bn_sqrt.c 9.8 KB
Newer Older
N
Nils Larsch 已提交
1
/* crypto/bn/bn_sqrt.c */
B
BN_sqrt  
Bodo Möller 已提交
2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72
/* Written by Lenka Fibikova <fibikova@exp-math.uni-essen.de>
 * and Bodo Moeller for the OpenSSL project. */
/* ====================================================================
 * Copyright (c) 1998-2000 The OpenSSL Project.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer. 
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. All advertising materials mentioning features or use of this
 *    software must display the following acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
 *
 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission. For written permission, please contact
 *    openssl-core@openssl.org.
 *
 * 5. Products derived from this software may not be called "OpenSSL"
 *    nor may "OpenSSL" appear in their names without prior written
 *    permission of the OpenSSL Project.
 *
 * 6. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by the OpenSSL Project
 *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
 *
 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 * ====================================================================
 *
 * This product includes cryptographic software written by Eric Young
 * (eay@cryptsoft.com).  This product includes software written by Tim
 * Hudson (tjh@cryptsoft.com).
 *
 */

#include "cryptlib.h"
#include "bn_lcl.h"


BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) 
/* Returns 'ret' such that
 *      ret^2 == a (mod p),
 * using the Tonelli/Shanks algorithm (cf. Henri Cohen, "A Course
 * in Algebraic Computational Number Theory", algorithm 1.5.1).
 * 'p' must be prime!
 */
	{
	BIGNUM *ret = in;
	int err = 1;
	int r;
73
	BIGNUM *A, *b, *q, *t, *x, *y;
B
BN_sqrt  
Bodo Möller 已提交
74 75 76 77 78 79 80 81 82 83 84 85
	int e, i, j;
	
	if (!BN_is_odd(p) || BN_abs_is_word(p, 1))
		{
		if (BN_abs_is_word(p, 2))
			{
			if (ret == NULL)
				ret = BN_new();
			if (ret == NULL)
				goto end;
			if (!BN_set_word(ret, BN_is_bit_set(a, 0)))
				{
86 87
				if (ret != in)
					BN_free(ret);
B
BN_sqrt  
Bodo Möller 已提交
88 89
				return NULL;
				}
90
			bn_check_top(ret);
B
BN_sqrt  
Bodo Möller 已提交
91 92 93 94 95 96 97
			return ret;
			}

		BNerr(BN_F_BN_MOD_SQRT, BN_R_P_IS_NOT_PRIME);
		return(NULL);
		}

98 99 100 101 102 103 104 105
	if (BN_is_zero(a) || BN_is_one(a))
		{
		if (ret == NULL)
			ret = BN_new();
		if (ret == NULL)
			goto end;
		if (!BN_set_word(ret, BN_is_one(a)))
			{
106 107
			if (ret != in)
				BN_free(ret);
108 109
			return NULL;
			}
110
		bn_check_top(ret);
111 112 113
		return ret;
		}

B
BN_sqrt  
Bodo Möller 已提交
114
	BN_CTX_start(ctx);
115
	A = BN_CTX_get(ctx);
B
BN_sqrt  
Bodo Möller 已提交
116 117 118 119 120 121 122 123 124 125 126
	b = BN_CTX_get(ctx);
	q = BN_CTX_get(ctx);
	t = BN_CTX_get(ctx);
	x = BN_CTX_get(ctx);
	y = BN_CTX_get(ctx);
	if (y == NULL) goto end;
	
	if (ret == NULL)
		ret = BN_new();
	if (ret == NULL) goto end;

127 128 129
	/* A = a mod p */
	if (!BN_nnmod(A, a, p, ctx)) goto end;

B
BN_sqrt  
Bodo Möller 已提交
130 131 132 133
	/* now write  |p| - 1  as  2^e*q  where  q  is odd */
	e = 1;
	while (!BN_is_bit_set(p, e))
		e++;
B
Bodo Möller 已提交
134
	/* we'll set  q  later (if needed) */
B
BN_sqrt  
Bodo Möller 已提交
135 136 137

	if (e == 1)
		{
B
Bodo Möller 已提交
138 139
		/* The easy case:  (|p|-1)/2  is odd, so 2 has an inverse
		 * modulo  (|p|-1)/2,  and square roots can be computed
B
BN_sqrt  
Bodo Möller 已提交
140 141
		 * directly by modular exponentiation.
		 * We have
B
Bodo Möller 已提交
142 143
		 *     2 * (|p|+1)/4 == 1   (mod (|p|-1)/2),
		 * so we can use exponent  (|p|+1)/4,  i.e.  (|p|-3)/4 + 1.
B
BN_sqrt  
Bodo Möller 已提交
144
		 */
145
		if (!BN_rshift(q, p, 2)) goto end;
146
		q->neg = 0;
147
		if (!BN_add_word(q, 1)) goto end;
148
		if (!BN_mod_exp(ret, A, q, p, ctx)) goto end;
B
BN_sqrt  
Bodo Möller 已提交
149
		err = 0;
150
		goto vrfy;
B
BN_sqrt  
Bodo Möller 已提交
151 152
		}
	
153 154
	if (e == 2)
		{
B
Bodo Möller 已提交
155
		/* |p| == 5  (mod 8)
156 157 158 159 160
		 *
		 * In this case  2  is always a non-square since
		 * Legendre(2,p) = (-1)^((p^2-1)/8)  for any odd prime.
		 * So if  a  really is a square, then  2*a  is a non-square.
		 * Thus for
B
Bodo Möller 已提交
161
		 *      b := (2*a)^((|p|-5)/8),
162 163
		 *      i := (2*a)*b^2
		 * we have
B
Bodo Möller 已提交
164
		 *     i^2 = (2*a)^((1 + (|p|-5)/4)*2)
165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181
		 *         = (2*a)^((p-1)/2)
		 *         = -1;
		 * so if we set
		 *      x := a*b*(i-1),
		 * then
		 *     x^2 = a^2 * b^2 * (i^2 - 2*i + 1)
		 *         = a^2 * b^2 * (-2*i)
		 *         = a*(-i)*(2*a*b^2)
		 *         = a*(-i)*i
		 *         = a.
		 *
		 * (This is due to A.O.L. Atkin, 
		 * <URL: http://listserv.nodak.edu/scripts/wa.exe?A2=ind9211&L=nmbrthry&O=T&P=562>,
		 * November 1992.)
		 */

		/* t := 2*a */
182
		if (!BN_mod_lshift1_quick(t, A, p)) goto end;
183

B
Bodo Möller 已提交
184
		/* b := (2*a)^((|p|-5)/8) */
185
		if (!BN_rshift(q, p, 3)) goto end;
186
		q->neg = 0;
187 188 189 190 191 192 193
		if (!BN_mod_exp(b, t, q, p, ctx)) goto end;

		/* y := b^2 */
		if (!BN_mod_sqr(y, b, p, ctx)) goto end;

		/* t := (2*a)*b^2 - 1*/
		if (!BN_mod_mul(t, t, y, p, ctx)) goto end;
B
Bodo Möller 已提交
194
		if (!BN_sub_word(t, 1)) goto end;
195 196

		/* x = a*b*t */
197
		if (!BN_mod_mul(x, A, b, p, ctx)) goto end;
198 199 200 201
		if (!BN_mod_mul(x, x, t, p, ctx)) goto end;

		if (!BN_copy(ret, x)) goto end;
		err = 0;
202
		goto vrfy;
203 204 205
		}
	
	/* e > 2, so we really have to use the Tonelli/Shanks algorithm.
B
BN_sqrt  
Bodo Möller 已提交
206
	 * First, find some  y  that is not a square. */
B
Bodo Möller 已提交
207 208
	if (!BN_copy(q, p)) goto end; /* use 'q' as temp */
	q->neg = 0;
209
	i = 2;
B
BN_sqrt  
Bodo Möller 已提交
210 211 212 213 214
	do
		{
		/* For efficiency, try small numbers first;
		 * if this fails, try random numbers.
		 */
215
		if (i < 22)
B
BN_sqrt  
Bodo Möller 已提交
216 217 218 219 220 221 222 223 224 225 226 227 228 229 230
			{
			if (!BN_set_word(y, i)) goto end;
			}
		else
			{
			if (!BN_pseudo_rand(y, BN_num_bits(p), 0, 0)) goto end;
			if (BN_ucmp(y, p) >= 0)
				{
				if (!(p->neg ? BN_add : BN_sub)(y, y, p)) goto end;
				}
			/* now 0 <= y < |p| */
			if (BN_is_zero(y))
				if (!BN_set_word(y, i)) goto end;
			}
		
B
Bodo Möller 已提交
231
		r = BN_kronecker(y, q, ctx); /* here 'q' is |p| */
B
BN_sqrt  
Bodo Möller 已提交
232 233 234 235 236 237 238 239
		if (r < -1) goto end;
		if (r == 0)
			{
			/* m divides p */
			BNerr(BN_F_BN_MOD_SQRT, BN_R_P_IS_NOT_PRIME);
			goto end;
			}
		}
240
	while (r == 1 && ++i < 82);
B
BN_sqrt  
Bodo Möller 已提交
241 242 243 244 245 246 247 248 249 250 251 252
	
	if (r != -1)
		{
		/* Many rounds and still no non-square -- this is more likely
		 * a bug than just bad luck.
		 * Even if  p  is not prime, we should have found some  y
		 * such that r == -1.
		 */
		BNerr(BN_F_BN_MOD_SQRT, BN_R_TOO_MANY_ITERATIONS);
		goto end;
		}

B
Bodo Möller 已提交
253 254
	/* Here's our actual 'q': */
	if (!BN_rshift(q, q, e)) goto end;
B
BN_sqrt  
Bodo Möller 已提交
255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288

	/* Now that we have some non-square, we can find an element
	 * of order  2^e  by computing its q'th power. */
	if (!BN_mod_exp(y, y, q, p, ctx)) goto end;
	if (BN_is_one(y))
		{
		BNerr(BN_F_BN_MOD_SQRT, BN_R_P_IS_NOT_PRIME);
		goto end;
		}

	/* Now we know that (if  p  is indeed prime) there is an integer
	 * k,  0 <= k < 2^e,  such that
	 *
	 *      a^q * y^k == 1   (mod p).
	 *
	 * As  a^q  is a square and  y  is not,  k  must be even.
	 * q+1  is even, too, so there is an element
	 *
	 *     X := a^((q+1)/2) * y^(k/2),
	 *
	 * and it satisfies
	 *
	 *     X^2 = a^q * a     * y^k
	 *         = a,
	 *
	 * so it is the square root that we are looking for.
	 */
	
	/* t := (q-1)/2  (note that  q  is odd) */
	if (!BN_rshift1(t, q)) goto end;
	
	/* x := a^((q-1)/2) */
	if (BN_is_zero(t)) /* special case: p = 2^e + 1 */
		{
289
		if (!BN_nnmod(t, A, p, ctx)) goto end;
B
BN_sqrt  
Bodo Möller 已提交
290 291 292
		if (BN_is_zero(t))
			{
			/* special case: a == 0  (mod p) */
293
			BN_zero(ret);
B
BN_sqrt  
Bodo Möller 已提交
294 295 296 297 298 299 300 301
			err = 0;
			goto end;
			}
		else
			if (!BN_one(x)) goto end;
		}
	else
		{
302
		if (!BN_mod_exp(x, A, t, p, ctx)) goto end;
B
BN_sqrt  
Bodo Möller 已提交
303 304 305
		if (BN_is_zero(x))
			{
			/* special case: a == 0  (mod p) */
306
			BN_zero(ret);
B
BN_sqrt  
Bodo Möller 已提交
307 308 309 310 311 312 313
			err = 0;
			goto end;
			}
		}

	/* b := a*x^2  (= a^q) */
	if (!BN_mod_sqr(b, x, p, ctx)) goto end;
314
	if (!BN_mod_mul(b, b, A, p, ctx)) goto end;
B
BN_sqrt  
Bodo Möller 已提交
315 316
	
	/* x := a*x    (= a^((q+1)/2)) */
317
	if (!BN_mod_mul(x, x, A, p, ctx)) goto end;
B
BN_sqrt  
Bodo Möller 已提交
318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333

	while (1)
		{
		/* Now  b  is  a^q * y^k  for some even  k  (0 <= k < 2^E
		 * where  E  refers to the original value of  e,  which we
		 * don't keep in a variable),  and  x  is  a^((q+1)/2) * y^(k/2).
		 *
		 * We have  a*b = x^2,
		 *    y^2^(e-1) = -1,
		 *    b^2^(e-1) = 1.
		 */

		if (BN_is_one(b))
			{
			if (!BN_copy(ret, x)) goto end;
			err = 0;
334
			goto vrfy;
B
BN_sqrt  
Bodo Möller 已提交
335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364
			}


		/* find smallest  i  such that  b^(2^i) = 1 */
		i = 1;
		if (!BN_mod_sqr(t, b, p, ctx)) goto end;
		while (!BN_is_one(t))
			{
			i++;
			if (i == e)
				{
				BNerr(BN_F_BN_MOD_SQRT, BN_R_NOT_A_SQUARE);
				goto end;
				}
			if (!BN_mod_mul(t, t, t, p, ctx)) goto end;
			}
		

		/* t := y^2^(e - i - 1) */
		if (!BN_copy(t, y)) goto end;
		for (j = e - i - 1; j > 0; j--)
			{
			if (!BN_mod_sqr(t, t, p, ctx)) goto end;
			}
		if (!BN_mod_mul(y, t, t, p, ctx)) goto end;
		if (!BN_mod_mul(x, x, t, p, ctx)) goto end;
		if (!BN_mod_mul(b, b, y, p, ctx)) goto end;
		e = i;
		}

365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380
 vrfy:
	if (!err)
		{
		/* verify the result -- the input might have been not a square
		 * (test added in 0.9.8) */
		
		if (!BN_mod_sqr(x, ret, p, ctx))
			err = 1;
		
		if (!err && 0 != BN_cmp(x, A))
			{
			BNerr(BN_F_BN_MOD_SQRT, BN_R_NOT_A_SQUARE);
			err = 1;
			}
		}

B
BN_sqrt  
Bodo Möller 已提交
381 382 383 384 385 386 387 388 389 390
 end:
	if (err)
		{
		if (ret != NULL && ret != in)
			{
			BN_clear_free(ret);
			}
		ret = NULL;
		}
	BN_CTX_end(ctx);
391
	bn_check_top(ret);
B
BN_sqrt  
Bodo Möller 已提交
392 393
	return ret;
	}