Add Rabin-Williams signatures using Bernstein's tweaked roots. Improve documentation

rw.cpp

@@ -7,9 +7,12 @@
 #include "integer.h"
 #include "nbtheory.h"
 #include "modarith.h"
+#include "asn.h"
 
 #ifndef CRYPTOPP_IMPORTS
 
+static const bool CRYPTOPP_RW_USE_OMP = false;
+
 NAMESPACE_BEGIN(CryptoPP)
 
 void RWFunction::BERDecode(BufferedTransformation &bt)
@@ -103,6 +106,55 @@ void InvertibleRWFunction::GenerateRandom(RandomNumberGenerator &rng, const Name
 
 	m_n = m_p * m_q;
 	m_u = m_q.InverseMod(m_p);
+
+	Precompute();
+}
+
+void InvertibleRWFunction::Initialize(const Integer &n, const Integer &p, const Integer &q, const Integer &u)
+{
+	m_n = n; m_p = p; m_q = q; m_u = u;
+
+	Precompute();
+}
+
+void InvertibleRWFunction::PrecomputeTweakedRoots() const
+{
+	ModularArithmetic modp(m_p), modq(m_q);
+
+	#pragma omp parallel sections if(CRYPTOPP_RW_USE_OMP)
+	{
+		#pragma omp section
+			m_pre_2_9p = modp.Exponentiate(2, (9 * m_p - 11)/8);
+		#pragma omp section
+			m_pre_2_3q = modq.Exponentiate(2, (3 * m_q - 5)/8);
+		#pragma omp section
+			m_pre_q_p = modp.Exponentiate(m_q, m_p - 2);
+	}
+
+	m_precompute = true;
+}
+
+void InvertibleRWFunction::LoadPrecomputation(BufferedTransformation &bt)
+{
+	BERSequenceDecoder seq(bt);
+	m_pre_2_9p.BERDecode(seq);
+	m_pre_2_3q.BERDecode(seq);
+	m_pre_q_p.BERDecode(seq);
+	seq.MessageEnd();
+
+	m_precompute = true;
+}
+
+void InvertibleRWFunction::SavePrecomputation(BufferedTransformation &bt) const
+{
+	if(!m_precompute)
+		Precompute();
+
+	DERSequenceEncoder seq(bt);
+	m_pre_2_9p.DEREncode(seq);
+	m_pre_2_3q.DEREncode(seq);
+	m_pre_q_p.DEREncode(seq);
+	seq.MessageEnd();
 }
 
 void InvertibleRWFunction::BERDecode(BufferedTransformation &bt)
@@ -113,6 +165,8 @@ void InvertibleRWFunction::BERDecode(BufferedTransformation &bt)
 	m_q.BERDecode(seq);
 	m_u.BERDecode(seq);
 	seq.MessageEnd();
+
+	m_precompute = false;
 }
 
 void InvertibleRWFunction::DEREncode(BufferedTransformation &bt) const
@@ -125,44 +179,70 @@ void InvertibleRWFunction::DEREncode(BufferedTransformation &bt) const
 	seq.MessageEnd();
 }
 
+// DJB's "RSA signatures and Rabin-Williams signatures..." (http://cr.yp.to/sigs/rwsota-20080131.pdf).
 Integer InvertibleRWFunction::CalculateInverse(RandomNumberGenerator &rng, const Integer &x) const
 {
 	DoQuickSanityCheck();
-	ModularArithmetic modn(m_n);
+
+	if(!m_precompute)
+		Precompute();
+
+	ModularArithmetic modn(m_n), modp(m_p), modq(m_q);
 	Integer r, rInv;
-	do {
+
-		// do this in a loop for people using small numbers for testing
+	do
+	{
+		// Do this in a loop for people using small numbers for testing
 		r.Randomize(rng, Integer::One(), m_n - Integer::One());
 		// Fix for CVE-2015-2141. Thanks to Evgeny Sidorov for reporting.
-		// Squaring to satisfy Jacobi requirements suggested by Jean-Pierre Münch.
+		// Squaring to satisfy Jacobi requirements suggested by Jean-Pierre Munch.
 		r = modn.Square(r);
 		rInv = modn.MultiplicativeInverse(r);
 	} while (rInv.IsZero());
+
 	Integer re = modn.Square(r);
-	re = modn.Multiply(re, x);			// blind
+	re = modn.Multiply(re, x);    // blind
 
-	Integer cp=re%m_p, cq=re%m_q;
+	const Integer &h = re, &p = m_p, &q = m_q, &n = m_n;
-	if (Jacobi(cp, m_p) * Jacobi(cq, m_q) != 1)
+	Integer e, f;
+
+	const Integer U = modq.Exponentiate(h, (q+1)/8);
+	if(((modq.Exponentiate(U, 4) - h) % q).IsZero())
+		e = Integer::One();
+	else
+		e = -1;
+
+	const Integer eh = e*h, V = modp.Exponentiate(eh, (p-3)/8);
+	if(((modp.Multiply(modp.Exponentiate(V, 4), modp.Exponentiate(eh, 2)) - eh) % p).IsZero())
+		f = Integer::One();
+	else
+		f = 2;
+
+	Integer W, X;
+	#pragma omp parallel sections if(CRYPTOPP_RW_USE_OMP)
 	{
-		cp = cp.IsOdd() ? (cp+m_p) >> 1 : cp >> 1;
+		#pragma omp section
-		cq = cq.IsOdd() ? (cq+m_q) >> 1 : cq >> 1;
-	}
-
-	#pragma omp parallel
-		#pragma omp sections
 		{
-			#pragma omp section
+			W = (f.IsUnit() ? U : modq.Multiply(m_pre_2_3q, U));
-				cp = ModularSquareRoot(cp, m_p);
-			#pragma omp section
-				cq = ModularSquareRoot(cq, m_q);
 		}
+		#pragma omp section
+		{
+			const Integer t = modp.Multiply(modp.Exponentiate(V, 3), eh);
+			X = (f.IsUnit() ? t : modp.Multiply(m_pre_2_9p, t));
+		}
+	}
+	const Integer Y = W + q * modp.Multiply(m_pre_q_p, (X - W));
 
-	Integer y = CRT(cq, m_q, cp, m_p, m_u);
+	// Signature
-	y = modn.Multiply(y, rInv);				// unblind
+	Integer s = modn.Multiply(modn.Square(Y), rInv);
-	y = STDMIN(y, m_n-y);
+	assert((e * f * s.Squared()) % m_n == x);
-	if (ApplyFunction(y) != x)				// check
+
+	// IEEE P1363, Section 8.2.8 IFSP-RW, p.44
+	s = STDMIN(s, m_n - s);
+	if (ApplyFunction(s) != x)                      // check
 		throw Exception(Exception::OTHER_ERROR, "InvertibleRWFunction: computational error during private key operation");
-	return y;
+
+	return s;
 }
 
 bool InvertibleRWFunction::Validate(RandomNumberGenerator &rng, unsigned int level) const
@@ -197,6 +277,8 @@ void InvertibleRWFunction::AssignFrom(const NameValuePairs &source)
 		CRYPTOPP_SET_FUNCTION_ENTRY(Prime2)
 		CRYPTOPP_SET_FUNCTION_ENTRY(MultiplicativeInverseOfPrime2ModPrime1)
 		;
+
+	m_precompute = false;
 }
 
 NAMESPACE_END

rw.h

@@ -1,20 +1,24 @@
 // rw.h - written and placed in the public domain by Wei Dai
 
 //! \file rw.h
-//! \brief Classes for Rabin-Williams signature schemes
+//! \brief Classes for Rabin-Williams signature scheme
-//! \details Rabin-Williams signature schemes as defined in IEEE P1363.
+//! \details The implementation provides Rabin-Williams signature schemes as defined in
+//!   IEEE P1363. It uses Bernstein's tweaked square roots in place of square roots to
+//!   speedup calculations.
+//! \sa <A HREF="http://cr.yp.to/sigs/rwsota-20080131.pdf">RSA signatures and Rabin–Williams
+//!   signatures: the state of the art (20080131)</A>, Section 6, <em>The tweaks e and f</em>.
 
 #ifndef CRYPTOPP_RW_H
 #define CRYPTOPP_RW_H
 
-
 #include "cryptlib.h"
 #include "pubkey.h"
 #include "integer.h"
 
 NAMESPACE_BEGIN(CryptoPP)
 
-//! _
+//! \class RWFunction
+//! \brief Rabin-Williams trapdoor function using the public key
 class CRYPTOPP_DLL RWFunction : public TrapdoorFunction, public PublicKey
 {
 	typedef RWFunction ThisClass;
@@ -46,14 +50,16 @@ protected:
 	Integer m_n;
 };
 
-//! _
+//! \class InvertibleRWFunction
+//! \brief Rabin-Williams trapdoor function using the private key
 class CRYPTOPP_DLL InvertibleRWFunction : public RWFunction, public TrapdoorFunctionInverse, public PrivateKey
 {
 	typedef InvertibleRWFunction ThisClass;
 
 public:
-	void Initialize(const Integer &n, const Integer &p, const Integer &q, const Integer &u)
+	InvertibleRWFunction() : m_precompute(false) {}
-		{m_n = n; m_p = p; m_q = q; m_u = u;}
+
+	void Initialize(const Integer &n, const Integer &p, const Integer &q, const Integer &u);
 	// generate a random private key
 	void Initialize(RandomNumberGenerator &rng, unsigned int modulusBits)
 		{GenerateRandomWithKeySize(rng, modulusBits);}
@@ -83,11 +89,25 @@ public:
 	void SetPrime2(const Integer &q) {m_q = q;}
 	void SetMultiplicativeInverseOfPrime2ModPrime1(const Integer &u) {m_u = u;}
 
+	virtual bool SupportsPrecomputation() const {return true;}
+	virtual void Precompute(unsigned int unused = 0) {PrecomputeTweakedRoots();}
+	virtual void Precompute(unsigned int unused = 0) const {PrecomputeTweakedRoots();}
+
+	virtual void LoadPrecomputation(BufferedTransformation &storedPrecomputation);
+	virtual void SavePrecomputation(BufferedTransformation &storedPrecomputation) const;
+
+protected:
+	void PrecomputeTweakedRoots() const;
+
 protected:
 	Integer m_p, m_q, m_u;
+
+	mutable Integer m_pre_2_9p, m_pre_2_3q, m_pre_q_p;
+	mutable bool m_precompute;
 };
 
-//! RW
+//! \class RW
+//! \brief Rabin-Williams algorithm
 struct RW
 {
 	static std::string StaticAlgorithmName() {return "RW";}
@@ -95,7 +115,8 @@ struct RW
 	typedef InvertibleRWFunction PrivateKey;
 };
 
-//! RWSS
+//! \class RWSS
+//! \brief Rabin-Williams signature scheme
 template <class STANDARD, class H>
 struct RWSS : public TF_SS<STANDARD, H, RW>
 {