def LLL(M, impl="auto"):
"""
Calculate LLL-reduced Matrix
Args:
M : A matrix
impl : LLL Implementation (default: auto)
You can select implementation: auto, fplll, parigp or gap
Return: LLL-reduced Matrix
"""
if impl == "auto":
if check("fplll"):
impl = "fplll"
elif check("gap"):
impl = "gap"
elif check("gp"):
impl = "parigp"
if impl == "fplll":
return fplll_lll(M)
elif impl == "parigp":
mat = "[" + "; ".join(map(lambda x: ", ".join(map(str, x)), M)) + "]"
return eval("[" + parigp(["M = mattranspose(%s)" % mat, "Str(mattranspose(M * qflll(M)))"]).replace("; ", "], [")[1:-1] + "]")
elif impl == "gap":
mat = str(M).replace("L", "")
return eval(gap(["vector := %s" % mat, "LLLReducedBasis(vector).basis"]).rstrip(";"))
else:
raise RuntimeError("Invalid Implementation: %s" % impl)
def test_knapsack(s):
from scryptos.wrapper.common import check
if check("gp") or check("fplll") or check("gap"):
m = 0x341ccf41e09da851
c = 0xB75B63369A52F5F30CFE5E642
a = [58692287682224938532079129932L, 54124250491778978820692485381L, 7277220015820983195773562608L,
22332383050669823978020089761L, 16967063558604003742849514894L, 62355997480269765615210626760L,
5170363880013545458168089364L, 14258428081357094750634713280L, 36287775811261632958539463292L,
64158589039078535932527740088L, 4957165945420369897339450045L, 48887024134310311336003185458L,
18793329531325217943998377262L, 34849054916999515597115226753L, 34004947907188645530085195162L,
34292499970059354752786233092L, 7465958787690007484635596453L, 54523540218652065182276201159L,
57000747039828947704764319534L, 50575388677892232980068371694L, 3702058161015823872166782237L,
3349829679265481129755048986L, 28405544429942218214723074100L, 36495788164044649888936432337L,
48544464129042978733031529923L, 60050271447609162325797432216L, 17009291688635671258136540844L,
32243452400131210275321820528L, 19435400185697379146087163973L, 18958695960561396891652356392L,
31046838278903521493393091567L, 22039804766852830688395024152L, 57057512556148595984239556858L,
60234203621762490899836532853L, 17520024899042505063126260369L, 47991875009003147708419421093L,
2490616484966554508753587547L, 2899153068397613767531906868L, 52497993703425658528041503014L,
52472487311532478269420426577L, 40482174126297668775911754500L, 16911496622935987625595000117L,
46693438934980177103776837991L, 1284890835773525386783112485L, 54477823291266207382876225082L,
61740894964814382664396357499L, 46647309100226523278177395127L, 16502561642567509404189158915L,
19004498941637468189390997034L, 9828916790346848731369187336L, 35425036974884801641584840823L,
31415726379765125631239673685L, 17972704773815859985638190557L, 9936946611209044418233820319L,
36798963351701498896151091569L, 13848431692126270671326713024L, 3198504385930460160976160781L,
16499536430449755854269030517L, 57509243300349206773820711938L, 43866494813937969559452082306L,
54036517188127062281695050584L, 27536442945835183874395339046L, 27752811040789181632791691991L,
55343638437809942929901949018L]
s.assertEqual(knapsackutil.merkle_hellman_low_density_CLOS(c, a), m)
s.assertEqual(knapsackutil.merkle_hellman_low_density_LO(c, a), m)
s.assertEqual(knapsackutil.merkle_hellman_modulo(14487, [12084, 18033, 12345, 13333, 10058], 20000), [1, 0, 1, 0, 1])
def test_common_private_exponent(s):
from scryptos.wrapper.common import check
if check("gp") or check("fplll") or check("gap"):
# Common Private Exponent Attack
# ek, nk from reference paper
e1, n1 = 587438623, 2915050561
e2, n2 = 2382816879, 3863354647
e3, n3 = 2401927159, 3943138939
rsa1 = RSA(e1, n1)
rsa2 = RSA(e2, n2)
rsa3 = RSA(e3, n3)
s.assertEqual(rsautil.common_private_exponent([rsa1, rsa2, rsa3]),
655)
def test_lattice(s):
from scryptos.wrapper.common import check
X = [[1, -1, 3], [1, 0, 5], [1, 2, 6]]
# transposed matrix (Pari/GP uses column-based LLL)
X_parigp = [[1, 1, 1], [-1, 0, 2], [3, 5, 6]]
if check("gp"):
s.assertEqual(lattice.LLL(X_parigp, impl="parigp"),
[[0, 1, 0], [1, 0, 1], [-1, 0, 2]])
if check("fplll"):
s.assertEqual(lattice.LLL(X, impl="fplll"),
[[1, -1, 0], [-1, 0, 1], [1, 1, 1]])
if check("gap"):
s.assertEqual(lattice.LLL(X, impl="gap"),
[[1, -1, 0], [0, -1, 1], [1, 1, 1]])
def test_modulus_fault_crt(s):
from scryptos.wrapper.common import check
if check("gp") or check("fplll") or check("gap"):
n = 139597781215932958403361341802832587199L
e = 65537
rsa = RSA(e, n)
fault_sigs = [
1058535326842046404366164623977343348220096515298415971420L,
498516681624023022157905434041816372788280365785800693627L,
804996362997244807580066976356636401798047106638276618248L,
486102002898098045301788623412192711614890707650168500297L,
1109646572715192904427320549147799213950859213551899817975L
]
rsa2 = rsautil.modulus_fault_crt(rsa, fault_sigs)
s.assertEqual(max(rsa2.p, rsa2.q), 14741565978953596877)
