tommath/bn_mp_sqrtmod_prime.c

125 lines
4.7 KiB
C
Raw Normal View History

#include "tommath_private.h"
2015-04-17 16:46:11 -04:00
#ifdef BN_MP_SQRTMOD_PRIME_C
/* LibTomMath, multiple-precision integer library -- Tom St Denis
*
* LibTomMath is a library that provides multiple-precision
* integer arithmetic as well as number theoretic functionality.
*
* The library is free for all purposes without any express
* guarantee it works.
*/
/* Tonelli-Shanks algorithm
* https://en.wikipedia.org/wiki/Tonelli%E2%80%93Shanks_algorithm
* https://gmplib.org/list-archives/gmp-discuss/2013-April/005300.html
*
*/
2017-09-20 10:59:43 -04:00
int mp_sqrtmod_prime(const mp_int *n, const mp_int *prime, mp_int *ret)
2015-04-17 16:46:11 -04:00
{
2017-08-30 13:13:53 -04:00
int res, legendre;
mp_int t1, C, Q, S, Z, M, T, R, two;
mp_digit i;
2015-04-17 16:46:11 -04:00
2017-08-30 13:13:53 -04:00
/* first handle the simple cases */
2017-10-15 10:11:09 -04:00
if (mp_cmp_d(n, 0uL) == MP_EQ) {
2017-08-30 13:13:53 -04:00
mp_zero(ret);
return MP_OKAY;
}
2017-10-15 10:11:09 -04:00
if (mp_cmp_d(prime, 2uL) == MP_EQ) return MP_VAL; /* prime must be odd */
2017-08-30 13:13:53 -04:00
if ((res = mp_jacobi(n, prime, &legendre)) != MP_OKAY) return res;
if (legendre == -1) return MP_VAL; /* quadratic non-residue mod prime */
2015-04-17 16:46:11 -04:00
2017-08-30 13:13:53 -04:00
if ((res = mp_init_multi(&t1, &C, &Q, &S, &Z, &M, &T, &R, &two, NULL)) != MP_OKAY) {
return res;
}
2015-04-17 16:46:11 -04:00
2017-08-30 13:13:53 -04:00
/* SPECIAL CASE: if prime mod 4 == 3
* compute directly: res = n^(prime+1)/4 mod prime
* Handbook of Applied Cryptography algorithm 3.36
*/
2017-10-15 10:11:09 -04:00
if ((res = mp_mod_d(prime, 4uL, &i)) != MP_OKAY) goto cleanup;
2017-10-15 13:57:12 -04:00
if (i == 3u) {
2017-10-15 10:11:09 -04:00
if ((res = mp_add_d(prime, 1uL, &t1)) != MP_OKAY) goto cleanup;
2017-08-30 13:13:53 -04:00
if ((res = mp_div_2(&t1, &t1)) != MP_OKAY) goto cleanup;
if ((res = mp_div_2(&t1, &t1)) != MP_OKAY) goto cleanup;
if ((res = mp_exptmod(n, &t1, prime, ret)) != MP_OKAY) goto cleanup;
res = MP_OKAY;
goto cleanup;
}
2015-04-17 16:46:11 -04:00
2017-08-30 13:13:53 -04:00
/* NOW: Tonelli-Shanks algorithm */
2015-04-17 16:46:11 -04:00
2017-08-30 13:13:53 -04:00
/* factor out powers of 2 from prime-1, defining Q and S as: prime-1 = Q*2^S */
if ((res = mp_copy(prime, &Q)) != MP_OKAY) goto cleanup;
2017-10-15 10:11:09 -04:00
if ((res = mp_sub_d(&Q, 1uL, &Q)) != MP_OKAY) goto cleanup;
2017-08-30 13:13:53 -04:00
/* Q = prime - 1 */
mp_zero(&S);
/* S = 0 */
while (mp_iseven(&Q) != MP_NO) {
if ((res = mp_div_2(&Q, &Q)) != MP_OKAY) goto cleanup;
/* Q = Q / 2 */
2017-10-15 10:11:09 -04:00
if ((res = mp_add_d(&S, 1uL, &S)) != MP_OKAY) goto cleanup;
2017-08-30 13:13:53 -04:00
/* S = S + 1 */
}
2015-04-17 16:46:11 -04:00
2017-08-30 13:13:53 -04:00
/* find a Z such that the Legendre symbol (Z|prime) == -1 */
2017-10-15 13:57:12 -04:00
if ((res = mp_set_int(&Z, 2uL)) != MP_OKAY) goto cleanup;
2017-08-30 13:13:53 -04:00
/* Z = 2 */
while (1) {
if ((res = mp_jacobi(&Z, prime, &legendre)) != MP_OKAY) goto cleanup;
if (legendre == -1) break;
2017-10-15 10:11:09 -04:00
if ((res = mp_add_d(&Z, 1uL, &Z)) != MP_OKAY) goto cleanup;
2017-08-30 13:13:53 -04:00
/* Z = Z + 1 */
}
2015-04-17 16:46:11 -04:00
2017-08-30 13:13:53 -04:00
if ((res = mp_exptmod(&Z, &Q, prime, &C)) != MP_OKAY) goto cleanup;
/* C = Z ^ Q mod prime */
2017-10-15 10:11:09 -04:00
if ((res = mp_add_d(&Q, 1uL, &t1)) != MP_OKAY) goto cleanup;
2017-08-30 13:13:53 -04:00
if ((res = mp_div_2(&t1, &t1)) != MP_OKAY) goto cleanup;
/* t1 = (Q + 1) / 2 */
if ((res = mp_exptmod(n, &t1, prime, &R)) != MP_OKAY) goto cleanup;
/* R = n ^ ((Q + 1) / 2) mod prime */
if ((res = mp_exptmod(n, &Q, prime, &T)) != MP_OKAY) goto cleanup;
/* T = n ^ Q mod prime */
if ((res = mp_copy(&S, &M)) != MP_OKAY) goto cleanup;
/* M = S */
2017-10-15 13:57:12 -04:00
if ((res = mp_set_int(&two, 2uL)) != MP_OKAY) goto cleanup;
2015-04-17 16:46:11 -04:00
2017-08-30 13:13:53 -04:00
res = MP_VAL;
while (1) {
if ((res = mp_copy(&T, &t1)) != MP_OKAY) goto cleanup;
i = 0;
while (1) {
2017-10-15 10:11:09 -04:00
if (mp_cmp_d(&t1, 1uL) == MP_EQ) break;
2017-08-30 13:13:53 -04:00
if ((res = mp_exptmod(&t1, &two, prime, &t1)) != MP_OKAY) goto cleanup;
i++;
}
2017-10-15 13:57:12 -04:00
if (i == 0u) {
2017-08-30 13:13:53 -04:00
if ((res = mp_copy(&R, ret)) != MP_OKAY) goto cleanup;
res = MP_OKAY;
goto cleanup;
}
if ((res = mp_sub_d(&M, i, &t1)) != MP_OKAY) goto cleanup;
2017-10-15 10:11:09 -04:00
if ((res = mp_sub_d(&t1, 1uL, &t1)) != MP_OKAY) goto cleanup;
2017-08-30 13:13:53 -04:00
if ((res = mp_exptmod(&two, &t1, prime, &t1)) != MP_OKAY) goto cleanup;
/* t1 = 2 ^ (M - i - 1) */
if ((res = mp_exptmod(&C, &t1, prime, &t1)) != MP_OKAY) goto cleanup;
/* t1 = C ^ (2 ^ (M - i - 1)) mod prime */
if ((res = mp_sqrmod(&t1, prime, &C)) != MP_OKAY) goto cleanup;
/* C = (t1 * t1) mod prime */
if ((res = mp_mulmod(&R, &t1, prime, &R)) != MP_OKAY) goto cleanup;
/* R = (R * t1) mod prime */
if ((res = mp_mulmod(&T, &C, prime, &T)) != MP_OKAY) goto cleanup;
/* T = (T * C) mod prime */
mp_set(&M, i);
/* M = i */
}
2015-04-17 16:46:11 -04:00
cleanup:
2017-08-30 13:13:53 -04:00
mp_clear_multi(&t1, &C, &Q, &S, &Z, &M, &T, &R, &two, NULL);
return res;
2015-04-17 16:46:11 -04:00
}
#endif