a12c0d0a65b27932ea6d5014407aead85201c08b
3 * Generate `strong' prime numbers
5 * (c) 1999 Straylight/Edgeware
8 /*----- Licensing notice --------------------------------------------------*
10 * This file is part of Catacomb.
12 * Catacomb is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU Library General Public License as
14 * published by the Free Software Foundation; either version 2 of the
15 * License, or (at your option) any later version.
17 * Catacomb is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU Library General Public License for more details.
22 * You should have received a copy of the GNU Library General Public
23 * License along with Catacomb; if not, write to the Free
24 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
28 /*----- Header files ------------------------------------------------------*/
30 #include <mLib/dstr.h>
40 /*----- Main code ---------------------------------------------------------*/
42 /* --- @strongprime_setup@ --- *
44 * Arguments: @const char *name@ = pointer to name root
45 * @mp *d@ = destination for search start point
46 * @pfilt *f@ = where to store filter jump context
47 * @unsigned nbits@ = number of bits wanted
48 * @grand *r@ = random number source
49 * @unsigned n@ = number of attempts to make
50 * @pgen_proc *event@ = event handler function
51 * @void *ectx@ = argument for the event handler
53 * Returns: A starting point for a `strong' prime search, or zero.
55 * Use: Sets up for a strong prime search, so that primes with
56 * particular properties can be found. It's probably important
57 * to note that the number left in the filter context @f@ is
58 * congruent to 2 (mod 4); that the jump value is twice the
59 * product of two large primes; and that the starting point is
60 * at least %$3 \cdot 2^{N-2}$%. (Hence, if you multiply two
61 * such numbers, the product is at least
63 * %$9 \cdot 2^{2N-4} > 2^{2N-1}$%
65 * i.e., it will be (at least) a %$2 N$%-bit value.
68 mp
*strongprime_setup(const char *name
, mp
*d
, pfilt
*f
, unsigned nbits
,
69 grand
*r
, unsigned n
, pgen_proc
*event
, void *ectx
)
73 unsigned slop
, nb
, u
, i
;
80 /* --- Figure out how large the smaller primes should be --- *
82 * We want them to be `as large as possible', subject to the constraint
83 * that we produce a number of the requested size at the end. This is
84 * tricky, because the final prime search is going to involve quite large
85 * jumps from its starting point; the size of the jumps are basically
86 * determined by our choice here, and if they're too big then we won't find
89 * Let's suppose we're trying to make an %$N$%-bit prime. The expected
90 * number of steps tends to increase linearly with size, i.e., we need to
91 * take about %2^k N$% steps for some %$k$%. If we're jumping by a
92 * %$J$%-bit quantity each time, from an %$N$%-bit starting point, then we
93 * will only be able to find a match if %$2^k N 2^{J-1} \le 2^{N-1}$%,
94 * i.e., if %$J \le N - (k + \log_2 N)$%.
96 * Experimentation shows that taking %$k + \log_2 N = 12$% works well for
97 * %$N = 1024$%, so %$k = 2$%. Add a few extra bits for luck.
100 for (i
= 1; i
&& nbits
>> i
; i
<<= 1); assert(i
);
101 for (slop
= 6, nb
= nbits
; nb
> 1; i
>>= 1) {
103 if (u
) { slop
+= i
; nb
= u
; }
105 if (nbits
/2 <= slop
) return (0);
107 /* --- Choose two primes %$s$% and %$t$% of half the required size --- */
112 rr
= mprand(rr
, nb
, r
, 1);
113 DRESET(&dn
); dstr_putf(&dn
, "%s [s]", name
);
114 if ((s
= pgen(dn
.buf
, MP_NEWSEC
, rr
, event
, ectx
, n
, pgen_filter
, &c
,
115 rabin_iters(nb
), pgen_test
, &rb
)) == 0)
118 rr
= mprand(rr
, nb
, r
, 1);
119 DRESET(&dn
); dstr_putf(&dn
, "%s [t]", name
);
120 if ((t
= pgen(dn
.buf
, MP_NEWSEC
, rr
, event
, ectx
, n
, pgen_filter
, &c
,
121 rabin_iters(nb
), pgen_test
, &rb
)) == 0)
124 /* --- Choose a suitable value for %$r = 2it + 1$% for some %$i$% --- *
126 * Then %$r \equiv 1 \pmod{t}$%, i.e., %$r - 1$% is a multiple of %$t$%.
129 rr
= mp_lsl(rr
, t
, 1);
130 pfilt_create(&c
.f
, rr
);
131 rr
= mp_lsl(rr
, rr
, slop
- 1);
132 rr
= mp_add(rr
, rr
, MP_ONE
);
133 DRESET(&dn
); dstr_putf(&dn
, "%s [r]", name
);
135 q
= pgen(dn
.buf
, MP_NEW
, rr
, event
, ectx
, n
, pgen_jump
, &j
,
136 rabin_iters(nb
+ slop
), pgen_test
, &rb
);
141 /* --- Select a suitable congruence class for %$p$% --- *
143 * This computes %$p_0 = 2 s (s^{-1} \bmod r) - 1$%. Then %$p_0 + 1$% is
144 * clearly a multiple of %$s$%, and
146 * %$p_0 - 1 \equiv 2 s s^{-1} - 2 \equiv 0 \pmod{r}$%
148 * is a multiple of %$r$%.
151 rr
= mp_modinv(rr
, s
, q
);
152 rr
= mp_mul(rr
, rr
, s
);
153 rr
= mp_lsl(rr
, rr
, 1);
154 rr
= mp_sub(rr
, rr
, MP_ONE
);
156 /* --- Pick a starting point for the search --- *
158 * Select %$3 \cdot 2^{N-2} < p_1 < 2^N$% at random, only with
159 * %$p_1 \equiv p_0 \pmod{2 r s}$.
164 x
= mp_mul(MP_NEW
, q
, s
);
166 pfilt_create(f
, x
); /* %$2 r s$% */
167 y
= mprand(MP_NEW
, nbits
, r
, 0);
168 y
= mp_setbit(y
, y
, nbits
- 2);
169 rr
= mp_leastcongruent(rr
, y
, rr
, x
);
170 mp_drop(x
); mp_drop(y
);
173 /* --- Return the result --- */
181 /* --- Tidy up if something failed --- */
193 /* --- @strongprime@ --- *
195 * Arguments: @const char *name@ = pointer to name root
196 * @mp *d@ = destination integer
197 * @unsigned nbits@ = number of bits wanted
198 * @grand *r@ = random number source
199 * @unsigned n@ = number of attempts to make
200 * @pgen_proc *event@ = event handler function
201 * @void *ectx@ = argument for the event handler
203 * Returns: A `strong' prime, or zero.
205 * Use: Finds `strong' primes. A strong prime %$p$% is such that
207 * * %$p - 1$% has a large prime factor %$r$%,
208 * * %$p + 1$% has a large prime factor %$s$%, and
209 * * %$r - 1$% has a large prime factor %$t$%.
212 mp
*strongprime(const char *name
, mp
*d
, unsigned nbits
, grand
*r
,
213 unsigned n
, pgen_proc
*event
, void *ectx
)
221 p
= strongprime_setup(name
, d
, &f
, nbits
, r
, n
, event
, ectx
);
222 if (!p
) { mp_drop(d
); return (0); }
224 p
= pgen(name
, p
, p
, event
, ectx
, n
, pgen_jump
, &j
,
225 rabin_iters(nbits
), pgen_test
, &rb
);
226 if (mp_bits(p
) != nbits
) { mp_drop(p
); return (0); }
232 /*----- That's all, folks -------------------------------------------------*/