3 * $Id: mp-modsqrt.c,v 1.1 2000/06/22 19:01:31 mdw Exp $
5 * Compute square roots modulo a prime
7 * (c) 2000 Straylight/Edgeware
10 /*----- Licensing notice --------------------------------------------------*
12 * This file is part of Catacomb.
14 * Catacomb is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU Library General Public License as
16 * published by the Free Software Foundation; either version 2 of the
17 * License, or (at your option) any later version.
19 * Catacomb is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU Library General Public License for more details.
24 * You should have received a copy of the GNU Library General Public
25 * License along with Catacomb; if not, write to the Free
26 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
30 /*----- Revision history --------------------------------------------------*
32 * $Log: mp-modsqrt.c,v $
33 * Revision 1.1 2000/06/22 19:01:31 mdw
34 * Compute square roots in a prime field.
38 /*----- Header files ------------------------------------------------------*/
46 /*----- Main code ---------------------------------------------------------*/
48 /* --- @mp_modsqrt@ --- *
50 * Arguments: @mp *d@ = destination integer
51 * @mp *a@ = source integer
52 * @mp *p@ = modulus (must be prime)
54 * Returns: If %$a$% is a quadratic residue, a square root of %$a$%; else
57 * Use: Returns an integer %$x$% such that %$x^2 \equiv a \pmod{p}$%,
58 * if one exists; else a null pointer. This function will not
59 * work if %$p$% is composite: you must factor the modulus, take
60 * a square root mod each factor, and recombine the results
61 * using the Chinese Remainder Theorem.
64 mp *mp_modsqrt(mp *d, mp *a, mp *p)
75 /* --- Cope if %$a \not\in Q_p$% --- */
77 if (mp_jacobi(a, p) != 1) {
83 /* --- Choose some quadratic non-residue --- */
86 grand *g = fibrand_create(0);
90 b = mprand_range(b, p, g, 0);
91 while (mp_jacobi(b, p) != -1);
95 /* --- Find the inverse of %$a$% --- */
98 mp_gcd(0, &ainv, 0, a, p);
100 /* --- Split %$p - 1$% into a power of two and an odd number --- */
102 t = mp_sub(MP_NEW, p, MP_ONE);
103 t = mp_odd(t, t, &s);
105 /* --- Now to really get going --- */
107 mpmont_create(&mm, p);
108 c = mpmont_expr(&mm, b, b, t);
109 t = mp_add(t, t, MP_ONE);
111 r = mpmont_expr(&mm, t, a, t);
112 ainv = mpmont_mul(&mm, ainv, ainv, mm.r2);
114 mone = mp_sub(MP_NEW, p, mm.r);
118 for (i = 1; i < s; i++) {
120 /* --- Compute %$d_0 = r^2a^{-1}$% --- */
123 dd = mpmont_reduce(&mm, dd, dd);
124 dd = mpmont_mul(&mm, dd, dd, ainv);
126 /* --- Now %$d = d_0^{s - i - 1}$% --- */
128 for (j = i; j < s - 1; j++) {
130 dd = mpmont_reduce(&mm, dd, dd);
133 /* --- Fiddle at the end --- */
135 if (MP_CMP(dd, ==, mone))
136 r = mpmont_mul(&mm, r, r, c);
138 c = mpmont_reduce(&mm, c, c);
141 /* --- Done, so tidy up --- */
143 d = mpmont_reduce(&mm, d, r);
145 mp_drop(r); mp_drop(c);
154 /*----- Test rig ----------------------------------------------------------*/
158 #include <mLib/testrig.h>
160 static int verify(dstr *v)
162 mp *a = *(mp **)v[0].buf;
163 mp *p = *(mp **)v[1].buf;
164 mp *rr = *(mp **)v[2].buf;
165 mp *r = mp_modsqrt(MP_NEW, a, p);
170 else if (MP_CMP(r, ==, rr))
174 if (MP_CMP(r, ==, rr))
179 fputs("\n*** fail\n", stderr);
180 fputs("a = ", stderr); mp_writefile(a, stderr, 10); fputc('\n', stderr);
181 fputs("p = ", stderr); mp_writefile(p, stderr, 10); fputc('\n', stderr);
183 fputs("r = ", stderr);
184 mp_writefile(r, stderr, 10);
187 fputs("r = <undef>\n", stderr);
188 fputs("rr = ", stderr); mp_writefile(rr, stderr, 10); fputc('\n', stderr);
197 assert(mparena_count(MPARENA_GLOBAL) == 0);
201 static test_chunk tests[] = {
202 { "modsqrt", verify, { &type_mp, &type_mp, &type_mp, 0 } },
206 int main(int argc, char *argv[])
209 test_run(argc, argv, tests, SRCDIR "/tests/mp");
215 /*----- That's all, folks -------------------------------------------------*/