries: you either simply have to have a
damn good reason, or a hell of a lot of money, or a product that's so
compelling that customers really *really* want it, or you have OEMs lining
up to sign LOIs or put up cash-with-preorder.

[my personal favourite is a focus on power-efficiency: battery-operated
hand-held devices at or below 3.5 watts (thus not requiring thermal pipes
or fans - which tend to break). i have to admit i am a little alarmed at
the world-wide energy consumption of bitcoin: personally i would very much
prefer to be involved in eco-conscious blockchain and crypto-currency
products].

so - as an open question: what would people really like to see happen,
here, what do people feel would be of interest to the wider bitcoin
community, and, crucially, is there a realistic way to bridge (fund) the
gap and actually deliver to the bitcoin user community?

best,

l.

---
crowd-funded eco-conscious hardware: https://www.crowdsupply.com/eoma68


-- 
---
crowd-funded eco-conscious hardware: https://www.crowdsupply.com/eoma68

--000000000000990b7405b9bd50e5
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

folks, hi, please do cc me as i am subscribed &quot;digest&quot;, apologies=
 for the inconvenience.<br><br>i&#39;ve been speaking on and off with kanzu=
re, asking his advice about a libre / transparently-developed ASIC / SoC, f=
or some time, since meeting a very interesting person at the Barcelona RISC=
-V Workshop in 2018.<br><br>this person pointed out that FIPS-approved algo=
rithms, implemented in FIPS-approved crypto-chips used in hardware wallets =
to protect billions to trillions in cryptocurrency assets world-wide are ba=
sically asking for trouble.=C2=A0 i heard 3rd-hand that the constants used =
in the original bitcoin protocol were very deliberately changed from those =
approved by FIPS and the NSA for exactly the reasons that drive people to q=
uestion whether it is a good idea to trust closed and secretive crypto-chip=
s, no matter how well-intentioned the company that manufactures them.=C2=A0=
 the person i met was there to &quot;sound out&quot; interested parties wil=
ling to help with such a venture, even to the extent of actually buying a F=
oundry, in order to guarantee that the crypto-chip they would like to see m=
ade had not been tampered with at any point during manufacturing.<br><br>at=
 FOSDEM2019 i was also approached by a team that also wanted to do a basic =
&quot;embedded&quot; processor, entirely libre-licensed, only in 350nm or 1=
80nm, with just enough horsepower to do digital signing and so on.=C2=A0 si=
nce then, fascinatingly, NLnet has obtained a new EU Horizon Grant and star=
ted their &quot;Assure&quot; Programme:<br><a href=3D"https://nlnet.nl/assu=
re/">https://nlnet.nl/assure/</a><br><br>(our application may be found here=
):<br><a href=3D"https://libre-soc.org/nlnet_2021_crypto_router/">https://l=
ibre-soc.org/nlnet_2021_crypto_router/</a><br><br>in addition, betrusted (h=
eaded by Bunnie Huang) is also funded by NLnet and is along similar lines:<=
br><a href=3D"https://betrusted.io/">https://betrusted.io/</a><br><br>NLnet=
 is even funding LibreSOC with a 180nm test chip tape-out of the LibreSOC C=
ore, with help from Sorbonne University and <a href=3D"https://chips4makers=
.io">https://chips4makers.io</a><br><a href=3D"https://bugs.libre-soc.org/s=
how_bug.cgi?id=3D199">https://bugs.libre-soc.org/show_bug.cgi?id=3D199</a><=
br><br>and we also have funding to do Formal Correctness Proofs for the low=
-level portions of the HDL (similar to c++ and python &quot;assert&quot;, b=
ut for hardware)<br><a href=3D"https://bugs.libre-soc.org/show_bug.cgi?id=
=3D158">https://bugs.libre-soc.org/show_bug.cgi?id=3D158</a><br><br>the poi=
nt being that where even one year ago the idea of an open source developer =
creating and paying for an actual ASIC was so ridiculous they would be laug=
hed at and viewed in a derisive fashion thereafter, reality is that things =
are opening up to the point where even Foundry PDKs are now open source:<br=
><a href=3D"https://github.com/google/skywater-pdk">https://github.com/goog=
le/skywater-pdk</a><br><br>technically it is possible to use Open Hardware =
to create commercial (closed) products.=C2=A0 Richard Herveille, most well-=
known for his early involvement in Opencores, was the Open Hardware develop=
er responsible for the HDL behind the first Antminer product by Bitmain, fo=
r example.=C2=A0 It used his RV32 core and i believe he also developed the =
SHA256 HDL for them.=C2=A0 however that is different in that it was a close=
d product, not open for independent public audit and review.<br><br>what i =
am therefore trying to say is that it is a genuinely achievable goal, now, =
to create fully transparently-openly-developed ASICs that could perform cry=
tographic tasks such as mining and hardware wallet key protection *and have=
 a full audit trail* even to the extent of having mathematical Formal Corre=
ctness Proofs.<br><br>my question is - therefore - with all that background=
 in mind - is: is this something that is of interest?<br><br>now, before ge=
tting all excited about the possibilities, it&#39;s critically important to=
 provide a reality-check on the costs involved:<br><br>* 350nm ASICs: <a hr=
ef=3D"https://chips4makers.io">https://chips4makers.io</a> - EUR 1750 for 2=
0 samples<br>* 180nm ASICs: EUR $600 per mm^2 MPW Shuttle (test ASICs) and =
EUR 50,000 for production masks<br>* ... exponential curve going through 13=
0nm, 65nm, 45nm gets to around $500k...<br>* 28nm ASICs: USD 100,000 for MP=
W and USD $1 million for production masks<br>* 22nm ASICs: double 28nm<br>*=
 14nm: double 22nm<br>* 7nm: quadruple 14nm<br><br>you get where that is go=
ing.=C2=A0 where higher geometries are now easily within reach even of a ho=
bbyist ASIC developer, USD 20 million is a bare minimum to design, develop =
and bring to manufacture a 7nm Custom ASIC.=C2=A0 full-custom silicon, as c=
arried out regularly by Intel, is USD 100 million.<br><br>this is not to sa=
y that it is completely outside the realm of possibility to do something in=
 these lower geometries: you either simply have to have a damn good reason,=
 or a hell of a lot of money, or a product that&#39;s so compelling that cu=
stomers really *really* want it, or you have OEMs lining up to sign LOIs or=
 put up cash-with-preorder.<br><br>[my personal favourite is a focus on pow=
er-efficiency: battery-operated hand-held devices at or below 3.5 watts (th=
us not requiring thermal pipes or fans - which tend to break). i have to ad=
mit i am a little alarmed at the world-wide energy consumption of bitcoin: =
personally i would very much prefer to be involved in eco-conscious blockch=
ain and crypto-currency products].<br><br>so - as an open question: what wo=
uld people really like to see happen, here, what do people feel would be of=
 interest to the wider bitcoin community, and, crucially, is there a realis=
tic way to bridge (fund) the gap and actually deliver to the bitcoin user c=
ommunity?<br><br>best,<br><br>l.<br><br>---<br>crowd-funded eco-conscious h=
ardware: <a href=3D"https://www.crowdsupply.com/eoma68">https://www.crowdsu=
pply.com/eoma68</a><br><br><br>-- <br>---<br>crowd-funded eco-conscious har=
dware: <a href=3D"https://www.crowdsupply.com/eoma68" target=3D"_blank">htt=
ps://www.crowdsupply.com/eoma68</a><br><br>

--000000000000990b7405b9bd50e5--