Golang Int.ModInverse方法代码示例

// GenerateRevocation creates a Revocation that revokes the given member
// private key.
func (priv *PrivateKey) GenerateRevocation(mem *MemberKey) *Revocation {
	s := new(big.Int).Add(priv.gamma, mem.x)
	s.ModInverse(s, bn256.Order)
	aStar := new(bn256.G2).ScalarMult(priv.g2, s)

	return &Revocation{mem.x, mem.a, aStar}
}

// Decrypt takes two integers, resulting from an ElGamal encryption, and
// returns the plaintext of the message. An error can result only if the
// ciphertext is invalid. Users should keep in mind that this is a padding
// oracle and thus, if exposed to an adaptive chosen ciphertext attack, can
// be used to break the cryptosystem.  See ``Chosen Ciphertext Attacks
// Against Protocols Based on the RSA Encryption Standard PKCS #1'', Daniel
// Bleichenbacher, Advances in Cryptology (Crypto '98),
func Decrypt(priv *PrivateKey, c1, c2 *big.Int) (msg []byte, err error) {
	s := new(big.Int).Exp(c1, priv.X, priv.P)
	s.ModInverse(s, priv.P)
	s.Mul(s, c2)
	s.Mod(s, priv.P)
	em := s.Bytes()

	firstByteIsTwo := subtle.ConstantTimeByteEq(em[0], 2)

	// The remainder of the plaintext must be a string of non-zero random
	// octets, followed by a 0, followed by the message.
	//   lookingForIndex: 1 iff we are still looking for the zero.
	//   index: the offset of the first zero byte.
	var lookingForIndex, index int
	lookingForIndex = 1

	for i := 1; i < len(em); i++ {
		equals0 := subtle.ConstantTimeByteEq(em[i], 0)
		index = subtle.ConstantTimeSelect(lookingForIndex&equals0, i, index)
		lookingForIndex = subtle.ConstantTimeSelect(equals0, 0, lookingForIndex)
	}

	if firstByteIsTwo != 1 || lookingForIndex != 0 || index < 9 {
		return nil, errors.New("elgamal: decryption error")
	}
	return em[index+1:], nil
}

//newPrivateKey makes private key from seeds.
func newPrivateKey(pSeed, qSeed big.Int) (*PrivateKey, error) {
	q := &qSeed
	p := &pSeed
	var tmp big.Int
	test := big.NewInt(0x7743)
	var q1, phi, keyD, keyN big.Int
	for count := 0; count < rsaCreateGiveup; count++ {
		q = primize(q)
		q1.Add(q, tmp.SetInt64(-1))
		p = primize(p)
		phi.Add(p, tmp.SetInt64(-1))
		phi.Mul(&phi, &q1)
		keyD.ModInverse(rsaPublicE, &phi)
		if keyD.Cmp(tmp.SetInt64(0)) == 0 {
			continue
		}
		keyN.Mul(p, q)
		tmp.Exp(test, rsaPublicE, &keyN)
		tmp.Exp(&tmp, &keyD, &keyN)
		if tmp.Cmp(test) == 0 {
			return &PrivateKey{&keyN, &keyD}, nil
		}
		p.Add(p, tmp.SetInt64(2))
		q.Add(q, tmp.SetInt64(2))
	}
	err := errors.New("cannot generate private key")
	log.Fatal(err)
	return nil, err
}

func (d *ecdsa) Sign(m []byte) (*big.Int, *big.Int) {
	h := sha1.New()
	if n, err := h.Write(m); n != len(m) || err != nil {
		log.Fatal("Error calculating hash")
	}
	e := h.Sum(nil)
	r, s := new(big.Int), new(big.Int)
	n := d.g.Size()
	z := new(big.Int).SetBytes(e)
	z.Mod(z, n)
	for r.Cmp(new(big.Int)) == 0 || s.Cmp(new(big.Int)) == 0 {
		k := new(big.Int).Rand(rnd, n)
		if k.Cmp(new(big.Int)) == 0 {
			continue
		}
		p := d.g.Pow(d.g.Generator(), k)
		r.Mod(p.(*ellipticCurveElement).x, n)

		k.ModInverse(k, n)
		s.Mul(r, d.key)
		s.Add(s, z)
		s.Mul(s, k)
		s.Mod(s, n)
	}
	return r, s
}

func computeX1(p, g, h, x1 *big.Int) *big.Int {
	t1 := new(big.Int).Exp(g, x1, p)
	t2 := t1.ModInverse(t1, p)
	t3 := t2.Mul(t2, h)
	t3.Mod(t3, p)

	return t3
}

func main() {
	raw, err := ioutil.ReadAll(os.Stdin)
	if err != nil {
		log.Fatalln(err)
	}

	raw_strings := strings.Fields(strings.Replace(string(raw), "\n", " ", -1))

	p, _ := new(big.Int).SetString(raw_strings[0], 0)
	g, _ := new(big.Int).SetString(raw_strings[1], 0)
	h, _ := new(big.Int).SetString(raw_strings[2], 0)

	B := big.NewInt(2)
	B.Exp(B, big.NewInt(20), p)
	mitms := make(map[string]*big.Int)
	one := big.NewInt(1)

	fmt.Println("p:", p)
	fmt.Println("g:", g)
	fmt.Println("h:", h)

	fmt.Println("Started calculating")

	for i := big.NewInt(0); i.Cmp(B) != 0; i.Add(i, one) {
		ex := new(big.Int).Exp(g, i, p)
		ex.ModInverse(ex, p)

		res := ex.Mul(ex, h)
		res.Mod(res, p)

		mitms[res.String()] = new(big.Int).Set(i)
	}

	fmt.Println("Calculated x1s")

	var x1, x0 *big.Int
	var ok bool
	for i := big.NewInt(0); i.Cmp(B) != 0; i.Add(i, one) {
		r := new(big.Int).Exp(g, B, p)
		r.Exp(r, i, p)

		if x1, ok = mitms[r.String()]; ok {
			x0 = new(big.Int).Set(i)
			fmt.Println("Found x0", x0, "x1", x1)
			break
		}
	}

	if x1 == nil || x0 == nil {
		fmt.Println("Something went wrong - no solution")
	} else {
		x := x0.Mul(x0, B)
		x.Add(x, x1)

		fmt.Println(x)
	}
}

// Set to a * b^-1 mod M, where b^-1 is the modular inverse of b.
func (i *Int) Div(a, b abstract.Secret) abstract.Secret {
	ai := a.(*Int)
	bi := b.(*Int)
	var t big.Int
	i.M = ai.M
	i.V.Mul(&ai.V, t.ModInverse(&bi.V, i.M))
	i.V.Mod(&i.V, i.M)
	return i
}

// returns (P / Q, P % Q)
func (p Poly) Div(q Poly, m *big.Int) (quo, rem Poly) {
	if m != nil {
		p.sanitize(m)
		q.sanitize(m)
	}
	if p.GetDegree() < q.GetDegree() || q.isZero() {
		quo = NewPolyInts(0)
		rem = p.Clone(0)
		return
	}
	quo = make([]*big.Int, p.GetDegree()-q.GetDegree()+1)
	rem = p.Clone(0)
	for i := 0; i < len(quo); i++ {
		quo[i] = big.NewInt(0)
	}
	t := p.Clone(0)
	qd := q.GetDegree()
	for {
		td := t.GetDegree()
		rd := td - qd
		if rd < 0 || t.isZero() {
			rem = t
			break
		}
		r := new(big.Int)
		if m != nil {
			r.ModInverse(q[qd], m)
			r.Mul(r, t[td])
			r.Mod(r, m)
		} else {
			r.Div(t[td], q[qd])
		}
		// if r == 0, it means that the highest coefficient of the result is not an integer
		// this polynomial library handles integer coefficients
		if r.Cmp(big.NewInt(0)) == 0 {
			quo = NewPolyInts(0)
			rem = p.Clone(0)
			return
		}
		u := q.Clone(rd)
		for i := rd; i < len(u); i++ {
			u[i].Mul(u[i], r)
			if m != nil {
				u[i].Mod(u[i], m)
			}
		}
		t = t.Sub(u, m)
		t.trim()
		quo[rd] = r
	}
	quo.trim()
	rem.trim()
	return
}

func main() {
	pi := new(big.Int)
	pi.SetString("7199773997391911030609999317773941274322764333428698921736339643928346453700085358802973900485592910475480089726140708102474957429903531369589969318716771", 10)
	gi := new(big.Int)
	gi.SetString("4565356397095740655436854503483826832136106141639563487732438195343690437606117828318042418238184896212352329118608100083187535033402010599512641674644143", 10)
	q := new(big.Int)
	q.SetString("236234353446506858198510045061214171961", 10)

	G := dh.NewFiniteGroup(*pi)
	g := dh.NewFiniteElement(G, *gi)
	GG := dh.NewGeneratedGroup(G, g, *q)
	d := dh.NewDiffieHellman(GG)

	factors := dh.FindCoFactors(q, pi, G)

	moduli := make(map[int64]int64)
	total := big.NewInt(1)

	for factor, h := range factors {
		total.Mul(total, big.NewInt(factor))
		mac := Bob(d, h)
		log.Printf("Guessing the shared secret in the subgroup of order %d", factor)
		found := false
		for i := int64(1); i <= factor; i++ {
			k := G.Pow(h, big.NewInt(i))
			if hmac.Equal(mac, Sign(secretMessage, k)) {
				//log.Printf("%d^%d", elt, i)
				found = true
				moduli[factor] = i
				break
			}
		}
		if !found {
			panic("Could not guess the shared secret")
		}
	}

	// From Wikipedia CRT page
	x := new(big.Int)
	for n, a := range moduli {
		N := new(big.Int).Set(total)
		N.Div(N, big.NewInt(n))
		N.ModInverse(N, big.NewInt(n))
		N.Mul(N, total)
		N.Div(N, big.NewInt(n))
		N.Mul(N, big.NewInt(a))
		x.Add(x, N)
		x.Mod(x, total)
	}
	log.Printf("Predicted key: %d", x)

	log.Printf("%s", d)
}

// Returns (N, e, d) of the given size that encrypts decBytes to encBytes
func chosenEncrytion(decBytes, encBytes []byte, keySize int) (N, e, d *big.Int) {
	padM := new(big.Int).SetBytes(encBytes)
	sig := new(big.Int).SetBytes(decBytes)
	eveP, evePFactors := choosePrime(keySize/2, padM, sig, nil)
	eveQ, eveQFactors := choosePrime(keySize/2, padM, sig, evePFactors)
	eveN := new(big.Int).Mul(eveP, eveQ)

	ep := pohlig(padM, sig, eveP, evePFactors)

	eq := pohlig(padM, sig, eveQ, eveQFactors)

	evePhi := new(big.Int).Set(eveN)
	evePhi.Sub(evePhi, eveP)
	evePhi.Sub(evePhi, eveQ)
	evePhi.Add(evePhi, big.NewInt(1))

	// From Wikipedia CRT page
	eveModuli := make(map[*big.Int]*big.Int)
	newP := new(big.Int).Sub(eveP, big.NewInt(1))
	newQ := new(big.Int).Sub(eveQ, big.NewInt(1))
	// Remove "2" factor so CRT works.
	newP.Div(newP, big.NewInt(2))
	newQ.Div(newQ, big.NewInt(2))
	eveModuli[newP] = new(big.Int).Mod(ep, newP)
	eveModuli[newQ] = new(big.Int).Mod(eq, newQ)
	if new(big.Int).Mod(eq, big.NewInt(2)).Cmp(new(big.Int).Mod(ep, big.NewInt(2))) != 0 {
		log.Fatal("ep and eq are not compatible and CRT won't work")
	}
	eveModuli[big.NewInt(4)] = new(big.Int).Mod(eq, big.NewInt(4))
	eveE := new(big.Int)
	for n, a := range eveModuli {
		N := new(big.Int).Set(evePhi)
		scratch := new(big.Int)
		scratch.Mod(N, n)
		if scratch.Cmp(new(big.Int)) != 0 {
			log.Fatalf("hmm %d / %d", N, n)
		}
		N.Div(N, n)
		scratch.GCD(nil, nil, N, n)
		if scratch.Cmp(big.NewInt(1)) != 0 {
			log.Fatalf("GCD: %d", scratch)
		}
		N.ModInverse(N, n)
		N.Mul(N, evePhi)
		N.Div(N, n)
		N.Mul(N, a)
		eveE.Add(eveE, N)
		eveE.Mod(eveE, evePhi)
	}

	return eveN, eveE, new(big.Int).ModInverse(eveE, evePhi)
}

/* R = 2P */
func (R *Point) double(P *Point, C *Curve) *Point {
	//If at infinity
	if P.inf {
		R.SetInf()
	} else {
		//Calculate slope
		//s = (3*Px² + a) / (2*Py) mod p
		t1 := new(big.Int).Exp(P.x, big.NewInt(2), C.p) // t1 = Px² mod p

		s := new(big.Int).Mul(t1, big.NewInt(3)) // s = 3 * t1

		s.Mod(s, C.p) // s = s mod p

		s.Add(s, C.a) // s = s + a mod p
		s.Mod(s, C.p)

		sd := new(big.Int).Mul(big.NewInt(2), P.y)

		sd.ModInverse(sd, C.p) // sd = 1 / 2*Py mod p

		s.Mul(s, sd) // s = (s / sd) mod p
		s.Mod(s, C.p)

		//Calculate Rx
		//Rx = s² - 2*Px mod p
		s2 := new(big.Int).Exp(s, big.NewInt(2), C.p) //s2 = s²
		s2.Mod(s2, C.p)

		t := new(big.Int).Mul(P.x, big.NewInt(2)) // t = 2*Px mod p
		t.Mod(t, C.p)

		t.Sub(s2, t) // Rx = s2 - t mod p
		R.x.Mod(t, C.p)

		//Calculate Ry using algorithm shown to the right of the commands
		//Ry = s(Px-Rx) - Py mod p

		t.Sub(P.x, R.x) //t = Px - Rx mod p
		t.Mod(t, C.p)

		t.Mul(s, t) //t = s * t mod p
		t.Mod(t, C.p)

		t.Sub(t, P.y) //t = t - Py mod p
		R.y.Mod(t, C.p)

		// 		mpz_mod(R->y, t3, curve->p);	//Ry = t3 mod p

	}
	return R
}

func q1() {
	n := new(big.Int)
	sqrtN := new(big.Int)
	a := new(big.Int)
	asquared := new(big.Int)
	one := new(big.Int)
	x := new(big.Int)
	xsquared := new(big.Int)
	//p := new(big.Int)

	n.SetString("179769313486231590772930519078902473361797697894230657273430081157732675805505620686985379449212982959585501387537164015710139858647833778606925583497541085196591615128057575940752635007475935288710823649949940771895617054361149474865046711015101563940680527540071584560878577663743040086340742855278549092581", 10)
	one.SetString("1", 10)

	sqrtN = mathutil.SqrtBig(n)
	a.Add(sqrtN, one)
	asquared.Mul(a, a)

	xsquared.Sub(asquared, n)

	x = mathutil.SqrtBig(xsquared)

	p := new(big.Int)
	q := new(big.Int)
	p.Sub(a, x)
	q.Add(a, x)

	fmt.Println(a.Sub(a, x).String())

	d := new(big.Int)
	phiN := new(big.Int)
	phiN.Mul(p.Sub(p, one), q.Sub(q, one))
	e := new(big.Int)
	e.SetString("65537", 10)

	//get my decryption exponent
	d.ModInverse(e, phiN)

	c := new(big.Int)
	c.SetString("22096451867410381776306561134883418017410069787892831071731839143676135600120538004282329650473509424343946219751512256465839967942889460764542040581564748988013734864120452325229320176487916666402997509188729971690526083222067771600019329260870009579993724077458967773697817571267229951148662959627934791540", 10)

	m := new(big.Int)
	m.Exp(c, d, n)

	fmt.Println("decrypted message:")
	fmt.Printf("%x\n", m.Bytes())

	//020805907610b524330594e51d5dbbf643f09603731e9817111392d0c64e2739959a092d4daf979d387520ea7e577af9eb50a29f736925e810ab2fb4640e091a0f73252cb669d5b62b26764190ed188239fe71e1a7cb9e935d2db55c98b024e1dae46d00
	answer, _ := hex.DecodeString("466163746f72696e67206c65747320757320627265616b205253412e")
	fmt.Printf("%s\n", answer)
}

// Calculates the Modular Inverse of a given Prime number such that
// (PRIME * MODULAR_INVERSE) & (MAX_INT_VALUE) = 1
// Panics if n is not a valid prime number.
// See: http://en.wikipedia.org/wiki/Modular_multiplicative_inverse
func ModInverse(n uint64) uint64 {

	p := big.NewInt(int64(n))
	if !p.ProbablyPrime(MILLER_RABIN) {
		accuracy := 1.0 - 1.0/math.Pow(float64(4), float64(MILLER_RABIN))
		panic(jsonerror.New(2, "Number is not prime", fmt.Sprintf("n=%d. %d Miller-Rabin tests done. Accuracy: %f", n, MILLER_RABIN, accuracy)))
	}

	var i big.Int

	prime := big.NewInt(int64(n))
	max := big.NewInt(int64(MAX_INT + 1))

	return i.ModInverse(prime, max).Uint64()
}

func TestModInv(t *testing.T) {
	A := new(big.Int)
	B := new(big.Int)
	for _, a := range numbers {
		if a == 0 {
			continue
		}
		A.SetUint64(a)
		b := mod_inv(a)
		B.ModInverse(A, P)
		expected := B.Uint64()
		if b != expected {
			t.Fatalf("inv(%d): Expecting %d but got %d", a, expected, b)
		}
	}
}

func crt(N *big.Int, moduli map[int64]int64) *big.Int {
	// From Wikipedia CRT page
	x := new(big.Int)
	total := N
	for n, a := range moduli {
		N := new(big.Int).Set(total)
		N.Div(N, big.NewInt(n))
		N.ModInverse(N, big.NewInt(n))
		N.Mul(N, total)
		N.Div(N, big.NewInt(n))
		N.Mul(N, big.NewInt(a))
		x.Add(x, N)
		x.Mod(x, total)
	}
	return x
}