kryptools 1.7__tar.gz → 1.8.1__tar.gz

{kryptools-1.7 → kryptools-1.8.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kryptools
-Version: 1.7
+Version: 1.8.1
 Summary: Implemenation of same basic algorithms used in cryptography.
 Author-email: Gerald Teschl <gerald.teschl@univie.ac.at>
 License: MIT
@@ -44,7 +44,7 @@ The tools contained are:
 * integer factorization (Fermat, Pollard p-1, Pollard rho, Lenstra's ECM, Dixon, basic quadratic sieve)
 * elliptic curves (Weierstrass form), group operations, order, discrete logarithms
 * linear algebra: Hermite normal form, Gram-Schmidt
-* lattices: Hadamard ratio, Babai rounding/nearest plane algorithm, lattice reduction (Lenstra-Lenstra-Lovaz)
+* lattices: Hadamard ratio, Babai rounding/nearest plane algorithm, lattice reduction (Lenstra-Lenstra-Lovaz), SIS, ISIS, LWE
 * linear codes: Hamming distance, left standard form, parity check matrix
 
 * Matrix: a class for Matrices (inverse, det, reduced echelon form, kernel, etc.)

{kryptools-1.7 → kryptools-1.8.1}/README.md

@@ -26,7 +26,7 @@ The tools contained are:
 * integer factorization (Fermat, Pollard p-1, Pollard rho, Lenstra's ECM, Dixon, basic quadratic sieve)
 * elliptic curves (Weierstrass form), group operations, order, discrete logarithms
 * linear algebra: Hermite normal form, Gram-Schmidt
-* lattices: Hadamard ratio, Babai rounding/nearest plane algorithm, lattice reduction (Lenstra-Lenstra-Lovaz)
+* lattices: Hadamard ratio, Babai rounding/nearest plane algorithm, lattice reduction (Lenstra-Lenstra-Lovaz), SIS, ISIS, LWE
 * linear codes: Hamming distance, left standard form, parity check matrix
 
 * Matrix: a class for Matrices (inverse, det, reduced echelon form, kernel, etc.)

{kryptools-1.7 → kryptools-1.8.1}/kryptools/Zmod.py

@@ -28,13 +28,15 @@ class Zmod:
     0
     """
 
-    def __init__(self, n: int, short: bool = True):
+    def __init__(self, n: int, short: bool = True, sharp: bool = False):
         if not isinstance(n, int) or n < 1:
             raise ValueError(f"{n} is not a positive integer.")
         self.n = n
+        self.n2 = n // 2
         self.isfield = None
         self.n_factors = {} # factoring of n
         self.short = short
+        self.sharp = sharp
         self.group_order = 0 # order of the multiplicative group
         self.factors = {}  # factoring of the multiplicative group order
 
@@ -161,9 +163,13 @@ class ZmodPoint:
         self.ring = ring
 
     def __repr__(self):
+        if self.ring.sharp:
+            x = self.sharp()
+        else:
+            x = self.x
         if self.ring.short:
-            return str(self.x)
-        return f"{self.x} (mod {self.ring.n})"
+            return str(x)
+        return f"{x} (mod {self.ring.n})"
 
     def __eq__(self, other):
         if not isinstance(other, self.__class__) or self.ring != other.ring:
@@ -239,7 +245,9 @@ class ZmodPoint:
         return NotImplemented
 
     def __abs__(self) -> int:
-        return abs(self.sharp())
+        if self.x <= self.ring.n2:
+            return self.x
+        return self.ring.n - self.x
 
     def bits(self) -> list:
         "Convert to a list of bits."
@@ -247,7 +255,7 @@ class ZmodPoint:
 
     def sharp(self):
         "Returns a symmetric (w.r.t. 0) representative."
-        if self.x <= self.ring.n // 2:
+        if self.x <= self.ring.n2:
             return self.x
         return self.x - self.ring.n
 
@@ -320,6 +328,24 @@ class ZmodPoint:
             roots.append((p**(j//2) * x) % pk)
         return self.ring(crt(roots, powers))
 
-    def is_generator(self):
+    def solve(self, b, all_solutions: bool = False) -> "ZmodPoint":
+        "Find a solution `x` of the linear equation `self * x == b` in Z_n."
+        b = int(b)
+        if not self:
+            if b:
+                return None
+            if all_solutions:
+                return list(self.ring)
+            return self.ring(0)
+        g = gcd(self.x, self.ring.n)
+        if b % g:
+            return None
+        m = self.ring.n // g
+        sol = self.ring(pow(self.x // g, -1, m) * (b // g) % m)
+        if all_solutions:
+            return [ sol + j * m for j in range(g) ]
+        return sol
+
+    def is_generator(self) -> bool:
         "Test if the point is a generator of the group Z_n^*."
         return self.ring.order() == self.order()

{kryptools-1.7 → kryptools-1.8.1}/kryptools/__init__.py

@@ -5,7 +5,7 @@ Implemenation of same basic algorithms used in cryptography.
 __author__ = "Gerald Teschl"
 __copyright__ = "Copyright 2024-2025, Gerald Teschl"
 __license__ = "MIT License"
-__version__ = "1.7"
+__version__ = "1.8.1"
 __email__ = "Gerald.Teschl@univie.ac.at"
 
 from .nt import egcd, cf, convergents, legendre_symbol, jacobi_symbol, sqrt_mod, euler_phi, carmichael_lambda, moebius_mu, is_carmichael_number, order, crt
@@ -15,7 +15,8 @@ from .factor import factorint, divisors
 from .dlp import dlog
 from .ec import EC_Weierstrass
 from .la import Matrix, zeros, eye, circulant, BinaryMatrix
-from .lat import gram_det, hadamard_ratio, hermite_nf, gram_schmidt, babai_round_cvp, babai_round_bnd, babai_plane_cvp, babai_plane_bnd, lagrange_lr, lll, random_unimodular_matrix
+from .lat import gram_det, hadamard_ratio, hermite_nf, gram_schmidt, babai_round_cvp, babai_round_bnd, babai_plane_cvp, babai_plane_bnd, lagrange_lr, lll, random_unimodular_matrix, q_ary_lattice
+from .lat import svp_lll, cvp_lll, sis_lll, isis_lll, svp_search, cvp_search, sis_search, isis_search
 from .poly import Poly, PolyBinMult, lagrange_interpolation
 from .Zmod import Zmod
 from .GF2 import GF2, GF2_aes, GF2_miniaes, GF2_ghash

{kryptools-1.7 → kryptools-1.8.1}/kryptools/la.py

@@ -2,7 +2,8 @@
 Linear algebra
 """
 
-from math import inf, sqrt
+# pragma pylint: disable=C0302
+from math import gcd, inf, sqrt
 from numbers import Number
 from fractions import Fraction
 from .Zmod import Zmod
@@ -69,7 +70,7 @@ class Matrix:
         res = "\\begin{pmatrix}\n"
         for row in self.matrix:
             res += " & ".join(map(str, row)) + '\\\\\n'
-        res += '\\end{pmatrix}'
+        res = res[:-3] + '\n\\end{pmatrix}'
         return res
 
     def __len__(self):
@@ -177,26 +178,42 @@ class Matrix:
 
     def append_row(self, row: list|tuple, ring = None) -> None:
         "Append a row."
-        if not isinstance(row, list|tuple):
+        if isinstance(row, self.__class__):
+            row = row.matrix
+        elif not isinstance(row, list|tuple):
             row = list(row)
-        if len(row) != self.cols:
+        if not isinstance(row[0], list|tuple):
+            row = [ row ]
+        if len(row[0]) != self.cols:
             raise ValueError("Length does not match the number of columns.")
         if ring:
-            row =list(map(ring, row))
-        self.matrix.append(row)
-        self.rows += 1
+            for i, r in enumerate(row):
+                row[i] =list(map(ring, r))
+        self.matrix += row
+        self.rows += len(row)
 
     def append_column(self, col: list|tuple, ring = None) -> None:
         "Append a column."
-        if not isinstance(col, list|tuple):
+        if isinstance(col, self.__class__):
+            col = col.matrix
+        elif not isinstance(col, list|tuple):
             col = list(col)
         if len(col) != self.rows:
             raise ValueError("Length does not match the number of rows.")
-        if ring:
-            col =list(map(ring, col))
-        for i in range(self.rows):
-            self.matrix[i].append(col[i])
-        self.cols += 1
+        if isinstance(col[0], list|tuple):
+            for i, c in enumerate(col):
+                if ring:
+                    self.matrix[i] += list(map(ring, c))
+                else:
+                    self.matrix[i] += c
+            self.cols += len(col[0])
+        else:
+            for i, c in enumerate(col):
+                if ring:
+                    self.matrix[i].append(ring(c))
+                else:
+                    self.matrix[i].append(c)
+            self.cols += 1
 
     def permute_columns(self, permutation) -> None:
         "Permute columns according to a list of new positions."
@@ -240,7 +257,7 @@ class Matrix:
 
     def norm2(self) -> float:
         "Squared Frobenius/Euclidean norm."
-        return sum(sum(x*x for x in row) for row in self.matrix)
+        return sum(sum(abs(x)**2 for x in row) for row in self.matrix)
 
     def norm(self, p: int = 2) -> float:
         "p-norm of the matrix regarded as a vector."
@@ -312,37 +329,45 @@ class Matrix:
             return self.__class__([[item * other for item in row] for row in self.matrix])
         return NotImplemented
 
-    def rref(self, start = 0, drop_zero_rows = False) -> "Matrix":
+    def rref(self, start: int = 0, drop_zero_rows: bool = False) -> "Matrix":
         "Compute the reduced echelon form."
+        if hasattr(self.matrix[0][0], "ring") and not self.matrix[0][0].ring.is_field():
+            # the matrix is over a ring (not a field)
+            return self._rref_ring(start = start, drop_zero_rows = drop_zero_rows)
         one = self._guess_zero()[1]
         n, m = self.cols, self.rows
-        R = self[:, :]
-        R.pivotcols = []
-        R.nonpivotcols = []
+        R = [ self.matrix[i][:] for i in range(m) ]
+        pivotcols = []
+        nonpivotcols = []
         i = 0
         if start >= n:
             raise ValueError("Start value cannot be beyond the last column.")
         for j in range(start, n):
-            if not R[i, j]:  # search for a nonzero entry in the present column
-                for ii in range(i+1, m):
-                    if R[ii, j]:
-                        R[i, :], R[ii, :] = R[ii, :], R[i, :]  # swap rows
+            if not R[i][j]:  # search for a nonzero entry in the present column
+                for ii in range(i + 1, m):
+                    if R[ii][j]:
+                        R[i], R[ii] = R[ii], R[i]  # swap rows
                         break
                 else:
-                    R.nonpivotcols.append(j)
+                    nonpivotcols.append(j)
                     continue  # all entries are zero
-            R.pivotcols.append(j)
-            if R[i, j] != one:
-                R[i, :] = R[i, j]**-1 * R[i, :]  # make the pivot one
+            pivotcols.append(j)
+            if R[i][j] != one:
+                tmp = R[i][j]**-1
+                for k in range(n):
+                    R[i][k] *= tmp  # make the pivot one
             for ii in range(m):  # remove the column entries above/below the pivot
                 if i == ii:
                     continue
-                tmp = R[ii, j]
-                R[ii, ::] -= tmp * R[i, :]
+                tmp = R[ii][j]
+                for k in range(n):
+                    R[ii][k] -= tmp * R[i][k]
             i += 1
             if i == m:
                 break
-        R.nonpivotcols += list(range(j+1, R.cols))
+        R = Matrix(R)
+        R.pivotcols = pivotcols
+        R.nonpivotcols = nonpivotcols + list(range(j+1, R.cols))
         # purge zero rows
         if drop_zero_rows:
             l = len(R.pivotcols)
@@ -352,6 +377,91 @@ class Matrix:
             R.rows = l
         return R
 
+    def _rref_ring(self, start: int = 0, drop_zero_rows: bool = False) -> "Matrix":
+        "Compute the reduced echelon form if the base ring is Z_n and no field."
+        ring = self.matrix[0][0].ring
+        M = self.applyfunc(int)
+        done = start
+        while done < M.cols:
+            M = M.hrnf(start = start, drop_zero_rows = drop_zero_rows)
+            done = M.cols
+            for i, j in enumerate(M.pivotcols):
+                if j < start:
+                    continue
+                pivot = M.matrix[i][j]
+                if pivot >= ring.n:
+                    done = min(j, done)
+                    pivot %= ring.n
+                if pivot:  # find the invertible part
+                    g = gcd(pivot, ring.n)
+                    while g > 1:
+                        pivot //= g
+                        g = gcd(pivot, ring.n)
+                if pivot > 1:  # we can make the pivot smaller
+                    done = min(j, done)
+                    tmp = pow(pivot, -1, ring.n)
+                    for k in range(j, M.cols):
+                        M.matrix[i][k] *= tmp
+            M.map(lambda x: x % ring.n)
+        M.map(ring)
+        return M
+
+    def hrnf(self, start = 0, drop_zero_rows: bool = False) -> "Matrix":
+        "Compute the Hermite row normal form."
+        n, m = self.cols, self.rows
+        if not isinstance(self.matrix[0][0], int):
+            raise ValueError("Hermite normal form requires integer entries!")
+        H = [ self.matrix[i][:] for i in range(m) ]
+        pivotcols = []
+        nonpivotcols = []
+        i = 0
+        if start >= n:
+            raise ValueError("Start value cannot be beyond the last column.")
+        for j in range(start, n):
+            i0 = i
+            minimum = abs(H[i][j])  # search for the pivot in the present column
+            for ii in range(i + 1, m):
+                tmp = abs(H[ii][j])
+                if tmp > 0 and (tmp < minimum or minimum == 0):
+                    minimum = tmp
+                    i0 = ii
+            if minimum == 0:
+                nonpivotcols.append(j)
+                continue  # all entrjes are zero
+            pivotcols.append(j)
+            if i0 > i:
+                H[i], H[i0] = H[i0], H[i]  # swap rows, to move the pivot jn place
+            if H[i][j] < 0:
+                for k in range(n):
+                    H[i][k] *= -1  # make the pivot positive
+            ii = i + 1
+            while ii < m:  # make the column entries below to the pivot zero
+                tmp = H[ii][j] // H[i][j]
+                for k in range(n):
+                    H[ii][k] -= tmp * H[i][k]
+                if H[ii][j]:
+                    H[i], H[ii] = H[ii], H[i]  # swap rows
+                else:
+                    ii += 1
+            for ii in range(i):  # reduce the column entries above to the pivot
+                tmp = H[ii][j] // H[i][j]
+                for k in range(n):
+                    H[ii][k] -= tmp * H[i][k]
+            i += 1
+            if i >= m:
+                break
+        H = Matrix(H)
+        H.pivotcols = pivotcols
+        H.nonpivotcols = nonpivotcols + list(range(j+1, H.cols))
+        # purge zero rows
+        if drop_zero_rows:
+            l = len(H.pivotcols)
+            if not l:
+                l = 1  # do not delete all rows
+            del H.matrix[l:]
+            H.rows = l
+        return H
+
     def left_standard_form(self) -> "Matrix":
         "Compute the left standard form."
         # reduced row echelon form
@@ -363,6 +473,8 @@ class Matrix:
 
     def kernel(self) -> "Matrix":
         "Compute a basis for the kernel."
+        if hasattr(self.matrix[0][0], "ring") and not self.matrix[0][0].ring.is_field():
+            raise NotImplementedError("The matrix must be over a field, not a ring.")
         _, one = self._guess_zero()
         M = self.rref(drop_zero_rows = True)
         K = M.zeros(M.cols, max(1,len(M.nonpivotcols)))
@@ -374,31 +486,43 @@ class Matrix:
 
     def det(self) -> int:
         "Compute the determinant."
-        zero, one = self._guess_zero()
-        if self.rows != self.cols:
-            raise ValueError("Matrix must be square!")
         n, m = self.cols, self.rows
-        R = self[:, :]
+        if n != m:
+            raise ValueError("Matrix must be square!")
+        if hasattr(self.matrix[0][0], "ring") and not self.matrix[0][0].ring.is_field():
+            # the matrix is over a ring (not a field)
+            ring = self.matrix[0][0].ring
+            R = [ list(map(lambda x: Fraction(int(x)), self.matrix[i])) for i in range(m) ]
+            zero, one = ring(0), 1
+        else:
+            ring = None
+            R = [ self.matrix[i][:] for i in range(m) ]
+            zero, one = self._guess_zero()
         D = one
         i = 0
         for j in range(n):
-            if not R[i, j]:  # search for a nonzero entry in the present column
+            if not R[i][j]:  # search for a nonzero entry in the present column
                 for ii in range(i+1, m):
-                    if R[ii, j]:
+                    if R[ii][j]:
                         D *= -one
-                        R[i, :], R[ii, :] = R[ii, :], R[i, :]  # swap rows
+                        R[i], R[ii] = R[ii], R[i]  # swap rows
                         break
-                else:
-                    return zero  # all entries are zero
-            if R[i, j] != one:
-                D *= R[i, j]
-                R[i, :] = R[i, j]**-1 * R[i, :]  # make the pivot one
-            for ii in range(i+1, n):  # remove the column entries below the pivot
+                else:  # all entries are zero
+                    return zero
+            if R[i][j] != one:
+                D *= R[i][j]
+                tmp = R[i][j]**-1
+                for k in range(n):
+                    R[i][k] *= tmp  # make the pivot one
+            for ii in range(i + 1, n):  # remove the column entries below the pivot
                 if i == ii:
                     continue
-                tmp = R[ii, j]
-                R[ii, ::] -= tmp * R[i, :]
+                tmp = R[ii][j]
+                for k in range(n):
+                    R[ii][k] -= tmp * R[i][k]
             i += 1
+        if ring:
+            return ring(D)
         return D
 
     def rank(self) -> int:
@@ -425,28 +549,68 @@ class Matrix:
         M = self.__class__(M).rref()
         if not left and M.pivotcols[self.cols - 1] != self.cols -1:
             raise ValueError("Matrix is not invertible!")
+        if hasattr(self.matrix[0][0], "ring") and not self.matrix[0][0].ring.is_field():
+            # the matrix is over a ring (not a field)
+            for i, j in enumerate(M.pivotcols):
+                if M.matrix[i][j] != one:
+                    raise ValueError("Matrix is not invertible!")
         return M[:, n:]
 
-    def solve(self, b: list|tuple, ring = None) -> "Matrix":
+    def solve(self, b: list|tuple) -> "Matrix":
         "Solve the linear system with given inhomogenous vector."
         if isinstance(b, list|tuple):
-            b = Matrix(b, ring = ring)
+            b = self.__class__(b)
         if self.rows != b.rows or b.cols != 1:
             raise ValueError("Matrix dimensions do not match.")
-        A = self.zeros(self.rows, self.cols + 1) # extended coefficient matrix
-        A[:, 0:self.cols] = self
-        A[:, self.cols] = b
+        A = self[:,:]
+        A.append_column(b)
         A = A.rref(drop_zero_rows = True)
+        if not any(A.matrix[-1][:-1]) and A.matrix[-1][-1]:
+            return None  # Not solvable
+        if hasattr(self.matrix[0][0], "ring") and not self.matrix[0][0].ring.is_field():
+            # the matrix is over a ring (not a field)
+            ring = self.matrix[0][0].ring
+            # compute column normal form (TODO implement full Smith normal form)
+            b = A[:,-1]
+
+            A = A[:,:-1].transpose()
+            A.map(int)
+            A.append_column(A.eye(A.rows))
+            A = A.hrnf().transpose()
+            R = A[b.rows:,:b.rows]
+            A = A[:b.rows,:b.rows]
+            A.map(ring)
+
+            solution_nr = [ 0 ] * A.rows
+            solutions_left = True
+            next_solution = False  # start with the first solution
+            while solutions_left:
+                solution = solution = [ None ] * A.rows
+                solutions_left = False
+                for i in range(A.rows):
+                    bi = b[i]
+                    for k in range(i):
+                        bi -= A.matrix[i][k] * solution[k]
+                    c = A.matrix[i][i].solve(bi, all_solutions = True)
+                    if c is None:
+                        solution = None
+                        break
+                    if next_solution and solution_nr[i] < len(c) - 1:
+                        solution_nr[i] += 1
+                        next_solution = False
+                    if solution_nr[i] < len(c) -1:
+                        solutions_left = True
+                    solution[i] = c[solution_nr[i]]
+                if next_solution: # no more solutions left
+                    return None
+                if solution is not None:
+                    return R * Matrix(solution)
+                next_solution = True
+            return None
+        # the matrix is over a field
         solution = self.zeros(self.cols, 1)
-        for i in range(A.rows-1, -1, -1):
-            if not any(A.matrix[i][:-1]):
-                if A.matrix[i][-1]:
-                    return None  # Not solvable
-            else:
-                for j in range(A.cols - 1):
-                    if A.matrix[i][j]:
-                        break # leading nonzero coefficient
-                solution[j]= A.matrix[i][-1]
+        for i, j in enumerate(A.pivotcols):
+            solution[j] = A.matrix[i][-1]
         return solution
 
     def is_unimodular(self) -> bool:
@@ -520,7 +684,6 @@ def circulant(vector: list|tuple, m: int = None, ring=None) -> "Matrix":
     vector = list(reversed(vector))
     return Matrix([rotate(vector, -n-1) for n in range(m)], ring=ring)
 
-
 class BinaryMatrix:
     """
     Binary Matrix class.
@@ -528,7 +691,7 @@ class BinaryMatrix:
     Example:
 
     To define a binary matrix use
-    >>> Matrix([[0, 1], [1, 0]])
+    >>> BinaryMatrix([[0, 1], [1, 0]])
     [01]
     [10]
     """
@@ -793,7 +956,7 @@ class BinaryMatrix:
             return res
         return self.from_bits(res)
 
-    def rref(self, start = 0, reduce = True, drop_zero_rows = False) -> "Matrix":
+    def rref(self, start: int = 0, reduce: bool = True, drop_zero_rows: bool = False) -> "Matrix":
         "Row reduced echelon form."
         rref = [ None ] * self.cols  # store rows accoring to leading bit
         rows = self.matrix[:]  # copy

{kryptools-1.7 → kryptools-1.8.1}/kryptools/lat.py

@@ -2,10 +2,11 @@
 Lattice tools
 """
 
-from math import prod, floor
+from math import prod, floor, inf
+from itertools import product
 from fractions import Fraction
 from random import choice, sample
-from .la import Matrix, zeros
+from .la import Matrix, eye, zeros
 
 
 def hermite_nf(M: Matrix) -> Matrix:
@@ -13,7 +14,7 @@ def hermite_nf(M: Matrix) -> Matrix:
     n, m = M.cols, M.rows
     H = M[:, :]
     j = n - 1
-    for i in reversed(range(m)):
+    for i in range(m-1,-1,-1):
         j0 = j
         minimum = abs(H[i, j])  # search for the pivot in the present row
         for jj in range(j):
@@ -24,10 +25,7 @@ def hermite_nf(M: Matrix) -> Matrix:
         if minimum == 0:
             continue  # all entries are zero
         if j0 < j:
-            H[:, j], H[:, j0] = (
-                H[:, j0],
-                H[:, j],
-            )  # swap columns, to move the pivot in place
+            H[:, j], H[:, j0] = H[:, j0], H[:, j]  # swap columns, to move the pivot in place
         if H[i, j] < 0:
             H[:, j] *= -1  # make the pivot positive
         jj = j - 1
@@ -41,7 +39,6 @@ def hermite_nf(M: Matrix) -> Matrix:
         for jj in range(j + 1, n):  # reduce the row entries right to the pivot
             tmp = H[i, jj] // H[i, j]
             H[:, jj] -= tmp * H[:, j]
-        #print(H)
         j -= 1
         if j < 0:
             break
@@ -55,22 +52,32 @@ def norm2(v: Matrix) -> float:
     return sum(map(lambda x: x * x, v))
 
 
-def gram_schmidt(U: Matrix) -> (Matrix, Matrix):
+def gram_schmidt(U: Matrix, drop_dependent: bool = True) -> (Matrix, Matrix):
     "Compute the Gram-Schmidt orthogonalization of the column vectors of a matrix M."
-    M = U.eye()
-    Us = U[:, :]
-    for j in range(1, U.rows):
+    M = U.eye(U.cols)
+    Us = U.zeros()
+    Us[:, 0] = U[:, 0]
+    jj = 0 # offset taking removed vectors into account
+    for j in range(1, U.cols):
         tmp = U[:, j]
-        for i in range(j):
-            M[i, j] = U[:, j].dot(Us[:, i]) / norm2(Us[:, i])
-            tmp -= M[i, j] * Us[:, i]
-        Us[:, j] = tmp
+        for i in range(j - jj):
+            M[i, j - jj] = U[:, j].dot(Us[:, i]) / Us[:, i].norm2()
+            tmp -= M[i, j - jj] * Us[:, i]
+        if not tmp:
+            if not drop_dependent:
+                raise ValueError("Vectors are linearly dependent.")
+            jj += 1
+        else:
+            Us[:, j - jj] = tmp
+    if jj:
+        Us = Us[:,:-jj]
+        M = M[:-jj,:-jj]
     return Us, M
 
 
 def gram_det(U: Matrix) -> float:
     "Compute the Gram determinant of a matrix."
-    Us = gram_schmidt(U)[0]
+    Us = gram_schmidt(U, drop_dependent = False)[0]
     return prod([Us[:, i].norm() for i in range(U.rows)])
 
 
@@ -109,7 +116,7 @@ def babai_plane_bnd(U: Matrix, p=2) -> float:
 
 def lagrange_lr(V: Matrix) -> Matrix:
     "Lagrange lattice reduction."
-    if (V.rows, V.cols) != (2, 2):
+    if V.cols != 2:
         raise ValueError("Lagrange lattice reduction requires dimension two.")
     v1, v2 = V[:, 0], V[:, 1]
     if norm2(v1) > norm2(v2):
@@ -130,10 +137,10 @@ def lll(V: Matrix, delta: float = 0.75, sort: bool = True) -> Matrix:
     U.map(int)
     Us = U[:, :]
     Us.map(Fraction)
-    M = U.zeros()
+    M = U.zeros(U.cols)
     M.map(Fraction)
     M[0, 0] = norm2(Us[:, 0])  # we store the squared norms on the diagonal
-    for l in range(1, U.rows):  # Gram-Schmidt decomposition
+    for l in range(1, U.cols):  # Gram-Schmidt decomposition
         tmp = U[:, l]
         for i in range(l):
             M[i, l] = U[:, l].dot(Us[:, i]) / M[i, i]
@@ -141,7 +148,7 @@ def lll(V: Matrix, delta: float = 0.75, sort: bool = True) -> Matrix:
         Us[:, l] = tmp
         M[l, l] = norm2(Us[:, l])
 
-    while j < U.rows:
+    while j < U.cols:
         for i in range(j - 1, -1, -1):  # reduce the weights of the basis vectors
             r = round(M[i, j])
             if r:
@@ -172,7 +179,7 @@ def lll(V: Matrix, delta: float = 0.75, sort: bool = True) -> Matrix:
             M[l, j], M[l, j - 1] = M[l, j - 1], M[l, j]
         tmp1 = oldM00 / M[j - 1, j - 1]
         tmp2 = oldM10 * oldM11 / M[j - 1, j - 1]
-        for l in range(j + 1, U.rows):
+        for l in range(j + 1, U.cols):
             M[j - 1, l], M[j, l] = (
                 tmp1 * M[j, l] + tmp2 * M[j - 1, l],
                 M[j - 1, l] - oldM10 * M[j, l],
@@ -180,9 +187,9 @@ def lll(V: Matrix, delta: float = 0.75, sort: bool = True) -> Matrix:
         j = max(j - 1, 1)  # redo the last step
 
     if sort:  # sort the vectors according to their norm
-        tmp = [U[:, j] for j in range(U.rows)]
+        tmp = [U[:, j] for j in range(U.cols)]
         tmp.sort(key=norm2)
-        for j in range(U.rows):
+        for j in range(U.cols):
             U[:, j] = tmp[j]
     return U
 
@@ -204,3 +211,95 @@ def random_unimodular_matrix(n: int, iterations: int = 50, max_val: int = None)
         if not max_val or max(abs(x) for x in tmp) <= max_val:
             W[:, i] = tmp
     return W
+
+def q_ary_lattice(U: Matrix, lll: bool = False) -> Matrix:  # pylint: disable=W0621
+    "Create a q-ary lattice and (optinally) LLL reduce the basis."
+    if isinstance(U, Matrix) and hasattr(U.matrix[0][0], "ring"):
+        q = U.matrix[0][0].ring.n
+    else:
+        raise ValueError("The matrix does not seem to be over Zmod.")
+    V = eye(U.rows, one = q)
+    V.append_column(U, ring = int)
+    V = hermite_nf(V)
+    if lll:
+        return globals()['lll'](V)
+    return V
+
+def svp_lll(U: Matrix) -> Matrix:
+    "Solve the shortest vector problem in a q-ary lattice associated with a matrix over a finite ring Z_q."
+    gf = U[0].ring
+    V = q_ary_lattice(U, lll = True)
+    x = V[:, 0]
+    x.map(gf)
+    return x
+
+def cvp_lll(U: Matrix, x: Matrix) -> Matrix:
+    "Solve the closest vector problem in a q-ary lattice associated with a matrix over a finite ring Z_q (LWE)."
+    gf = U[0].ring
+    V = q_ary_lattice(U, lll = True)
+    x.map(int)
+    y = babai_plane_cvp(x, V)
+    x.map(gf)
+    return y
+
+def sis_lll(A: Matrix) -> Matrix:
+    "Solve the short integer problem over a finite ring Z_q (SIS)."
+    return svp_lll(A.kernel())
+
+def isis_lll(A: Matrix, b: Matrix) -> Matrix:
+    "Solve the inhomogenous short integer problem over a finite ring Z_q (ISIS)."
+    y = A.solve(b)
+    return y - cvp_lll(A.kernel(), y)
+
+def svp_search(U: Matrix, m: int = 0, p: int = 2) -> Matrix:
+    "Solve the shortest vector problem in a q-ary lattice associated with a matrix over a finite ring Z_q."
+    gf = U[0].ring
+    if m:
+        ml, mu = -m, m + 1
+    else:
+        ml, mu = -((gf.n-1)//2), gf.n//2 + 1
+    U.map(int)
+    norm_min = inf
+    c_min = None
+    for j in range(U.cols):
+        for c in product(range(ml, mu), repeat = U.cols-j-1):
+            for cc in range(1, mu):
+                cc = U * Matrix([ 0 ] * j + [ cc ] + list(c))
+                cc.map(gf)
+                norm = cc.norm(p)
+                if norm < norm_min:
+                    norm_min = norm
+                    c_min = cc
+    U.map(gf)
+    return c_min
+
+def cvp_search(U: Matrix, b: Matrix, p: int = 2) -> Matrix:
+    "Solve the closest vector problem in a q-ary lattice associated with a matrix over a finite ring Z_q (LWE)."
+    gf = U[0].ring
+    U.map(int)
+    b.map(int)
+    norm_min = inf
+    c_min = None
+    for c in product(range(-((gf.n-1)//2), gf.n//2 + 1), repeat = U.cols):
+        c = U * Matrix(c)
+        d = c - b
+        d.map(gf)
+        norm = d.norm(p)
+        if norm < norm_min:
+            norm_min = norm
+            c.map(gf)
+            c_min = c
+    U.map(gf)
+    b.map(gf)
+    return c_min
+
+def sis_search(A: Matrix, p: int = 2) -> Matrix:
+    "Solve the short integer problem over a finite ring Z_q (SIS)."
+    return svp_search(A.kernel(), p = p)
+
+def isis_search(A: Matrix, b: Matrix, p: int = 2) -> Matrix:
+    "Solve the inhomogenous short integer problem over a finite ring Z_q (ISIS)."
+    y = A.solve(b)
+    if y is None:
+        return None
+    return y - cvp_search(A.kernel(), y, p = p)

{kryptools-1.7 → kryptools-1.8.1}/kryptools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kryptools
-Version: 1.7
+Version: 1.8.1
 Summary: Implemenation of same basic algorithms used in cryptography.
 Author-email: Gerald Teschl <gerald.teschl@univie.ac.at>
 License: MIT
@@ -44,7 +44,7 @@ The tools contained are:
 * integer factorization (Fermat, Pollard p-1, Pollard rho, Lenstra's ECM, Dixon, basic quadratic sieve)
 * elliptic curves (Weierstrass form), group operations, order, discrete logarithms
 * linear algebra: Hermite normal form, Gram-Schmidt
-* lattices: Hadamard ratio, Babai rounding/nearest plane algorithm, lattice reduction (Lenstra-Lenstra-Lovaz)
+* lattices: Hadamard ratio, Babai rounding/nearest plane algorithm, lattice reduction (Lenstra-Lenstra-Lovaz), SIS, ISIS, LWE
 * linear codes: Hamming distance, left standard form, parity check matrix
 
 * Matrix: a class for Matrices (inverse, det, reduced echelon form, kernel, etc.)

{kryptools-1.7 → kryptools-1.8.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kryptools"
-version = "1.7"
+version = "1.8.1"
 authors = [
   { name="Gerald Teschl", email="gerald.teschl@univie.ac.at" },
 ]

{kryptools-1.7 → kryptools-1.8.1}/tests/test_Zmod.py

@@ -45,10 +45,11 @@ def test_Zmod_methods():
     assert [abs(i) for i in Z_5] == [0, 1, 2, 2, 1]
     assert not Z_5(0)
     assert Z_5(1)
-    assert Z_5(2) == Z_5(2)
+    assert Z_5(2) == Z_5(7)
     assert Z_5(2) != Z_5(3)
     assert Z_5(2) != 2
     assert str(Z_5(3)) == "3"
+    assert Z_5(2).solve(3) == 3 * Z_5(2)**-1
     Z_5.short = False
     assert str(Z_5(6)) == "1 (mod 5)"
 
@@ -67,10 +68,12 @@ def test_Zmod_methods():
     assert [abs(i) for i in Z_6] == [0, 1, 2, 3, 2, 1]
     assert not Z_6(0)
     assert Z_6(1)
-    assert Z_6(2) == Z_6(2)
+    assert Z_6(2) == Z_6(8)
     assert Z_6(2) != Z_6(3)
     assert Z_5(2) != Z_6(2)
     assert str(Z_6(3)) == "3"
+    assert Z_6(2).solve(4) == Z_6(2)
+    assert Z_6(2).solve(3) is None
 
 
 def test_Zmod_order():

{kryptools-1.7 → kryptools-1.8.1}/tests/test_la.py

@@ -1,7 +1,8 @@
 # pragma pylint: disable=C0114,C0116
 import pytest  # pylint: disable=W0611
-from fractions import Fraction  # pylint: disable=C0411
+from math import gcd  # pylint: disable=C0411
 from random import randint, seed  # pylint: disable=C0411
+from fractions import Fraction  # pylint: disable=C0411
 from kryptools import Matrix, Zmod, GF2, eye, circulant, BinaryMatrix
 
 
@@ -36,11 +37,39 @@ def test_Matrix():
     Mi = M.inv()
     assert M * Mi == M.eye()
 
+def test_Matrix2():
+    num_tests = 100
+    seed(0)
+    for ring in Zmod(7), Zmod(8), Zmod(10):
+        for m,n in ((3, 5), (5, 3), (3, 3)):
+            for _ in range(num_tests):
+                A = Matrix([[ring.random() for _ in range(m)] for _ in range(n)])
+                b = Matrix([ring.random() for _ in range(n)])
+                AA = A.applyfunc(lambda x: Fraction(int(x)))
+                if n == m:
+                    d = A.det()
+                    assert d == ring(AA.det())
+                    if gcd(d.x, ring.n) == 1:
+                        assert A.inv() * A == A.eye()
+                    else:
+                        with pytest.raises(ValueError):
+                            A.inv()
+                x = A.solve(b)
+                if x is not None:
+                    assert A * x == b
+                else:
+                    if n == m:
+                        assert gcd(d.x, ring.n) != 1
+                xx = Matrix([ring.random() for _ in range(m)])
+                b = A * xx
+                x = A.solve(b)
+                assert A * x == b
+
 def test_kernel():
     for gf in Zmod(2), Zmod(7), GF2(1), GF2(8):
         for m,n in ((3, 5), (5, 3), (3, 3)):
             for _ in range(25):
-                A = Matrix([[gf.random() for _ in range(m)] for _ in range(n)], ring = gf)
+                A = Matrix([[gf.random() for _ in range(m)] for _ in range(n)])
                 K = A.kernel()
                 assert not A * K
                 assert K.rows == A.cols
@@ -84,7 +113,7 @@ def test_BinaryMatrix():
                 assert BinaryMatrix(Mat.inv()) == mat.inv()
         assert Mat.rank() == mat.rank()
         sol = mat.solve(b)
-        Sol = Mat.solve(b, ring = Z_2)
+        Sol = Mat.solve(Z_2(b))
         assert (sol is None and Sol is None) or list(Sol.applyfunc(int)) == sol
         if mat.rows == 1:
             assert int(Mat * X) == mat.apply(x)[0]