kryptools 0.1__tar.gz

kryptools-0.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Gerald Teschl
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

kryptools-0.1/PKG-INFO

@@ -0,0 +1,35 @@
+Metadata-Version: 2.1
+Name: kryptools
+Version: 0.1
+Summary: Implemenation of same basic algorithms used in cryptography.
+Author-email: Gerald Teschl <gerald.teschl@univie.ac.at>
+Project-URL: Homepage, https://github.com/teschlg/kryptools
+Project-URL: Issues, https://github.com/teschlg/kryptools/issues
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+
+# kryptools
+Gerald Teschl <Gerald.Teschl@univie.ac.at>
+
+This package was written for my course on cryptography. Consequently its intention is
+mainly educational, that is, to show how basic algorithms are implemented. In particular,
+you are welcome to read (and modify) the source. Any suggestions on how to make the
+code more readable or make it better are welcome. However, my main goal is to keep
+it simple and readability will be preferred over small speed improvements.
+
+The tools contained are:
+
+* number theory: sqrt modulo primes, crt, continued fractions, etc.
+* primes: Sieve of Erathostenes, primality tests
+* solvers for discrete logarithms (naive, Pollard rho, Shanks baby step/giant step, index calculus, quadratic sieve)
+* integer factorization (Pollard p-1, Lentra's ECM, Dixon, basic quadratic sieve)
+* linear algebra: Hermite normal form, Gram-Schmidt
+* lattices: Babai rounding/nearest plane, lattice reduction
+
+* Matrix: a class for Matrices (inverse, det, reduced echelon form, etc.)
+* Poly: a class for polynomials (division, modulo)
+* Zmod: a class for the ring of integers modulo an integer

kryptools-0.1/README.md

@@ -0,0 +1,21 @@
+# kryptools
+Gerald Teschl <Gerald.Teschl@univie.ac.at>
+
+This package was written for my course on cryptography. Consequently its intention is
+mainly educational, that is, to show how basic algorithms are implemented. In particular,
+you are welcome to read (and modify) the source. Any suggestions on how to make the
+code more readable or make it better are welcome. However, my main goal is to keep
+it simple and readability will be preferred over small speed improvements.
+
+The tools contained are:
+
+* number theory: sqrt modulo primes, crt, continued fractions, etc.
+* primes: Sieve of Erathostenes, primality tests
+* solvers for discrete logarithms (naive, Pollard rho, Shanks baby step/giant step, index calculus, quadratic sieve)
+* integer factorization (Pollard p-1, Lentra's ECM, Dixon, basic quadratic sieve)
+* linear algebra: Hermite normal form, Gram-Schmidt
+* lattices: Babai rounding/nearest plane, lattice reduction
+
+* Matrix: a class for Matrices (inverse, det, reduced echelon form, etc.)
+* Poly: a class for polynomials (division, modulo)
+* Zmod: a class for the ring of integers modulo an integer

kryptools-0.1/kryptools/Zmod.py

@@ -0,0 +1,115 @@
+"""
+Ring of intergers modulo `n`.
+"""
+
+class Zmod:
+    """
+    Ring of intergers modulo `n`.
+
+    Example:
+    
+    To define a finite Galois field modulo the prime 5 use
+    >>> gf=Zmod(5)
+    
+    To declare 3 as an element of our Galois filed use
+    >>> gf(3)
+    3 (mod 5)
+
+    The usual arithmetic operations are supported.
+    >>> gf(2) + gf(3)
+    0 (mod 5)
+    """
+
+    def __init__(self, n: int, short: bool = False):
+        self.n = n
+        self.short = short
+
+    def __call__(self, x: int):
+        return ZmodPoint(x, self)
+
+    def __eq__(self, other):
+        if isinstance(other, self.__class__):
+            return self.n == other.n
+        return False
+
+    def __contains__(self, other: "ZmodPoint") -> bool:
+        return isinstance(other, ZmodPoint) and self.n == other.ring.n
+
+
+class ZmodPoint:
+    "Represents a point in the ring Zmod."
+
+    def __init__(self, x: int, ring: "Zmod"):
+        if isinstance(x, self.__class__) and x.ring.n == ring.n:
+            self.x = int(x)
+        else:
+            self.x = int(x) % ring.n
+        self.ring = ring
+
+    def __repr__(self):
+        if self.ring.short:
+            return str(self.x)
+        return f"{self.x} (mod {self.ring.n})"
+
+    def __eq__(self, other):
+        if not isinstance(other, self.__class__) or self.ring != other.ring:
+            return False
+        return self.x == other.x
+
+    def __bool__(self):
+        return self.x != 0
+
+    def __int__(self):
+        return self.x
+
+    def sharp(self):
+        "Returns a symmetric (w.r.t. 0) representative."
+        tmp = (self.ring.n - 1) // 2
+        return (self.x + tmp) % self.ring.n - tmp
+
+    def __hash__(self):
+        return hash(self.x)
+
+    def __add__(self, other: "ZmodPoint") -> "ZmodPoint":
+        if isinstance(other, self.__class__) and self.ring == other.ring:
+            return self.__class__(self.x + other.x, self.ring)
+        if isinstance(other, int):
+            return self.__class__(self.x + other, self.ring)
+        return NotImplemented
+
+    def __radd__(self, scalar: int) -> "ZmodPoint":
+        return self.__class__(scalar + self.x, self.ring)
+
+    def __neg__(self) -> "ZmodPoint":
+        return self.__class__(-self.x, self.ring)
+
+    def __sub__(self, other: "ZmodPoint") -> "ZmodPoint":
+        if isinstance(other, self.__class__) and self.ring == other.ring:
+            return self.__class__(self.x - other.x, self.ring)
+        if isinstance(other, int):
+            return self.__class__(self.x - other, self.ring)
+        return NotImplemented
+
+    def __rsub__(self, scalar: int) -> "ZmodPoint":
+        return self.__class__(scalar - self.x, self.ring)
+
+    def __mul__(self, other: "ZmodPoint") -> "ZmodPoint":
+        if isinstance(other, self.__class__) and self.ring == other.ring:
+            return self.__class__(self.x * other.x, self.ring)
+        if isinstance(other, int):
+            return self.__class__(self.x * other, self.ring)
+        return NotImplemented
+
+    def __rmul__(self, scalar: int) -> "ZmodPoint":
+        return self.__class__(scalar * self.x, self.ring)
+
+    def __truediv__(self, other: "ZmodPoint") -> "ZmodPoint":
+        if not isinstance(other, self.__class__) or self.ring != other.ring:
+            return NotImplemented
+        return self.__class__(self.x * pow(other.x, -1, self.ring.n), self.ring)
+
+    def __rtruediv__(self, scalar: int) -> "ZmodPoint":
+        return self.__class__(scalar * pow(self.x, -1, self.ring.n), self.ring)
+
+    def __pow__(self, scalar: int) -> "ZmodPoint":
+        return self.__class__(pow(self.x, scalar, self.ring.n), self.ring)

kryptools-0.1/kryptools/__init__.py

@@ -0,0 +1,13 @@
+"""
+Implemenation of same basic algorithms used in cryptography.
+"""
+
+from .dlp import dlog
+from .ec import EC_Weierstrass
+from .factor import factorint
+from .la import Matrix
+from .lat import hermite_nf, gram_schmidt, lll
+from .nt import cf, convergents, jacobi_symbol, sqrt_mod, euler_phi, order, carmichael_lambda
+from .poly import Poly
+from .primes import sieve_eratosthenes, isprime
+from .Zmod import Zmod

kryptools-0.1/kryptools/dlp.py

@@ -0,0 +1,76 @@
+"""
+Discrete Log Problem:
+    dlog(a, b, n) solve the discrete log problem a^x = b mod n
+"""
+
+
+from math import gcd, log, sqrt
+from .nt import crt, order
+from .dlp_bsgs import dlog_bsgs
+from .dlp_qs import dlog_qs
+from .factor import factorint
+
+
+def dlog_naive(a: int, b: int, n: int, m: int = None) -> int:
+    """Compute the discrete log_a(b) in Z_n of an element a of order m by exhaustive search."""
+    a %= n
+    b %= n
+    if not m:
+        m = n - 1
+    aa = 1
+    for i in range(m):
+        aa = (aa * a) % n
+        if aa == b:
+            return i + 1
+    return None  # no solution
+
+def _dlog_switch(a: int, b: int, n: int, m: int) -> int:
+    """Compute the discrete log_a(b) in Z_n of an element a of order m choosing an appropriate method."""
+    if m < 1000:
+        return dlog_naive(a, b, n, m)
+    elif log(m) - 6 < 2 * sqrt(log(n) * log(log(n))):  # compare the theoreticaly expected running times ob bsgs and ic; the constant 6 is determined experimentally
+        return dlog_bsgs(a, b, n, m)
+    else:
+        return dlog_qs(a, b, n, m)
+
+def _dlog_ph(a: int, b: int, n: int, q: int, k: int) -> int:
+    """Compute the discrete log_a(b) in Z_n of an element a of order q^k using Pohlig-Hellman reduction."""
+    if k == 1 or q**k < 10000:
+        return _dlog_switch(a, b, n, q**k)
+    aj = pow(a, q ** (k - 1), n)
+    a1 = aj
+    bj = pow(b, q ** (k - 1), n)
+    xj = _dlog_switch(a1, bj, n, q)
+    for j in range(2, k + 1):
+        aj = pow(a, q ** (k - j), n)
+        bj = pow(b, q ** (k - j), n)
+        yj = _dlog_switch(a1, bj * pow(aj, -xj, n) % n, n, q)
+        if yj is None:
+            return None
+        xj = xj + q ** (j - 1) * yj % q**j
+    return xj
+
+
+def dlog(a: int, b: int, n: int, m: int = None) -> int:
+    """Compute the discrete log_a(b) in Z_n of an element a of order m using Pohlig-Hellman reduction."""
+    a %= n
+    b %= n
+    assert gcd(a, n) == 1, "a and n must be coprime."
+    assert gcd(b, n) == 1, "b and n must be coprime."
+    if m:
+        mf = factorint(m)
+    else:
+        m, mf = order(a, n, True)
+    assert pow(b, m, n) == 1, "DLP not solvable."
+    # We first use Pohlig-Hellman to split m into powers of prime factors
+    mm = []
+    ll = []
+    for pj, kj in mf.items():
+        aj = pow(a, m // pj**kj, n)
+        bj = pow(b, m // pj**kj, n)
+        l = _dlog_ph(aj, bj, n, pj, kj)
+        if l is None:
+            return None
+        mm += [pj**kj]
+        ll += [l]
+    return crt(ll, mm)

kryptools-0.1/kryptools/dlp_bsgs.py

@@ -0,0 +1,29 @@
+"""
+Discrete log solvers: Shanks' baby-step-giant-step algorithm
+"""
+
+from math import isqrt
+
+
+def dlog_bsgs(a: int, b: int, n: int, m: int = None) -> int:
+    """Compute the discrete log_a(b) in Z_n of an element a of order m using Shanks' baby-step-giant-step algorithm."""
+    a %= n
+    b %= n
+    if not m:
+        m = n - 1
+    mm = 1 + isqrt(m - 1)
+    # initialize baby_steps table
+    baby_steps = {}
+    baby_step = 1
+    for k in range(mm):
+        baby_steps[baby_step] = k
+        baby_step = baby_step * a % n
+
+    # now take the giant steps
+    giant_stride = pow(a, -mm, n)
+    giant_step = b
+    for l in range(mm):
+        if giant_step in baby_steps:
+            return l * mm + baby_steps[giant_step]
+        giant_step = giant_step * giant_stride % n
+    return None  # no solution

kryptools-0.1/kryptools/dlp_ic.py

@@ -0,0 +1,136 @@
+"""
+Discrete log solvers: Index calculus
+"""
+
+from math import gcd
+from random import randint
+from .primes import sieve_eratosthenes
+from .dlp_qs import determine_factorbound, determine_trialdivison_bounds, is_smooth
+
+def dlog_ic(a: int, b: int, n: int, m: int, pollard: bool = True, verbose: int = 0) -> int:
+    """Compute the discrete log_a(b) in Z_p of an element a of prime order m using Index Calculus."""
+
+    # assert isprime(m), "The order of a must be prime."
+    # assert n_order(a, n) == m, "The order of a is incorrect."
+    # assert pow(b, m, n) == 1, "The DLP is not solvable."
+
+    def find_relation(include_b: bool) -> None or list:
+        """Find a relation for b * a^x or a^x"""
+        nonlocal a, b, m, n, max_trys, factorbase, factorbase_len, smallprimes_len, pollard_k
+
+        x_max = m - 1
+        x_min = 0
+        if include_b:
+            x_min = 1
+        trys = 0
+        while trys < max_trys:
+            x = randint(x_min, x_max)
+            if include_b:
+                bax = b * pow(a ,x, n) % n
+            else:
+                bax = pow(a ,x, n)
+            relation = is_smooth(bax, factorbase, factorbase_len, smallprimes_len, pollard_k)
+            if relation:
+                break
+            trys += 1
+        else:
+            raise Exception(f"Sorry, Index Calculus failed to find a relation after {trys} trys.")
+        if verbose > 2:
+            if include_b:
+                print(f"rel found: b*a^{x}=", b * pow(a, x, n) % n, relation)
+            else:
+                print(f"rel found: a^{x}=", pow(a, x, n), relation)
+        relation.reverse()  # the linear algebra is slightly faster if we take the large primes first
+        if include_b:
+            relation += [ 1, x ]
+        else:
+            relation += [ 0, x ]
+        return relation
+
+
+    # this functions does the linear algebra
+    def process_relation(relation: list) -> None or int:
+        """Add a new relation to the linear system and keep the system in echelon form."""
+        nonlocal a, b, m, n, relations, len_relations, n_relations
+
+        n_relations += 1
+        # Gauss elimination
+        for i in range(len_relations):
+            ri = relation[i] % m
+            if ri == 0:
+                continue
+            if relations[i] is not None:  # subtract the current relations
+                relation[i] = 0
+                for j in range(i + 1, len_relations + 1):
+                    relation[j] = (relation[j] - ri * relations[i][j]) % m
+                continue
+            # normalize the first nonzero entry
+            rinv = pow(ri, -1, m)
+            relation[i] = 1
+            for j in range(i+1, len_relations + 1):
+                    relation[j] = rinv * relation[j] % m
+            relations[i] = relation
+            if verbose > 2:
+                print(n_relations, f"rel found (index={i}) :", relation)
+            elif verbose > 1:
+                print(n_relations, f"rel found (index={i})")
+            index = i
+            break  # we don't need a reduced echelon form
+        else:  # the relation contains no new information
+            if verbose > 1:
+                print(n_relations,"redundant rel found")
+            return None
+        #for i in range(index):  # reduced echelon form
+        #    if relations[i] != None:
+        #        ri = relations[i][index]  # make this entry zero
+        #        if ri > 0:
+        #            relations[i][index] = 0
+        #            for j in range(index+1, len_relations + 1):
+        #                relations[i][j] = (relations[i][j] - ri * relation[j]) % m
+        #print(n_relations, f"i={i}={index} ({len_relations})", relations)
+        if index == len_relations - 1:  # we found the solution
+            if verbose:
+                print(f"Success after {n_relations} relations out of {len_relations}.")
+            #for i in range(lf):
+            #    p = factorbase[i]
+            #    print(f'{p:d}',pow(p,m,n)==1,relations[i])
+            x = (m - relations[index][len_relations]) % m
+            if pow(a, x, n) == b:
+                return x
+            raise Exception("Sorry, Index Calculus failed! Either the DLP is not solvable, or the order is not prime or incorrect.")
+
+    #
+    # Determine the parameters
+    #
+    B, expected_trys = determine_factorbound(n)[:2]
+    max_trys = 10 * expected_trys
+    factorbase = tuple(p for p in sieve_eratosthenes(B) if gcd(p,n) == 1)  # compute the factorbse
+    factorbase_len = len(factorbase)  # length of the factorbase
+    if factorbase_len == 0:
+        raise Exception("Sorry, Index Calculus could not find a factorbase!")
+    smallprimes_len, pollard_k = factorbase_len, None
+    if pollard:  # should we speed up trial division with Pollard p-1
+        smallprimes_len, pollard_k = determine_trialdivison_bounds(B // 150, factorbase)
+    if verbose > 0:
+        print(f"Factorbase: bound = {B}, size = {factorbase_len}, max_trys = {max_trys}")
+
+    # Start the work
+    n_relations = 0  # number of relations found
+
+    # first find a relation involving b
+    relation = find_relation(True)
+
+    # Set up the linear system
+    len_relations = factorbase_len + 1
+    relations = [None] * len_relations
+    res = process_relation(relation)
+    if res:
+        return res
+
+    while n_relations < 5 * factorbase_len:  # find relations for all primes in our factor base
+        relation = find_relation(False)
+        res = process_relation(relation)
+        if res:
+            return res
+
+    raise Exception("Sorry, Index Calculus could not find enough relations! ({n_relations} - {n_relations_redundant} = {n_relations - n_relations_redundant} out of {len_relations})")