kryptools 0.1__py3-none-any.whl

kryptools/factor_ecm.py

@@ -0,0 +1,140 @@
+"""
+Integer factorization: Lentra's ECM
+"""
+
+from math import gcd, isqrt, log
+from random import randint, seed
+from .primes import sieve_eratosthenes
+
+# Crandall and Pomerance: Primes (doi=10.1007/0-387-28979-8)
+# Algorithm 7.2.7
+
+
+def dbl(P, c2, p):
+    # c2 = c - 2
+    t1 = (P[0] + P[1]) % p
+    t2 = (P[0] - P[1]) % p
+    t3 = P[0] * P[1] % p
+    return pow(t1 * t2, 2, p), ((t1 * t1 + c2 * t3) % p) * 4 * t3 % p
+
+
+def add(P1, P2, P3, p):
+    t1 = pow(P1[0] * P2[0] - P1[1] * P2[1], 2, p)
+    t2 = pow(P1[0] * P2[1] - P2[0] * P1[1], 2, p)
+    return P3[1] * t1 % p, P3[0] * t2 % p
+
+
+def mult(k, P, c2, p):
+    if k == 1:
+        return P
+    if k == 2:
+        return dbl(P, c2, p)
+    Q = dbl(P, c2, p)
+    R = P
+    for i in bin(k)[3:]:
+        if i == "1":
+            R = add(Q, R, P, p)
+            Q = dbl(Q, c2, p)
+        else:
+            Q = add(R, Q, P, p)
+            R = dbl(R, c2, p)
+    return R
+
+# Crandall and Pomerance: Primes (doi=10.1007/0-387-28979-8)
+# Algorithm 7.4.4 (Inversionless ECM)
+
+def _ecm_parameters(B1: int, B2: int = None, D: int = None, primes: tuple = None):
+    "Precompute parameters for the ECM method."
+
+    # Stage-one/two limits must be even
+    B1 += B1 & 1
+    if not B2:
+        B2 = 100 * B1
+    else:
+        B2 += B2 & 1
+    if not D:
+        D = isqrt(B2)
+    if not primes:
+        primes = sieve_eratosthenes(B1 - 1 + ((B2 - B1 + 1) // (2 * D) + 1) * 2 * D)
+
+    stage_one = 1
+    for p in primes:
+        if p > B1:
+            break
+        stage_one *= p**int(log(B1, p))
+
+    stage_two_deltas = {}
+    r = B1 - 1
+    stage_two_deltas[r] = []
+    for p in primes:
+        if p <= r:
+            continue
+        if p <= r + 2 * D:
+            stage_two_deltas[r].append((p - r) // 2)
+        else:
+            r += 2 * D
+            while p > r + 2 * D:
+                stage_two_deltas[r] = []
+                r += 2 * D
+            stage_two_deltas[r] = [(p - r) // 2]
+    return D, stage_one, stage_two_deltas
+
+
+def factor_ecm(n: int, B1: int = 11000, B2: int = 1900000, curves: int = 74, ecm_parameters: tuple = None):
+    "Factors a number n using Lentsta's ECM method."    
+
+    if ecm_parameters:
+        curves, D, stage_one, stage_two_deltas = ecm_parameters
+    else:
+        D, stage_one, stage_two_deltas = _ecm_parameters(B1, B2)
+
+    for _ in range(curves):
+        # find a random curve
+        sigma = randint(6, n - 1)
+        u = (sigma**2 - 5) % n
+        v = (4 * sigma) % n
+        try:
+            c = (pow(v - u, 3, n) * (3 * u + v) * pow(4 * u**3 * v, -1, n) - 2) % n
+        except:
+            m = gcd(4 * u**3 * v, n)
+            return m
+        c2 = c - 2 % n
+        # and a point on the curve (or its twist)
+        Q = (pow(u, 3, n), pow(v, 3, n))
+        # Stage one
+        Q = mult(stage_one, Q, c2, n)
+        if Q[1] == 0:
+            continue
+        g = gcd(Q[1], n)
+        if g > 1:
+            return g
+
+        # Stage two
+        S = [dbl(Q, c2, n)]
+        S.append(dbl(S[0], c2, n))
+
+        for i in range(2, D):
+            S.append(add(S[i - 1], S[0], S[i - 2], n))
+
+        beta = []
+        for i in range(D):
+            beta.append((S[i][0] * S[i][1]) % n)
+        g = 1
+        T = mult(B1 - 2 * D - 1, Q, c2, n)
+        R = mult(B1 - 1, Q, c2, n)
+        for r in range(B1 - 1, B2, 2 * D):
+            alpha = R[0] * R[1] % n
+            for delta in stage_two_deltas[r]:
+                g = g * ((R[0] - S[delta - 1][0]) * (R[1] + S[delta - 1][1]) - alpha + beta[delta - 1]) % n
+                if g == 0:
+                    break
+            if g == 0:
+                break
+            g =gcd(g,n)
+            if 1 < g:
+                return g
+            R, T = add(R, S[D - 1], T, n), R
+
+        g = gcd(g, n)
+        if 1 < g < n:
+            return g

kryptools/factor_pm1.py

@@ -0,0 +1,58 @@
+"""
+Integer factorization: Pollard's p-1 method
+"""
+
+from math import gcd, log
+from .primes import sieve_eratosthenes
+
+def _pm1_parameters(B1: int, B2: int = None, primes: tuple = None):
+    "Precompute parameters for the P-1 method."
+    if not B2:
+        B2 = 100 * B1
+    if not primes:
+        primes = sieve_eratosthenes(B2)
+
+    stage_one = 1
+    for p in primes:
+        if p > B1:
+            break
+        stage_one *= p**int(log(B1, p))
+
+    stage_two_deltas = []
+    for q in primes:
+        if q <= B1:
+            continue
+        if q > B2:
+            break
+        stage_two_deltas.append(q - p)
+
+    return stage_one, stage_two_deltas
+
+
+def factor_pm1(n: int, B1: int = 11000, B2: int = 1900000, x: int = 2, pm1_parameters: tuple = None):
+    "Factors a number n using Pollard's P-1 method."    
+
+    if pm1_parameters:
+        stage_one, stage_two_deltas = pm1_parameters
+    else:
+        stage_one, stage_two_deltas = _pm1_parameters(B1, B2)
+
+    g = gcd(pow(x, stage_one, n) - 1, n)
+    if 1 < g < n:
+        return g
+    k = 0
+    for d in stage_two_deltas:
+        saved = {}
+        if not d in saved:
+            y = pow(x, d, n)
+            saved[d] = y
+        x = (x * saved[d]) % n
+        k += 1
+        if k % 20 == 0:
+            g = gcd(x-1, n)
+            if 1 < g < n:
+                return g
+    g = gcd(x-1, n)
+    if 1 < g < n:
+        return g
+    return None

kryptools/factor_qs.py

@@ -0,0 +1,174 @@
+"""
+Integer factorization: Quadratic sieve
+"""
+
+from math import isqrt, gcd, sqrt, log, exp, ceil
+from .primes import sieve_eratosthenes
+from .nt import legendre_symbol, sqrt_mod
+
+def bytexor(a: bytearray, b: bytes) -> bytes:
+    """Xor the bytestring b to the bytearry a."""
+    for i in range(len(a)):
+        a[i] ^= b[i]
+
+
+def byteset(a: bytearray, i: int) -> bytes:
+    """Set the i'th bit in the bytearray a to 1."""
+    i1, i0 = divmod(i, 8)
+    a[i1] |= 2**i0
+
+
+def bytetest(a: bytes, i: int) -> bytes:
+    """Test if the i'th bit in the bytestring a is 1."""
+    i1, i0 = divmod(i, 8)
+    return (a[i1] & 2**i0) != 0
+
+
+def factor_qs(n: int) -> list:
+    """Find factors of n using the quadratic sieve."""
+    # first determine the bound B for the factorbase: Choosing B=p^(1/u) Canfield-Erdös-Pomerance gives us
+    # the expected running time |B|^2 u^u = u^(u+2) p^(2/u)/log(n). There is no explicit expression for the optimum, hence
+    # we use Newton
+    u = 2 * sqrt(log(n) / log(log(n)))  # asymptotic value
+    for _ in range(3):
+        u = (2 * log(n) + u * u * (2 + log(u))) / (
+            2 + 3 * u + 2 * u * log(u)
+        )  # Newton iteration
+    B = int(exp(log(n) / u))
+    # B = int(exp(0.5 * sqrt( log(n) * log(log(n)) )*( 1 + 1/log(log(n)) )))
+
+    factorbase = []
+    for p in sieve_eratosthenes(B):  # compute the factorbase
+        ls = legendre_symbol(n, p)
+        if ls == 0:  # we already found a factor;-)
+            if n == p:
+                return n
+            return p
+        if ls == 1:  # we only take primes such that n is quadratic residue
+            factorbase.append(p)
+    lf = len(factorbase)  # length of the factorbase (including -1)
+    lfb = ceil((lf+1) / 8)  # the number of bytes we need to store a relation
+
+    factorbase_log = [log(p) for p in factorbase]  # we add these up to test if a number will probably factor
+    factorbase_root = [0] * lf # compute the roots of n mod p
+    for i, p in enumerate(factorbase):
+        r1 = sqrt_mod(n, p)
+        assert r1 is not None # only quadratic residues
+        r2 = -r1 % p
+        if r1 == r2:
+            factorbase_root[i] = [ r1 ]
+        else:
+            factorbase_root[i] = [ r1, -r1 % p ]
+
+    m = isqrt(n - 1) + 1
+    d = m**2 - n
+    if d == 0: # Our number is a square
+        return m
+    m2 = 2 * m
+
+    relation_no = -1
+    relations = [None] * (lf + 1)  # here we will store the relations in case we found a B-smooth number
+    values = [None] * (lf + 1)  # here we will store the values leading to the B-smooth numbers
+
+    # set up the sieve
+    sieve_step = 100
+    sieve_bound = sieve_step
+    # start values for the iterators in the positive/negative direction
+    iterator_p = [ [0, 0] for _ in range(lf) ]
+    iterator_m = [ [0, 0] for _ in range(lf) ]
+    for i, p in enumerate(factorbase):
+        for j, r in enumerate(factorbase_root[i]):
+            iterator_p[i][j] = (r - m) % p
+            iterator_m[i][j] = iterator_p[i][j] - p  # one step in the negative direction
+
+    def do_sieve():
+        nonlocal factorbase, factorbase_root, sieve_bound, factors
+        for i, p in enumerate(factorbase):
+            for r in range(len(factorbase_root[i])):
+                j = iterator_p[i][r]
+                while j <= sieve_bound:
+                    if j in factors:
+                        factors[j][0].append(i)
+                        factors[j][1] += factorbase_log[i]
+                    else:
+                        factors[j] = [[i], factorbase_log[i]]
+                    j += p
+                iterator_p[i][r] = j  # store as start value for the next step
+                j = iterator_m[i][r]
+                while j > -sieve_bound:
+                    if j in factors:
+                        factors[j][0].append(i)
+                        factors[j][1] += factorbase_log[i]
+                    else:
+                        factors[j] = [[i], factorbase_log[i]]
+                    j -= p
+                iterator_m[i][r] = j  # store as start value for the next step
+
+    def process_relation(j: int, relation: bytes):
+        nonlocal relation_no, values, relations
+        relation_no += 1
+        rhs = bytearray(b"\x00") * lfb # construct the k'th row of the identity matrix
+        byteset(rhs, relation_no)
+        relation += rhs  # extend the relation with this row
+        values[relation_no] = j  # store the value which lead to the relation
+        # do the Gauss elimination
+        index = lf # this will be the index of the first nonzero entry
+        # print(f'{j:3}', ' '.join(f'{b:08b}' for b in reversed(relation)))
+        for i in range(lf):
+            if bytetest(relation, i) and relations[i] is not None:  # make this entry zero if we can (Gauss elimination)
+                bytexor(relation, relations[i])
+            if bytetest(relation, i) and index == lf:  # is this the index of the first nonzero entry?
+                index = i
+        # print(f'{j:3}', ' '.join(f'{b:08b}' for b in reversed(relation)))
+        if index == lf:  # the new relation is linearly dependent: we have found a linear combination of the 0 vector
+            # now we need to determine the factors
+            u = 1  # product over all values m - j such that f(m-j) is B-smooth
+            v = 1  # sqrt of the product over all f(m-j) which are B-smooth
+            w = 1  # save nonsquare terms for the next round
+            for i in range(lf):
+                if bytetest(relation, lfb * 8 + i):  # select the relations which sum to the 0 vector
+                    ui = m + values[i]
+                    u = (u * ui) % n
+                    vi = ui ** 2 - n
+                    d = gcd(w, vi)
+                    v = (v * d) % n  # sqrt of the part which is already square
+                    w = (w // d) * (vi // d)  # this part is not square yet
+            v = v * isqrt(w) % n
+            res = gcd(u - v, n)
+            if 1 < res < n:
+                return res
+            relation_no -= 1  # this one did not work, try again
+        else:
+            relations[index] = relation
+        return None
+
+    while True:
+        factors = {} # store the index of the primes dividing j
+
+        do_sieve()
+
+        for j in sorted(factors.keys(),key=abs):
+            v = d + (m2 + j) * j  # (j + m) ** 2 - n
+            if factors[j][1] > 0.49 * log(abs(v)):
+                primes = factors[j][0]
+                mask = bytearray(b"\x00") * lfb
+                if v < 0:
+                    byteset(mask, 0)
+                    v *= -1
+                for i in primes:
+                    p = factorbase[i]
+                    k = 1  # per our sieve we already know that p devides v
+                    v //= p
+                    while v % p == 0:  # divide by p as many times as possible
+                        k = (k + 1) % 2  # we only want to know if the exponent is even or odd
+                        v //= p
+                    if k:
+                        byteset(mask, i + 1)
+                if v == 1:
+                    res = process_relation(j, mask)
+                    if res:
+                        return res
+                del(factors[j])
+            else:
+                del(factors[j])  # the number is unlikely to factor
+        sieve_bound += sieve_step  # increase the sieve and continue

kryptools/la.py

@@ -0,0 +1,223 @@
+"""
+Linear algebra
+"""
+
+from math import sqrt, prod
+
+class Matrix:
+    """
+    Matrix class.
+
+    Example:
+    
+    To define a matrix use
+    >>> Matrix([[1, 2], [3, 4]])
+    [1, 2]
+    [3, 4]
+    """
+    def __init__(self, matrix, ring = None):
+        if not isinstance(matrix[0], list|tuple):
+            matrix = [ [x] for x in matrix ]
+        self.matrix = matrix
+        self.cols = len(matrix[0])
+        self.rows = len(matrix)
+        if ring:
+            self.map(ring)
+
+    def __repr__(self) -> str:
+        out = ["[ "] * self.rows
+        for j in range(self.cols):
+            tmp = [ "" ] * self.rows
+            max_len = 0
+            for i in range(self.rows):
+                tmp[i] = str(self.matrix[i][j])
+                max_len = max(max_len, len(tmp[i]))
+            for i in range(self.rows):
+                out[i] += " " * (max_len - len(tmp[i])) + tmp[i]
+                if j < self.cols - 1:
+                    out[i] += ", "
+        for i in range(self.rows):
+            out[i] += " ]"
+        return '\n'.join(out)
+
+    def __len__(self):
+        return self.cols * self.rows
+
+    def __getitem__(self, item):
+        if isinstance(item, tuple):
+            i, j = item
+            if isinstance(i, int) and isinstance(j, int):
+                return self.matrix[i][j]
+            rows = range(self.rows)[i]
+            if isinstance(i, int):
+                rows = [ rows ]
+            cols = range(self.cols)[j]
+            if isinstance(j, int):
+                cols = [ cols ]
+            return Matrix([[self.matrix[i][j] for j in cols] for i in rows])
+        i, j = divmod(item, self.cols)
+        return self.matrix[i][j]
+
+    def __setitem__(self, item, value):
+        if isinstance(item, tuple):
+            i, j = item
+            if isinstance(i, int) and isinstance(j, int):
+                self.matrix[i][j] = value
+                return
+            rows = range(self.rows)[i]
+            if isinstance(i, int):
+                rows = [ rows ]
+            cols = range(self.cols)[j]
+            if isinstance(j, int):
+                cols = [ cols ]
+            for i, ii in zip(cols,range(len(cols))):
+                for j, jj in zip(rows,range(len(rows))):
+                    self.matrix[j][i] = value[jj,ii]
+            return
+        i, j = divmod(item, self.cols)
+        self.matrix[i][j] = value
+
+    def __eq__(self, other):
+        if not isinstance(other, self.__class__):
+            return False
+        return self.matrix == other.matrix
+
+    def map(self, func):
+        "Apply a function to all elements in place"
+        for row in self.matrix:
+            row[:] = map(func, row)
+
+    def applyfunc(self, func):
+        "Apply a function to all elements"
+        tmp = self[:,:]
+        tmp.map(func)
+        return tmp
+
+    def norm2(self) -> float:
+        "Squared Frobenius/Euclidean norm."
+        return sum( sum(x*x for x in row) for row in self.matrix )
+
+    def norm(self) -> float:
+        "Frobenius/Euclidean norm."
+        return sqrt(self.norm2())
+
+    def dot(self, other) -> int:
+        if self.rows == 1 and other.rows == 1 and self.cols == other.cols:
+            return sum(x * y for x, y in zip(self.matrix[0], other.matrix[0]))
+        if self.cols == 1 and other.cols == 1 and self.rows == other.rows:
+            return sum(x[0] * y[0] for x, y in zip(self.matrix, other.matrix))
+        return NotImplemented
+
+    def transpose(self) -> "Matrix":
+        return Matrix([list(i) for i in zip(*self.matrix)])
+
+    def multiply(self, other) -> "Matrix":
+        if not isinstance(other, Matrix) or self.cols != other.rows:
+            return NotImplemented
+        result = [[0 for j in range(other.cols)] for i in range(self.rows)]
+        for i in range(self.rows):
+            for j in range(other.cols):
+                for k in range(other.rows):
+                    result[i][j] += self.matrix[i][k] * other.matrix[k][j]
+        return Matrix(result)
+
+    def __add__(self, other) -> "Matrix":
+        if isinstance(other, Matrix) and other.cols == self.cols and other.rows == self.rows:
+            return Matrix([ [ x1 + y1 for x1, y1 in zip(x,y)] for x, y in zip(self.matrix, other.matrix)])
+        return NotImplemented
+
+    def __sub__(self, other) -> "Matrix":
+        if isinstance(other, Matrix) and other.cols == self.cols and other.rows == self.rows:
+            return Matrix([ [ x1 - y1 for x1, y1 in zip(x,y)] for x, y in zip(self.matrix, other.matrix)])
+        return NotImplemented
+
+    def __neg__(self) -> "Matrix":
+        return -1 * self
+
+    def __mul__(self, other) -> "Matrix":
+        if isinstance(other, Matrix):
+            return self.multiply(other)
+        return NotImplemented
+
+    def __rmul__(self, other) -> "Matrix":
+        if isinstance(other, Matrix):
+            return self.multiply(other)
+        return Matrix([ [item * other for item in row] for row in self.matrix ])
+
+    def rref(self) -> "Matrix":
+        "Compute the reduced echelon form of a matrix M."
+        n, m = self.cols, self.rows
+        R = self[:, :]
+        i = 0
+        for j in range(n):
+            if not R[i, j]: # search for am nonzero entry in the present column
+                for ii in range(i+1,m):
+                    if R[ii, j]:
+                        R[i, :], R[ii, :] = R[ii, :], R[i, :]  # swap rows
+                        break
+                else:
+                    continue  # all entries are zero
+            if R[i, j] != 1:
+                R[i, :] = 1/ R[i, j] * R[i, :]  # make the pivot one
+            for ii in range(m):  # remove the column entries above/below the pivot
+                if i == ii:
+                    continue
+                tmp = R[ii, j]
+                R[ii, ::] -= tmp * R[i, :]
+            i += 1
+            if i == m:
+                break
+        return R
+
+    def det(self) -> int:
+        "Compute the determinant of a matrix M."
+        if self.rows != self.rows:
+            raise ValueError("Matrix must be square!")
+        n = self.cols
+        R = self[:, :]
+        D = 1
+        i = 0
+        for j in range(n):
+            if not R[i, j]: # search for am nonzero entry in the present column
+                for ii in range(i+1,m):
+                    if R[ii, j]:
+                        D *= -1
+                        R[i, :], R[ii, :] = R[ii, :], R[i, :]  # swap rows
+                        break
+                else:
+                    return 0  # all entries are zero
+            if R[i, j] != 1:
+                D *= R[i, j]
+                R[i, :] = 1/ R[i, j] * R[i, :]  # make the pivot one
+            for ii in range(i+1,n):  # remove the column entries below the pivot
+                if i == ii:
+                    continue
+                tmp = R[ii, j]
+                R[ii, ::] -= tmp * R[i, :]
+            i += 1
+        return D
+
+    def inv(self) -> "Matrix":
+        "Compute the inverse of a square matrix M."
+        if self.rows != self.rows:
+            raise ValueError("Matrix must be square!")
+        n = self.cols
+        MM = Matrix([[0 for _ in range(2*n)] for _ in range(n)])
+        for i in range(n):
+            MM[i,n+i] = 1
+        MM[:,0:n] = self
+        MM = MM.rref()
+        if not prod(MM[i, i] for i in range(n)):
+            raise ValueError("Matrix is not invertible!")
+        return MM[:,n:]
+
+
+def zeros(m:int, n: int) -> "Matrix":
+    return Matrix([[ 0 for j in range(n)] for i in range(m) ])
+
+def eye(m:int, n: int) -> "Matrix":
+    def delta(i, j):
+        if i == j:
+            return 1
+        return 0
+    return Matrix([[ delta(i, j) for j in range(n) ] for i in range(m) ])