| 1 | n/a | # |
|---|
| 2 | n/a | # Copyright (c) 2008-2016 Stefan Krah. All rights reserved. |
|---|
| 3 | n/a | # |
|---|
| 4 | n/a | # Redistribution and use in source and binary forms, with or without |
|---|
| 5 | n/a | # modification, are permitted provided that the following conditions |
|---|
| 6 | n/a | # are met: |
|---|
| 7 | n/a | # |
|---|
| 8 | n/a | # 1. Redistributions of source code must retain the above copyright |
|---|
| 9 | n/a | # notice, this list of conditions and the following disclaimer. |
|---|
| 10 | n/a | # |
|---|
| 11 | n/a | # 2. Redistributions in binary form must reproduce the above copyright |
|---|
| 12 | n/a | # notice, this list of conditions and the following disclaimer in the |
|---|
| 13 | n/a | # documentation and/or other materials provided with the distribution. |
|---|
| 14 | n/a | # |
|---|
| 15 | n/a | # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" AND |
|---|
| 16 | n/a | # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
|---|
| 17 | n/a | # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
|---|
| 18 | n/a | # ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE |
|---|
| 19 | n/a | # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
|---|
| 20 | n/a | # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
|---|
| 21 | n/a | # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
|---|
| 22 | n/a | # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
|---|
| 23 | n/a | # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
|---|
| 24 | n/a | # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
|---|
| 25 | n/a | # SUCH DAMAGE. |
|---|
| 26 | n/a | # |
|---|
| 27 | n/a | |
|---|
| 28 | n/a | |
|---|
| 29 | n/a | ###################################################################### |
|---|
| 30 | n/a | # This file lists and checks some of the constants and limits used # |
|---|
| 31 | n/a | # in libmpdec's Number Theoretic Transform. At the end of the file # |
|---|
| 32 | n/a | # there is an example function for the plain DFT transform. # |
|---|
| 33 | n/a | ###################################################################### |
|---|
| 34 | n/a | |
|---|
| 35 | n/a | |
|---|
| 36 | n/a | # |
|---|
| 37 | n/a | # Number theoretic transforms are done in subfields of F(p). P[i] |
|---|
| 38 | n/a | # are the primes, D[i] = P[i] - 1 are highly composite and w[i] |
|---|
| 39 | n/a | # are the respective primitive roots of F(p). |
|---|
| 40 | n/a | # |
|---|
| 41 | n/a | # The strategy is to convolute two coefficients modulo all three |
|---|
| 42 | n/a | # primes, then use the Chinese Remainder Theorem on the three |
|---|
| 43 | n/a | # result arrays to recover the result in the usual base RADIX |
|---|
| 44 | n/a | # form. |
|---|
| 45 | n/a | # |
|---|
| 46 | n/a | |
|---|
| 47 | n/a | # ====================================================================== |
|---|
| 48 | n/a | # Primitive roots |
|---|
| 49 | n/a | # ====================================================================== |
|---|
| 50 | n/a | |
|---|
| 51 | n/a | # |
|---|
| 52 | n/a | # Verify primitive roots: |
|---|
| 53 | n/a | # |
|---|
| 54 | n/a | # For a prime field, r is a primitive root if and only if for all prime |
|---|
| 55 | n/a | # factors f of p-1, r**((p-1)/f) =/= 1 (mod p). |
|---|
| 56 | n/a | # |
|---|
| 57 | n/a | def prod(F, E): |
|---|
| 58 | n/a | """Check that the factorization of P-1 is correct. F is the list of |
|---|
| 59 | n/a | factors of P-1, E lists the number of occurrences of each factor.""" |
|---|
| 60 | n/a | x = 1 |
|---|
| 61 | n/a | for y, z in zip(F, E): |
|---|
| 62 | n/a | x *= y**z |
|---|
| 63 | n/a | return x |
|---|
| 64 | n/a | |
|---|
| 65 | n/a | def is_primitive_root(r, p, factors, exponents): |
|---|
| 66 | n/a | """Check if r is a primitive root of F(p).""" |
|---|
| 67 | n/a | if p != prod(factors, exponents) + 1: |
|---|
| 68 | n/a | return False |
|---|
| 69 | n/a | for f in factors: |
|---|
| 70 | n/a | q, control = divmod(p-1, f) |
|---|
| 71 | n/a | if control != 0: |
|---|
| 72 | n/a | return False |
|---|
| 73 | n/a | if pow(r, q, p) == 1: |
|---|
| 74 | n/a | return False |
|---|
| 75 | n/a | return True |
|---|
| 76 | n/a | |
|---|
| 77 | n/a | |
|---|
| 78 | n/a | # ================================================================= |
|---|
| 79 | n/a | # Constants and limits for the 64-bit version |
|---|
| 80 | n/a | # ================================================================= |
|---|
| 81 | n/a | |
|---|
| 82 | n/a | RADIX = 10**19 |
|---|
| 83 | n/a | |
|---|
| 84 | n/a | # Primes P1, P2 and P3: |
|---|
| 85 | n/a | P = [2**64-2**32+1, 2**64-2**34+1, 2**64-2**40+1] |
|---|
| 86 | n/a | |
|---|
| 87 | n/a | # P-1, highly composite. The transform length d is variable and |
|---|
| 88 | n/a | # must divide D = P-1. Since all D are divisible by 3 * 2**32, |
|---|
| 89 | n/a | # transform lengths can be 2**n or 3 * 2**n (where n <= 32). |
|---|
| 90 | n/a | D = [2**32 * 3 * (5 * 17 * 257 * 65537), |
|---|
| 91 | n/a | 2**34 * 3**2 * (7 * 11 * 31 * 151 * 331), |
|---|
| 92 | n/a | 2**40 * 3**2 * (5 * 7 * 13 * 17 * 241)] |
|---|
| 93 | n/a | |
|---|
| 94 | n/a | # Prime factors of P-1 and their exponents: |
|---|
| 95 | n/a | F = [(2,3,5,17,257,65537), (2,3,7,11,31,151,331), (2,3,5,7,13,17,241)] |
|---|
| 96 | n/a | E = [(32,1,1,1,1,1), (34,2,1,1,1,1,1), (40,2,1,1,1,1,1)] |
|---|
| 97 | n/a | |
|---|
| 98 | n/a | # Maximum transform length for 2**n. Above that only 3 * 2**31 |
|---|
| 99 | n/a | # or 3 * 2**32 are possible. |
|---|
| 100 | n/a | MPD_MAXTRANSFORM_2N = 2**32 |
|---|
| 101 | n/a | |
|---|
| 102 | n/a | |
|---|
| 103 | n/a | # Limits in the terminology of Pollard's paper: |
|---|
| 104 | n/a | m2 = (MPD_MAXTRANSFORM_2N * 3) // 2 # Maximum length of the smaller array. |
|---|
| 105 | n/a | M1 = M2 = RADIX-1 # Maximum value per single word. |
|---|
| 106 | n/a | L = m2 * M1 * M2 |
|---|
| 107 | n/a | P[0] * P[1] * P[2] > 2 * L |
|---|
| 108 | n/a | |
|---|
| 109 | n/a | |
|---|
| 110 | n/a | # Primitive roots of F(P1), F(P2) and F(P3): |
|---|
| 111 | n/a | w = [7, 10, 19] |
|---|
| 112 | n/a | |
|---|
| 113 | n/a | # The primitive roots are correct: |
|---|
| 114 | n/a | for i in range(3): |
|---|
| 115 | n/a | if not is_primitive_root(w[i], P[i], F[i], E[i]): |
|---|
| 116 | n/a | print("FAIL") |
|---|
| 117 | n/a | |
|---|
| 118 | n/a | |
|---|
| 119 | n/a | # ================================================================= |
|---|
| 120 | n/a | # Constants and limits for the 32-bit version |
|---|
| 121 | n/a | # ================================================================= |
|---|
| 122 | n/a | |
|---|
| 123 | n/a | RADIX = 10**9 |
|---|
| 124 | n/a | |
|---|
| 125 | n/a | # Primes P1, P2 and P3: |
|---|
| 126 | n/a | P = [2113929217, 2013265921, 1811939329] |
|---|
| 127 | n/a | |
|---|
| 128 | n/a | # P-1, highly composite. All D = P-1 are divisible by 3 * 2**25, |
|---|
| 129 | n/a | # allowing for transform lengths up to 3 * 2**25 words. |
|---|
| 130 | n/a | D = [2**25 * 3**2 * 7, |
|---|
| 131 | n/a | 2**27 * 3 * 5, |
|---|
| 132 | n/a | 2**26 * 3**3] |
|---|
| 133 | n/a | |
|---|
| 134 | n/a | # Prime factors of P-1 and their exponents: |
|---|
| 135 | n/a | F = [(2,3,7), (2,3,5), (2,3)] |
|---|
| 136 | n/a | E = [(25,2,1), (27,1,1), (26,3)] |
|---|
| 137 | n/a | |
|---|
| 138 | n/a | # Maximum transform length for 2**n. Above that only 3 * 2**24 or |
|---|
| 139 | n/a | # 3 * 2**25 are possible. |
|---|
| 140 | n/a | MPD_MAXTRANSFORM_2N = 2**25 |
|---|
| 141 | n/a | |
|---|
| 142 | n/a | |
|---|
| 143 | n/a | # Limits in the terminology of Pollard's paper: |
|---|
| 144 | n/a | m2 = (MPD_MAXTRANSFORM_2N * 3) // 2 # Maximum length of the smaller array. |
|---|
| 145 | n/a | M1 = M2 = RADIX-1 # Maximum value per single word. |
|---|
| 146 | n/a | L = m2 * M1 * M2 |
|---|
| 147 | n/a | P[0] * P[1] * P[2] > 2 * L |
|---|
| 148 | n/a | |
|---|
| 149 | n/a | |
|---|
| 150 | n/a | # Primitive roots of F(P1), F(P2) and F(P3): |
|---|
| 151 | n/a | w = [5, 31, 13] |
|---|
| 152 | n/a | |
|---|
| 153 | n/a | # The primitive roots are correct: |
|---|
| 154 | n/a | for i in range(3): |
|---|
| 155 | n/a | if not is_primitive_root(w[i], P[i], F[i], E[i]): |
|---|
| 156 | n/a | print("FAIL") |
|---|
| 157 | n/a | |
|---|
| 158 | n/a | |
|---|
| 159 | n/a | # ====================================================================== |
|---|
| 160 | n/a | # Example transform using a single prime |
|---|
| 161 | n/a | # ====================================================================== |
|---|
| 162 | n/a | |
|---|
| 163 | n/a | def ntt(lst, dir): |
|---|
| 164 | n/a | """Perform a transform on the elements of lst. len(lst) must |
|---|
| 165 | n/a | be 2**n or 3 * 2**n, where n <= 25. This is the slow DFT.""" |
|---|
| 166 | n/a | p = 2113929217 # prime |
|---|
| 167 | n/a | d = len(lst) # transform length |
|---|
| 168 | n/a | d_prime = pow(d, (p-2), p) # inverse of d |
|---|
| 169 | n/a | xi = (p-1)//d |
|---|
| 170 | n/a | w = 5 # primitive root of F(p) |
|---|
| 171 | n/a | r = pow(w, xi, p) # primitive root of the subfield |
|---|
| 172 | n/a | r_prime = pow(w, (p-1-xi), p) # inverse of r |
|---|
| 173 | n/a | if dir == 1: # forward transform |
|---|
| 174 | n/a | a = lst # input array |
|---|
| 175 | n/a | A = [0] * d # transformed values |
|---|
| 176 | n/a | for i in range(d): |
|---|
| 177 | n/a | s = 0 |
|---|
| 178 | n/a | for j in range(d): |
|---|
| 179 | n/a | s += a[j] * pow(r, i*j, p) |
|---|
| 180 | n/a | A[i] = s % p |
|---|
| 181 | n/a | return A |
|---|
| 182 | n/a | elif dir == -1: # backward transform |
|---|
| 183 | n/a | A = lst # input array |
|---|
| 184 | n/a | a = [0] * d # transformed values |
|---|
| 185 | n/a | for j in range(d): |
|---|
| 186 | n/a | s = 0 |
|---|
| 187 | n/a | for i in range(d): |
|---|
| 188 | n/a | s += A[i] * pow(r_prime, i*j, p) |
|---|
| 189 | n/a | a[j] = (d_prime * s) % p |
|---|
| 190 | n/a | return a |
|---|
| 191 | n/a | |
|---|
| 192 | n/a | def ntt_convolute(a, b): |
|---|
| 193 | n/a | """convolute arrays a and b.""" |
|---|
| 194 | n/a | assert(len(a) == len(b)) |
|---|
| 195 | n/a | x = ntt(a, 1) |
|---|
| 196 | n/a | y = ntt(b, 1) |
|---|
| 197 | n/a | for i in range(len(a)): |
|---|
| 198 | n/a | y[i] = y[i] * x[i] |
|---|
| 199 | n/a | r = ntt(y, -1) |
|---|
| 200 | n/a | return r |
|---|
| 201 | n/a | |
|---|
| 202 | n/a | |
|---|
| 203 | n/a | # Example: Two arrays representing 21 and 81 in little-endian: |
|---|
| 204 | n/a | a = [1, 2, 0, 0] |
|---|
| 205 | n/a | b = [1, 8, 0, 0] |
|---|
| 206 | n/a | |
|---|
| 207 | n/a | assert(ntt_convolute(a, b) == [1, 10, 16, 0]) |
|---|
| 208 | n/a | assert(21 * 81 == (1*10**0 + 10*10**1 + 16*10**2 + 0*10**3)) |
|---|