/
pollardsrho.py
executable file
·132 lines (102 loc) · 3.72 KB
/
pollardsrho.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
#!/usr/bin/env python3
# This script makes use of another module: common.py, which can be
# found on GitHub:
#
# https://github.com/andreacorbellini/ecc/blob/master/logs/common.py
#
# You must place that module on the same directory of this script
# prior to running it.
import random
from common import inverse_mod, tinycurve as curve
class PollardRhoSequence:
def __init__(self, point1, point2):
self.point1 = point1
self.point2 = point2
self.add_a1 = random.randrange(1, curve.n)
self.add_b1 = random.randrange(1, curve.n)
self.add_x1 = curve.add(
curve.mult(self.add_a1, point1),
curve.mult(self.add_b1, point2),
)
self.add_a2 = random.randrange(1, curve.n)
self.add_b2 = random.randrange(1, curve.n)
self.add_x2 = curve.add(
curve.mult(self.add_a2, point1),
curve.mult(self.add_b2, point2),
)
def __iter__(self):
partition_size = curve.p // 3 + 1
x = None
a = 0
b = 0
while True:
if x is None:
i = 0
else:
i = x[0] // partition_size
if i == 0:
# x is either the point at infinity (None), or is in the first
# third of the plane (x[0] <= curve.p / 3).
a += self.add_a1
b += self.add_b1
x = curve.add(x, self.add_x1)
elif i == 1:
# x is in the second third of the plane
# (curve.p / 3 < x[0] <= curve.p * 2 / 3).
a *= 2
b *= 2
x = curve.double(x)
elif i == 2:
# x is in the last third of the plane (x[0] > curve.p * 2 / 3).
a += self.add_a2
b += self.add_b2
x = curve.add(x, self.add_x2)
else:
raise AssertionError(i)
a = a % curve.n
b = b % curve.n
yield x, a, b
def log(p, q, counter=None):
assert curve.is_on_curve(p)
assert curve.is_on_curve(q)
# Pollard's Rho may fail sometimes: it may find a1 == a2 and b1 == b2,
# leading to a division by zero error. Because PollardRhoSequence uses
# random coefficients, we have more chances of finding the logarithm
# if we try again, without affecting the asymptotic time complexity.
# We try at most three times before giving up.
for i in range(3):
sequence = PollardRhoSequence(p, q)
tortoise = iter(sequence)
hare = iter(sequence)
# The range is from 0 to curve.n - 1, but actually the algorithm will
# stop much sooner (either finding the logarithm, or failing with a
# division by zero).
for j in range(curve.n):
x1, a1, b1 = next(tortoise)
x2, a2, b2 = next(hare)
x2, a2, b2 = next(hare)
if x1 == x2:
if b1 == b2:
# This would lead to a division by zero. Try with
# another random sequence.
break
x = (a1 - a2) * inverse_mod(b2 - b1, curve.n)
logarithm = x % curve.n
steps = i * curve.n + j + 1
return logarithm, steps
raise AssertionError('logarithm not found')
def main():
x = random.randrange(1, curve.n)
p = curve.g
q = curve.mult(x, p)
print('Curve: {}'.format(curve))
print('Curve order: {}'.format(curve.n))
print('p = (0x{:x}, 0x{:x})'.format(*p))
print('q = (0x{:x}, 0x{:x})'.format(*q))
print(x, '* p = q')
y, steps = log(p, q)
print('log(p, q) =', y)
print('Took', steps, 'steps')
assert x == y
if __name__ == '__main__':
main()