Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BIG.modinv works only for prime modules #856

Open
ManudL2000 opened this issue Apr 15, 2024 · 2 comments
Open

BIG.modinv works only for prime modules #856

ManudL2000 opened this issue Apr 15, 2024 · 2 comments
Labels
crypto issue related to cryptographic primitives

Comments

@ManudL2000
Copy link
Contributor

ManudL2000 commented Apr 15, 2024

Looking at the method "modinv" in the file zen_big.c, seems that this method find succesfully the inverse of a big number only if the modulo is a prime number.
When the modulo is a composite number two things can happen:

  1. the computation doesn't stop (for example when the big number in input is not invertible).
  2. It gives a wrong inverse.

For example in the ring Z/6Z the element 5 is invertible and its inverse is 5 since 25 mod 6 = 1. Instead the output of the function is 3.

local x = BIG.new(5)
local module = BIG.new(6)
local inv_x = x:modinv(module)
print(inv_x:decimal())
@jaromil jaromil added the crypto issue related to cryptographic primitives label Apr 16, 2024
@matteo-cristino
Copy link
Collaborator

Looking deeper into milagro library it seems to use the binary method in order to compute the modulo inverse. This algorithm, if I remember well, works only with odd modulos. Need to search better for this, if this is the case than we should add a check on the parity of the modulo.

@jaromil
Copy link
Member

jaromil commented Jun 30, 2024

I agree adding checks is the right approach, let's introduce a parity check?
Also the modinv function could check for 2^BIGBITS values and switch to use the BIG_XXX_invmod2m function in milagro which is much faster. See src/big.c.in at line 1432

/* a=1/a mod 2^BIGBITS. This is very fast! */
void BIG_XXX_invmod2m(BIG_XXX a)

and

/* Set r=1/a mod p. Binary method */
/* SU= 240 */
void BIG_XXX_invmodp(BIG_XXX r,BIG_XXX a,BIG_XXX p)

the latter has internal checks on parity, but I don't know this technique well enough to judge on its constraints. I know that a must be <p on entry.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
crypto issue related to cryptographic primitives
Projects
None yet
Development

No branches or pull requests

3 participants