DE102004044453A1 - Data value testing method for cryptographic applications, involves determining auxiliary value in course of prime number test, and withdrawing another prime number test by auxiliary value - Google Patents

Abstract

The method involves implementing a prime number test according to a probabilistic test method. Another prime number test in accordance to another probabilistic test procedure which differs from former test procedure is implemented, when the former test is not identified as compound number. An auxiliary value is determined in the course of former test, where the latter test is withdrawn by the auxiliary value. Independent claims are also included for the following: (A) a computer program product with several program commands (B) a device, particularly mobile data carrier or a secured cryptographic unit.

Description

The This invention relates generally to the field of cryptography. special The invention relates to the field of probabilistic primality tests and the probabilistic prime number determination. The present described Procedures are referred to as "probabilistic" because they make a compound with a certain probability of error Number wrongly identify as prime. By contrast, in the case considered here a prime never falsely considered as a composite number.

efficient Primality tests and efficient prime numbering techniques for many cryptographic applications required. For example, for key generation in the RSA method described in U.S. Patent 4,405,829, two secret primes are set. The size of these primes depends on the security requirements and is usually a few hundred up to a few thousand bits. This size is expected in Future still significantly increase. Because the primes are kept secret Need to become, must the Prime number generation in a secure environment such as a chip card or a shielded cryptographic unit. Such systems usually have only a relatively low computing power and relatively little available Space on, so on a low resource requirement of the one used for the prime number generation Procedure must be respected.

at the one just mentioned Prime number generation for key generation for asymmetrical (public key) Cryptosystems become numbers in a given search area by chance - at least on the basis of random numbers - chosen and checked for their prime property until a probable prime number is found. For this, the average Error probability of the primality test should be low. For others Application areas, e.g. according to the key exchange protocol Diffie and Hellman, must have a parameter a public key be checked for prime property. Since this parameter may have been chosen by an opponent, here must Probability of error in the worst case Case (worst case error probability) be small.

at All of the probabilistic primality tests considered here can be achieve an arbitrarily small guaranteed probability of error, by conducting a sufficient number of test rounds. Generally determined the required to reach a certain level of reliability Effort - the possible should be kept small - off the number of needed Test rounds and the effort for every single test. In practice, it is also important that one possible good mathematical estimation the error probability that can be achieved by a certain number of test rounds present, thus unnecessary calculation effort can be avoided.

One known probabilistic primality test is the Miller-Rabin test described in the article "Probabilistic Algorithms for Testing Primality" by Michael O. Rabin, published in the Journal of Number Theory 12, 1980, pages 128-138. The Miller-Rabin test is based on the mathematical fact that the following applies to a prime number n: the ring Z _n of the integers modulo n is equivalent to the Galois field GF (n), its multiplicative group Z _n * is cyclic with the Order n - 1, and there is exactly one primitive second unit root, -1. If, for a given n, one of these properties is not true, then n can not be a prime.

The Miller-Rabin test is based on the basic idea of randomly selecting an element from Z _n * and checking whether its order is divisible by n-1. Further, some calculations are performed in the 2-Sylow group of Z _n to check if there are more than 1 additional square roots of 1, as is the case for most composite n.

The error probability of the Miller-Rabin tests in the worst case is at most 4 ^-t, where t test rounds are executed.

Another probabilistic primality test is known as the quadratic Frobenius test (QFT - quadratic Frobenius test). The QFT was presented in the article "A probable prime test with high confidence" by Jon Grantham, published in the Journal of Number Theory 72 (1), 1998, pages 32-47. Since then, the QFT has received keen interest in science and practice, and a number of modifications and advancements have been proposed. By way of example only, the extended quadratic Frobenius test (EQFT) is mentioned here, which is described in the research report by Ivan B. Damgard and Gudmund S. Frandsen, "An extended quadratic Frobenius primality test with average and worst case error esti mates ", BRICS RS-03-9, Aarhus University, Denmark, February 2003.

The starting point for the QFT is the mathematical fact that the ring Z _n [x] / f (x) is equivalent to the Galois field GF (n ² ) if n is a prime and f (x) is an irreducible quadratic polynomial over Z _n is. For a prime number n, various properties are fulfilled in GF (n ² ) and can be checked using randomly selected elements from (Z _n [x] / f (x)) *. Thus, the multiplicative group of GF (n ² ) is cyclic with order n ² - 1, so that the order of each z ε (Z _n [x] / f (x)) * must be divisible by n ² - 1. Furthermore, there is a natural automorphism, namely the conjugation in Z _n [x] / f (x), which for every prime number n is equivalent to the Frobenius automorphism z → z ^p in GF (n ² ). In addition, if n is not divisible by 2 or 3, n ² -1 is divisible by 24, and the body GF (n ² ) has a cyclic group of 24th roots of unity generated by a primitive root if n is a prime number is. All primitive q-th roots z, if they exist, must satisfy the equation Φ _q (z) = 0 for the q-th circular pitch polynomial Φ _q .

In different variants of the QFT different of the above properties - or combinations thereof - are checked. The quadratic polynomial f (x) can either be chosen randomly or fixed. The cost of each round of testing and the resulting reduction in the probability of error depend on the details of the method used. For example, the original, proposed by Grantham QFT in the worst case, a probability of error of about 7710 ^t for t rounds of testing, and the running time is approximately equivalent to three Miller-Rabin tests per lap.

One in the previously mentioned research report by Damgard et al. The EQFT design presented under the designation EQFTwc has an error probability of approximately 256 · 576 ^-2 t for t rounds of ^testing and a running time which approximately corresponds to the runtime of two miller ^rabin tests per test round. However, additional preparatory calculation steps are required, the cost of which is the cost of two Miller-Rabin tests. Another of Damgard et al. Although the proposed variant called EQFTac does not require these preparatory calculation steps, it does not always achieve the desired runtime of two Miller Rabin tests per test round.

task The invention is a particularly efficient technique for primality testing and for to suggest the prime number search. In particular, a predetermined maximum error probability with the least possible computational effort be achieved. In preferred embodiments, the invention especially good for implementation on portable data carriers and other resource constrained Systems are suitable.

According to the invention this Task solved in whole or in part by a test method having the features of claim 1, a search method with the features of claim 14, a computer program product according to claim 19 and a device according to claim 20. The dependent ones claims relate to preferred embodiments of the invention.

The Invention is based on the basic idea out, for the primality test at least two different probabilistic ones Use test method. A first primality test is performed according to a first test procedure. If the first primality test is the data value to check as a possible prime recognizes, at least one more primality test is performed according to a run second test method. This is inventively provided that at the at least one further primality test at least one in the course of the initial value tests. The ones from Thus, information obtained in the first test procedure is not but they are used for at least one more Primality test required calculation effort.

By using two test methods according to the invention, these can be adapted to the requirements particularly well. In particular, it is provided in preferred embodiments to use as the first test method, a relatively fast method that recognizes compound numbers already in many "simple cases" with little effort. The second test procedure, which is more expensive in preferred embodiments, then only needs to be used for the remaining numbers to be tested, which are either prime numbers or not so easily recognizable composite numbers. Based on the ideas according to the invention, embodiments of the invention can be implemented which, in the worst case, have an error probability of approximately 2 ^-12 t for t rounds of ^testing and whose running time always corresponds to the duration of two Miller-Rabin tests per test round of the second test method; the first primality test according to the first test method only requires a runtime such as one mil in these exemplary embodiments ler-Rabin test.

to Reduction of the error probability will preferably be primality tests run several times after the second test procedure until the number to be checked was either recognized as composed or until a predetermined one Maximum number of test rounds is reached. The number to be checked is in such Embodiments only identified as a probable prime number, if they take the first primality test and all other primality tests has passed.

In In preferred embodiments, the first test method is based on the Basic ideas of the Miller-Rabin test, while the second test procedure starting from the basic ideas of the quadratic Frobenius test. The further primality tests do not necessarily need one uniform procedure to become. Rather, in some embodiments of the invention provided that the further primality tests first according to the second Test method and then according to a simplified variant of the second test method can be performed.

at the method according to the invention The search for prime numbers is always followed by at least one data value determined and by an inventive test method - or a Further development - on his Primary property checked out.

Especially for applications for cryptographic purposes, the prime number search determined prime number can not be foreseen by third parties. It is Therefore provided in preferred embodiments that the determined Data value represents a random number.

Preferably the process for prime number search is further developed with ideas that already in the German patent application 10 2004 007 615.4 from 17. February 2004 same inventor and the same applicant described have been. In particular, it can be provided that the examined Data values are followed by test sequences, each determined by a random Start value go out. The number of test rounds containing a data value must exist in order to be regarded as a prime number, it is preferable to proceed with progressing Duration of search - e.g. with increasing number of unsuccessfully searched test sequences - successively elevated.

The Computer program product according to the invention has program instructions to one of the inventive method to implement. Such a computer program product can be physical Be medium, e.g. a semiconductor memory or a floppy disk or a CD-ROM. However, the computer program product may also be non-physical Be medium, e.g. one over a computer network transmitted Signal. In particular, the computer program product may program instructions included in the production or initialization process a portable data carrier or a cryptographic device introduced into this / these become.

The inventive device may in particular be a portable data carrier, e.g. a chip card (smart card in different designs or a chip module or another resource limited System. However, the device can also be a cryptographic unit usually subject to considerable resource constraints as well. In further embodiments of the invention, the device is a common one Computer, e.g. in the key generation for cryptogaphic Purposes is used. The device according to the invention contains in known manner at least one processor, several in different Technologies designed memory and various auxiliary modules such as. Interface circuits, timers and connectors.

In preferred developments have the computer program product and / or the device features the features described in the present specification mentioned and / or the dependent method claims corresponded features.

Further Features, objects and advantages of the invention will become apparent from the following description of several embodiments and alternative embodiments. Reference is made to the schematic drawing.

1 the sole drawing figure illustrates a method sequence according to a simple exemplary embodiment of the invention.

1. Overview of the in 1 shown embodiment

This in 1 The primality test procedure illustrated processes a data value 10 representing a number n to be tested. The data value 10 may be present in any technical representation, eg in the form of binary values corresponding to charge levels or voltage levels in a memory area.

The data value 10 is first in a first primal count 12 examined. For this purpose, a first probabilistic test method is used, which can be based for example on the basic ideas of the Miller-Rabin method. An embodiment of this test method is described in detail in section 3.

Through the first primality test 12 the number n to be examined is identified either as a composite number or as a possible prime number. The classification as a composite number is never erroneous, while the classification as a possible prime number has a certain probability of error. So it's possible that one in the first primality test 12 a number n considered to be a possible prime, is actually a compound number.

When the first primality test 12 If the number to be checked considers n to be a possible prime number, at least one further primality test will be performed 16 executed. The first primality test 12 gives auxiliary values in this case 14 in at least one more primality test 16 used to reduce the computational burden.

In the present embodiment, the auxiliary values include 14 two data values c and ε. The first auxiliary value c is an element of a first mathematical ring, namely the ring of integers modulo n. Specifically, the first auxiliary value c is a small quadratic non-modulus n. In the case n ≠ 1 mod 8, c = -1 or c = 2 are selected. By adding the root of c to the first ring, a second mathematical ring is created, which is a quadratic extension of the first ring. In the case of a prime number n, this second ring is isomorphic to GF (n ² ). The second auxiliary value ε is an element of the second mathematical ring. More specifically, the second auxiliary value ε in the present embodiment is a primitive eighth unit root in the second ring.

That for the further primality tests 16 Test methods used in the present embodiments are based on ideas of the quadratic Frobenius test. However, the test procedure here is particularly simple in design, which, among other things, by the use of the first primality test 12 calculated auxiliary values 14 is possible. The further primality test 16 is therefore referred to here as a simplified quadratic Frobenius test (SQFT - simplified quadratic Frobenius test). Exemplary embodiments of the further primality test 16 are described in detail in Sections 4 and 7 below.

Similar to the first primality test 12 is also used for every further primality test 16 the number n to be tested either safely as a composite number or - but with a certain probability of error - identified as a possible prime. In order to obtain a negligibly small overall error probability - typically being less than the probability of a computational error caused by a hardware failure - the further primality test becomes 16 repeatedly executed as long as the number n to be tested is not recognized as being composed. Any such execution of the second primality test 16 is referred to here as a "test round".

In step 18 a check is made as to whether a predetermined maximum number of successful test rounds - for example two or three rounds of testing - has been reached. If this is the case, it ends in 1 shown method with the result that the data 10 most likely represents a prime number (step 20 ).

If, on the other hand, either the first primality test 12 or in a test round of the second primality test 16 the number n to be checked is recognized as a composite number, the procedure is aborted immediately. It then takes a jump - in 1 represented by dashed arrows - to the result output that the data value 10 surely represents a composite number (step 22 ).

Embodiments of the in 1 The overall primality test procedure detailed below is described in detail below as methods SQFT and SQFT3 in Sections 5 and 7.

In particular, the methods described herein are intended to be performed by a processor of a portable data carrier or a cryptographic device. The procedures are to do this in the form of program instructions contained in a ROM or EEPROM or other memory of the data carrier or cryptographic device.

2. Used Notations and conventions

For the following detailed description of the primality test and search methods, a notation customary in the present technical field is used, which is summarized in this section:
Let Z _{n be} the ring of integers modulo n. For k, n ∈ Z with odd n, the Jacobi symbol is denoted by (k / n) in the following. The largest common divisor gcd (a, b) of two numbers a and b is also written below as (a, b) for the sake of simplicity. The quotient of two numbers a, b is denoted by a / b in the usual way, but to distinguish it from the Jacobi symbol always without immediately enclosing round brackets. The cardinality of a set S is called | S | written.

ist die Primfaktorzerlegung von n.In the following, let P (n) denote for each integer n the set of those primes that share n. For every integer n and prime number p, let v _p (n) be the exponent m of the largest power p ^m of p dividing n. Therefore | P (n) | the number of different prime factors of n, and

is the prime factorization of n.

The i-th circular pitch polynomial is denoted by Φ _i . In the present embodiments, the third and eighth circular pitch polynomials Φ ₃ (z) = z ² + z + 1 and Φ ₈ (z) = z ⁴ + 1 are mainly used.

For an odd natural number n and a unit c modulo n, the ring Z [x] / (n, x ² -c) is denoted by R (n, c) below. Each element of R (n, c) is represented as polynomial ax + b of the first degree with the variable x and the coefficients 0 ≤ a, b <n. The multiplicative group of units in R (n, c) is written as R (n, c) *.

For z = ax + b, the following multiplicative homomorphisms are defined on R (n, c): , : R (n, c) → R (n, c), z = ax - b N (∙): R (n, c) → Z n , N (z) = z · Z = b 2 - approx 2

As usual, will be these two homomorphisms are called conjugation and norm. The conjugation is an automorphism on R (n, c).

In In the following description, the (odd) integer that is on their prime property should always be denoted by n.

The in the following sections, using pseudocode Procedures end each time an output instruction has been reached is. On the express Indication of a procedure end or return instruction after each Output statement is therefore omitted in the pseudocode representations.

3. First test procedure (MR2)

The first test procedure to run the first primality test 12 ( 1 ) is based in the present embodiment on the Miller-Rabin test. Its running time is very low, roughly equal to the duration of a small-scale Miller Rabin test.

If the data value to be tested 10 represents a composite number, this recognizes the first test procedure with considerable probability and ends with the output "n is composed". Does the procedure recognize the data value? 10 not as a compound number, may possibly be prime. It is a peculiarity of the method described here that in this case not only is an output "n possibly possibly prime", but that the method also has auxiliary values 14 which are useful for another primality test - namely, a Frobenius square test in the present embodiment. These auxiliary values 14 are in the present embodiment, a small quadratic non-residue c modulo n and a primitive eighth unit root ε in R (n, c).

In the pseudocode notation used here, the first test procedure is described as follows:

Of the executed by the method MR2 Miller-Rabin test has base 2 if n ≠ 1 (mod 8) and base c, if n = 1 (mod 8). In the second case c will be in step [3] determined as a small random number with (c / n) = -1.

The fact that ε is a primitive eighth unit root in R (n, c) is obvious for the case n = 1 (mod 8) because of ε ⁴ = -1 (mod R (n, c)). For the other cases, this can be done using the standard representation (± 1 ± √ -1 ) / √ 2 The primitive eighth unit roots can be easily checked.

4. Second Test Method (SQFT _RND )

The second test procedure used to perform each additional primality test 16 ( 1 ) is based in the present example on the Frobenius square test. This is a particularly simple variant that provides the auxiliary values provided by the first test method MR2 14 uses. The SQFT _RND test procedure is performed according to the following pseudocode representation:

5. First embodiment of the primality test (SQFT)

In a first exemplary embodiment SQFT, the primality test according to the invention uses the two test methods MR2 and SQFT _RND described above. First, the first test method MR2 is executed. If the examined number n can not already be identified as composed, the second test method SQFT _{RND is} executed at least once.

The processes of the second test method SQFT _RND, which are referred to as "test rounds", are repeated until either the examined number n has been recognized as being composed or until a predefined maximum value t of test rounds has been reached. Only in the latter case, ie, if the number n has passed the first test method MR2 and t rounds of the second test method SQFT _RND , the number n is referred to as the probable prime number. For all test rounds, the auxiliary values determined by the first test method MR2 are 14 - In the present embodiment, the values c and ε - used.

In the pseudocode representation used here, the sequence of the method SQFT can be summarized as follows:

Obviously, neither the method MR2 nor the method SQFT _RND ever classifies a prime number n as composed. This therefore also applies to the method SQFT.

After the first round of testing, the second test method SQFT _{RND can be} further simplified, without thereby increasing the error probability; this will be described in more detail below in Section 9.

The execution of the first test method MR2 at the beginning of the overall method SQFT is particularly advantageous if the method SQFT as part a method for generating primes is used. in this connection have to namely usually many random Candidates are checked for their prime purchasing power, and only the smallest part of the candidates actually turns out to be Prime out. The simple and fast first test procedure MR2 serves as possible many of those candidates who are composite numbers with preferably to identify little effort. This is the first test procedure MR2 well suited, because in practice it is the vast majority Candidates will find and at least twice as fast as the well-known QFT method is.

6. error probability from SQFT

For practical application, it is important that a probabilistic primality test method has a good estimate of the probability of error. As mentioned above, since the method SQFT never mistakenly identifies a prime number as a composite number, here the error probability β _{1, t} (n) is considered to be the probability that the method SQFT falsely calls a composite number n upon execution of t rounds of testing SQFT _RND Classified prime. This error probability β _{1, t} (n) of the worst case error probability (SQFT) worst-case ^test can be estimated with a maximum of 2 ^{-12 t} .

In order to be able to estimate the average error probability of the SQFT (average case behavior) test, a search method which repeatedly chooses an odd integer n with a bit length k and then the method SQFT with a limit of t test rounds to this number n is considered applies. The search range of the numbers n available during the search is denoted M _k in the following; M _k = {n: 2 ^k-1 <n <2 ^k , n is odd}. The search process continues until a number designated by SQFT as the prime number is found. Let us estimate the probability q _{k, t} that the number thus determined is actually a compound number.

The estimation of the probability q _{k, t} determined by the inventor is given in the following table for various practically relevant values of the bit length k and the number of rounds t; each entry in the table represents the negative logarithm of the base 2 of the corresponding probability value q _{k, t} :

For example, the entry "134" in column "t = 2" and row "k = 500" of the table says that -log ₂ q _500,2 ≥ 134. In other words, for a bit length of 500 bits and with only two rounds of ^testing , the average error probability of the search ^method described above is at most 2 ^-134 . This is significantly better than the average error probabilities of 2 ^-80 or 2 ^-100 typically required today by cryptographic norms.

7. Design alternatives with consideration of the third roots of unity (SQFT3 _RND and SQFT3)

In the second test method SQFT _RND described above, which is a particularly simple embodiment, the third unit roots have not been considered. In contrast, the alternative alternatives described in the second test method and the overall method - here referred to as SQFT3 _RND or SQFT3 - provide for a check of properties of the third unit roots. If these properties are not met for a number n to be tested, this number is certainly not a prime number.

The so-supplemented second test method SQFT3 _RND is described as a pseudocode as follows:

gilt. Der in Schritt [7] berechnete Wert ε'₃ ist eine nicht-triviale dritte Einheitswurzel. Die hierfür geforderten Eigenschaften – wenn n eine Primzahl ist – werden in den Schritten [8] und [9] überprüft.The minimum calculated in step [5] of the method SQFT3 _RND exists because in this step

applies. The value ε ' ₃ calculated in step [7] is a non-trivial third unit root. The egg required for this properties - if n is a prime number - are checked in steps [8] and [9].

The following modified embodiment of the overall method SQFT3 uses the second test method SQFT3 _RND in the additional embodiment described above.

To investigate the error probability of the modified method SQFT3, for a composite number n, the probability that the method SQFT3 with t rounds of tests incorrectly identifies the number n as the prime number is denoted by β _{3, t} (n). This error probability β _{3, t} (n) of the worst case error probability ^{SQFT3 primality test} can be estimated with a maximum of 2 ⁴ · 24 ^-4t ≈ 2 ^4-18.36t .

The estimation for average error probability described in section 6 The SQFT primality test in the search procedure mentioned there also applies for the SQFT3 primality test. Here, too, are in many practice-relevant make Only two rounds of testing required today for cryptographic Applications typically guarantee required reliability.

Comparing the methods SQFT and SQFT3 shows that the method SQFT is simpler while SQFT3 provides asymptotically better results. In the case of the cryptographic applications which are preferably considered here, in many cases the method SQFT should be sufficient for the number of prime numbers and error probabilities usual today. Especially when implemented on resource limited systems, eg smart cards, the simplicity of the SQFT method can be a considerable advantage because of the smaller program size. The SQFT3 method, on the other hand, is more preferable if there is enough memory available for the program and for data.

8. Implementation

In the following some hints for the implementation of the method SQFT3 and the achievable running time are given. Taking into consideration these indications, the method can SQFT3 n (1 + o (1)) multiplications are implemented in _n Z at t test rounds with a log expected duration of (2t + 1). ₂ Expressed in units corresponding to the runtime required for a Miller Rabin test, the SQFT3 asymptotically runs for 2 t + 1 Miller Rabin tests for t rounds of testing.

The just mentioned estimates the term and the following implementation notes also apply for the SQFT method because this is just a simplification of SQFT3 represents. However, the method SQFT causes because of its simplicity less overhead (overhead), so it's despite the asymptotic same term for simpler applications is usually preferable.

In the implementations presented here, values from R (n, c) are generally represented by their polynomial coefficients, eg, the value z ∈ R (n, c) by A _z , B _z ∈ Z _n with z = A _z x + B _z , To multiply two values w, z ∈ R (n, c) by w = A _w x + B _w and z = A _z x + B _z then the formula wz = (m 1 + m 2 ) x + (cA z + B z ) (A w + B w ) - cm 1 - m 2 with m ₁ = A _z B _w and m ₂ = B _z A _w used. In the case w = z m ₁ = m ₂ , so that a multiplication can be saved.

verwendet, wobei ε_a = q(a/q – ⌊a/q⌋), ε_b = q(b/q – ⌊b/q⌋) und ε_ab = q(ab/q – ⌊ab/q⌋) gelten.For calculating a value z ^{⌊ab / q⌋} with z ^∈ R (n, c) and a, b, q ∈ N, in the implementations described here, if z ^{⌊a / q⌋} and z ^{⌊b / q⌋} in advance have been calculated and present as interim results, the relationship

where ε _a = q (a / q - ⌊a / q⌋), ε _b = q (b / q - ⌊b / q⌋) and ε _ab = q (ab / q - ⌊ab / q⌋) be valid.

gelten. Diese Zahlen e, f, g werden im folgenden verwendet.For the value u calculated in step [4] of the method SQFT3 _RND , 3 ^u | (n ² - 1) and u> 0, so that we can find integers e, f, g for which the relationships u = e · f + g; 0≤g≤f; e, f> 0 and

be valid. These numbers e, f, g are used below.

In the further notes on the implementation of SQFT3 _RND , a distinction is made between the cases n = 2 mod 3 and n = 1 mod 3. First, consider the former case n = 2 mod 3. Here, n + 1 = 3 ^u · s for the integer s = r / (n - 1). The following sequence of auxiliary values t ₀ , t ₁ , t ₂ ,..., T _e , t _{e + 1 is then} calculated in order, the above rule being used to calculate z ^{⌊ab / q⌋} :

gegeben sind, dann kann nach der obigen Formel t_j für j ≥ 2 mit log₂ 3^f + O(1) Quadrierungen und o(log₂ 3^f) Multiplikationen berechnet werden. Die Berechnung von t₀, t₁ und

kostet zusätzlich log₂ s, log₂ 3^g beziehungsweise log₂ 3^f Quadrierungen und entsprechend weniger Multiplikationen. Insgesamt lautet die Abschätzung für die Anzahl der Quadrierungen daher: log2 s + log2 3f + log2 3g + e·log2 3f + O(e) = = log2 (s·3ef+g) + O(e + f) = log2 n·(1 + o(1)) The calculation of t ₀ , t ₁ , t ₂ ,..., T _e , t _{e + 1} is by far the most complex partial operation in the method SQFT 3 _RND . The following consideration shows that this requires at most log ₂ n * (1 + o (1)) squarings and o (log ₂ n) multiplications in R (n, c): to calculate a k-th power after a squaring and multiplication methods are known to require at most log ₂ k + 0 (1) squarings and o (log ₂ k) multi-lations. If t _j-1 and

Then, according to the above formula, t _j can be calculated for j ≥ 2 with log ₂ 3 ^f + O (1) squarings and o (log ₂ 3 ^f ) multiplications. The calculation of t ₀ , t ₁ and

additionally costs log ₂ s, log ₂ 3 ^g and log ₂ 3 ^f squared and correspondingly less multiplications. Overall, the estimate for the number of squares is therefore: log 2 s + log 2 3 f + log 2 3 G + e · log 2 3 f + O (e) = = log 2 (S · 3 ef + g ) + O (e + f) = log 2 n · (1 + o (1))

The Number of multiplications can be estimated analogously.

gemäß der folgenden Gleichung berechnet:

Furthermore, z ^{-1 is} calculated. From this and from t _{e + 1} = z ^{⌊ (n + 1) / 8⌋} = z ^{(n + 1-ε) / 8} (for an integer ε with 0 ≤ ε <8) then z ^{n is} calculated and in step [2] checks if z ⁿ = z applies. Next, in step [3]

calculated according to the following equation:

überprüft werden. Diese Bedingung ist äquivalent zu z^γ = 1, weil

gilt und z invertierbar ist.To check if z ^γ = 1, you can use instead

be checked. This condition is equivalent to z ^γ = 1 because

and z is invertible.

mit

berechnet werden. Es wird zunächst angenommen, daß dieses Minimum existiert. Wenn dies nicht der Fall ist, dann zeigen die folgenden Berechnungen, daß das Minimum nicht existiert. Für die Berechnung wird das folgende Backtracking-Verfahren verwendet: Es sei τ(j) = max {0, (j – 1)f + g}. Dann ist

Mit den bereits vorliegenden Hilfswerten t_j können weitere Hilfswerte

für j = 0, 1, ..., e + 1 problemlos berechnet werden. Weiter ist die Gleichung

äquivalent zu der folgenden Gleichung:

Finally, to perform steps [5] and [7], the value

With

be calculated. It is first assumed that this minimum exists. If this is not the case then the following calculations show that the minimum does not exist. The following backtracking method is used for the calculation: Let τ (j) = max {0, (j - 1) f + g}. Then

With the already existing auxiliary values t _j , further auxiliary _values can be obtained

for j = 0, 1, ..., e + 1 are easily calculated. Next is the equation

equivalent to the following equation:

definiert ist. Der Wert i – 1 muß die Ungleichung τ(J – 1) ≤ i – 1 ≤ τ(J) – 1 erfüllen. Nun wird die folgende Berechnung ausgeführt:

This equivalence holds because the relations z ⁿ = z and r = s (n-1) are met and because z is invertible. Therefore, a value J can be calculated by

is defined. The value i-1 must satisfy the inequality τ (J-1) ≦ i-1 ≦ τ (J) -1. Now, the following calculation is performed:

in der folgenden Sequenz enthalten sein muß:

From the above considerations it also follows that

must be included in the following sequence:

This sequence can be calculated from the previous results with little effort. The method SQFT3 _RND is thus substantially complete for the case n = 2 mod 3; the remaining steps can be easily implemented.

It is still the case n = 1 mod 3 to treat, which is shown here shorter and with reference to the above statements. In this case n - 1 = 3 ^u · s for the integer s = r / (n + 1). The following sequence of auxiliary values t ₀ , t ₁ , t ₂ ,..., T _e , t _{e + 1} is calculated:

Similar to the case n = 2 mod 3, the effort for the calculation of t ₀ , t ₁ , ..., t _e , t _{e + 1} with at most log ₂ n · (1 + o (1)) squarings and o (log ₂ n) multiplications in R (n, c) can be estimated.

in Schritt [3] wie folgt berechnet:

From t _{e + 1} = z ^{⌊ (n-1) 8⌋} = z ^{(n-1-ε) / 8} (for an integer ε with 0 ≦ ε <8), again z ^{n is} calculated and in step [2] checks if z ⁿ = z applies. Next will be

calculated in step [3] as follows:

Daher können aus

die weiteren Werte

für j = 0, 1, ..., e + 1 berechnet werden. Mit diesen Werten wird schließlich der im Verfahrensschritt [7] benötigte Wert

mit

berechnet, wobei dasselbe Backtracking-Verfahren wie im oben beschriebenen Fall n = 2 mod 3 verwendet wird.Again, let τ (j) = max {0, (j-1) f + g}. This definition of τ (j) yields

Therefore, can out

the other values

for j = 0, 1, ..., e + 1. With these values, finally, the value required in step [7] becomes

With

calculated using the same backtracking method as in the case n = 2 mod 3 described above.

9. Possible optimizations the implementation

The In particular, the implementation illustrated in the previous section may in terms of storage space requirements - and possibly also in the Regarding the term - still be improved. Some possibilities These are presented in this section. Again these optimization possibilities equally applicable to the SQFT and SQFT3 procedures.

In step [4] of the method SQFT, the method SQFT _{RND is called} at most t times, namely once every test round. However, the method SQFT may be modified such that SQFT _{RND is} invoked only in the first round of testing, while in the following t-1 rounds of testing the following method SQFT _{SUBS is} called instead:

The method SQFT3 _RND can be modified in a corresponding manner and called from the second test round of SQFT3.

Using SQFT _SUBS instead of SQFT _RND - or using the appropriately modified version of SQFT3 _RND - saves a Jacobi symbol computation in each round of testing, but slightly increases the overhead of performing step [3].

At first glance, this change does not seem to be advantageous because the computation of a Jacobi symbol essentially requires a modular inversion in Z _n , which usually causes much less effort than the modular exponentiation that is needed anyway. However, this is not always the case for implementation on portable data carriers and similar cryptographic devices because, firstly, some data carriers have dedicated hardware support for modular multiplication-not modular inversion-and secondly, some hardware inelevation protections are more expensive for modular inversion than for modular multiplication.

The in the previous sections 6 and 7 given error estimates also apply to the modifications of the methods SQFT and SQFT3 just described.

In the method SQFT3 _RND , the calculation of the minimum value i in step [5] is particularly costly for large values u = v ₃ (n ² -1). As shown above in section 8, this calculation can be performed relatively efficiently for large numbers n to be checked. However, if the number n to be checked is not so large - as is often the case with cryptographic applications - then the overhead involved in the computation is considerable. In particular, this concerns the case that the number n to be checked is actually prime because most of the composite numbers have already been recognized by the upstream MR2 method.

gilt – dies impliziert, daß für den in Schritt [5] berechneten Minimumwert i die Gleichung i = v₃(n² – 1) gilt –, dann kann in folgenden Testrunden die Berechnung des Minimumwerts i entfallen, wobei in diesen Testrunden dann überprüft wird, ob

ist. Auch Weiterentwicklungen dieser Abwandlung sind möglich, mit denen die Berechnung des Minimumwerts i mit noch größerer Wahrscheinlichkeit vermieden werden kann.To reduce the effort in calculating the minimum value i in the method SQFT3 _RND , the following modification may be provided: If, for the value z selected in step [1], the equation

If - this implies that for the minimum value i calculated in step [5] the equation i = v ₃ (n ² - 1) holds, then the calculation of the minimum value i can be omitted in the following test rounds, whereupon it is checked in these test rounds , if

is. Further developments of this modification are possible with which the calculation of the minimum value i can be even more likely to be avoided.

10th embodiments of methods for determining prime numbers

A particularly simple example of a method for prime number search in which a candidate number n to be checked from a predetermined search range M _{k is} randomly selected and subjected to a prime number test in each step has already been described in Section 6 above. Such a method, however, is not always suitable for practical use, because in resource-constrained devices such as portable data carriers and other cryptographic devices, the generation of random numbers is often cumbersome.

Therefore, in the exemplary embodiment described here, a prime number determination method is used in which an incremental search is carried out. The incremental search begins with a randomly determined starting value n ₀ from the search area M _k . Starting from this start value n ₀ , the values of a test sequence n ₀ , n ₀ + 2, n ₀ + 4,..., N ₀ + 2 (s - 1) are checked successively for their prime property until the first probable prime number is found. If the maximum number s, also referred to as the screen length, of verified values in the test sequence has been reached without a probable prime being found, a new test series is started with a new random number as start value n ₀ . This known per se prioritization method is here compared to the prior art in that not one of the known primality tests, but one of the above-described embodiments of the invention is used as a test method.

The Primary Determination with Incremental Search Needs Much less random numbers than the procedure described in section 6 with random Search. Furthermore, the incremental search method has the advantage that preparatory Trial divisions combined with techniques such as the sieve of Eratosthenes can be to quickly recognize composite numbers with small prime factors and immediately to reject. Such upstream tests or screening methods impair the validity the error estimates given in Sections 6 and 7 for the Primality tests are not, if no primes by the pre-tests be discarded.

However, the probability of error of the incremental search primes determination method is significantly higher than the error probability of the random search method described in Section 6. This is because the successive primality tests within a search queue are not independent of each other. Approximately, in the incremental search method, the error probability increases by a factor of about s ² when the test sequence has the length s, if a probable prime is already found in the first searched test sequence. As more test sequences have to be searched, the probability of error becomes even greater.

For many applications, it is desirable to maintain a low probability of error in the incremental search prime number determination method, even if multiple test sequences must be run through. This can be the case, for example, if a very low total error error or if the individual test sequences contain a relatively large number of "gaps" because the finally determined primes must satisfy additional conditions in addition to their prime property.

In order to keep the overall error probability low, in the following embodiment of the prime number determination method it is proposed to gradually increase the number t of test rounds, which must pass a number n to be examined, until it is regarded as a prime number. More specifically, a parameter r is introduced which indicates after how many unsuccessful searches in each test sequence the test round number t is increased by 1. This method SQFT _INC is described in detail by the following pseudocode representation:

The idea implemented in the method SQFT _{INC to} gradually increase the number of required test rounds in an incremental search has already been described in German Patent Application 10 2004 007 615.4 of 17 February 2004 by the same inventor and the same Applicant. The content of this application is hereby incorporated in full in the present document. In modifications of the method SQFT _{INC it} can be provided not to use the primality test SQFT but another primality test method according to the invention.

In the following, Qk _{, t, s, r} denotes the probability that the method SQFT _INC with the input parameters k, t, s and r as the result does not give a prime number but a composite number. This error probability Q _{k, t, s, r} has been estimated by the inventor. The following table contains some values of -log ₂ Q _{k, t, s, r} depending on the bit length k and the number of laps t. In each case s = c · ln (2 ^k ) and c = r = 10 were selected. This choice of the test sequence size s as a function of k results in an un Danger constant probability that in a test sequence is a prime number. The values for c and r are often chosen smaller than 10 in practice:

The runtime of the SQFT _INC method, expressed in multiples of the runtime for a Miller-Rabin test, may be approximately (ln ( ^2k ) / 2 + 2t) * (1 + c ₃ ) for a small constant c ₃ << 1 be estimated if c ≥ 1 and rc ≥ 10 and k is sufficiently large. This estimation is based on mathematical considerations and practical experience, so that in some cases a longer duration is possible.

The included in the above description of embodiments Details should not be construed as limiting the scope of the Conceived invention but rather as examples of preferred embodiments. Many other modifications are possible and for the obvious. The scope of the invention is therefore intended to be not determined by the illustrated embodiments, but through the claims and their equivalents.

Claims (20)

Method for testing whether a given data value ( 10 ) represents a prime, comprising the steps of: - performing a first primality test ( 12 ) according to a first probabilistic test procedure, and - if in the first primality test ( 12 ) the data value ( 10 ) was not identified as a composite number, then performing at least one further primality test ( 16 ) according to a second probabilistic test method that differs from the first test method, wherein at least one in the course of the first primality test ( 12 ) determined auxiliary value ( 14 ) in the at least one further primality test ( 16 ) for the at least one further primality test ( 16 ) to reduce the required calculation effort. Method according to Claim 1, characterized in that further primality tests ( 16 ) according to the second test procedure until either the data value ( 10 ) is identified as a composite number or until a predetermined maximum number of rounds of testing has been reached. A method according to claim 1 or claim 2, characterized characterized in that first test method less calculation effort than the second test method requires. Method according to one of Claims 1 to 3, characterized in that in the first primality test ( 12 ) a first test base in a first ring is selected, and that in each further primality test ( 16 ) each another test base in a second ring, which is an extension ring of the first ring, is selected. Method according to Claim 4, characterized in that for each primality test ( 12 . 16 ) Calculations using the data value ( 10 ) and the respective test bases, which either show that the data 10 ), or that, with a certain probability, indicate that the data ( 10 ) represented number (n) is a prime number. Method according to Claim 5, characterized in that the first ring is the ring of integers modulo that is represented by the data value ( 10 ), and that the second ring is a quadratic extension of the first ring. Method according to claim 6, characterized in that in the first primality test ( 12 ) as test basis a small quadratic non-residue modulo by the data value ( 10 ) represented number (s) is selected. Method according to Claim 7, characterized in that the value chosen as the quadratic non-residue is -1, if the value represented by the data value ( 10 ) is modulo 4 equivalent to 1, and that the value of 2 or the value -2 is chosen as the quadratic non-residue if the value represented by the data ( 10 ) represented number (n) modulo 8 is equivalent to 5. Method according to one of claims 6 to 8, characterized in that the at least one in the first primality test ( 12 ) determined auxiliary value ( 14 ) is at least one root of unity that is in the second ring and that necessarily exists when the data ( 10 ) represented number (n) is a prime number. Method according to claim 9, characterized in that the at least one in the first primality test ( 12 ) determined auxiliary value ( 14 ) is at least one primitive eighth unit root in the second ring. Method according to one of Claims 1 to 10, characterized in that the first primality test ( 12 ) is a Miller-Rabin test or a variant thereof. Method according to one of Claims 1 to 11, characterized in that the second primality test ( 16 ) is a test round of a Frobenius square test or a variant thereof. Method according to one of claims 1 to 12, characterized that after the execution a first round of the second test procedure for all subsequent ones Test rounds a simplified version of the second test procedure is used. Method of determining a data value that is predominantly Probability represents a prime number, in turn at least one data value determined from a given search area and tested by a method according to any one of claims 1 to 13, to one of the tested data values as a probable prime number is identified. Method according to claim 14, characterized in that that the data values followed by at least one test sequence, wherein each test sequence, starting from a randomly determined starting value, further data values to be tested according to a first predetermined Usually defined. Method according to claim 15, characterized in that that the Number of existing test rounds, up to a tested data value is identified as prime, according to a second predetermined Rule gradually increased becomes. Method according to claim 16, characterized in that that the second predetermined rule is that the number of existing Test rounds after each predetermined number of unsuccessful searched test sequences increased by one. Method according to one of claims 1 to 17, characterized that this Method for cryptographic purposes, in particular for RSA key generation or a Diffie-Hellman key exchange, serves. Computer program product with a plurality of program instructions, causing the at least one processor to retry a method one of the claims 1 to 18. Device, in particular portable data carrier or secure cryptographic unit, with at least one processor and at least one memory, the apparatus being adapted is to carry out a method according to one of claims 1 to 18.