Prime integers form the basis for finite field and elliptic curve cryptography, as well as many other applications. Provable prime generation guarantees primality and is more efficient than probabilistic generation, and provides components for an efficient primality proof. This paper details a protocol which takes in the proof components from the generation process, proves primality, and as an added benefit, supplies the user with a subgroup generator

Anna M.  Johnston

Rathna Ramesh

Cryptology ePrint Archive

Prime Proof ProtocolAnna M. Johnston, Rathna Rameshamj at juniper dot netJuniper NetworksDecember 14, 2020AbstractPrime integers form the basis for finite field and elliptic curve cryptography, as wellas many other applications. Provable prime generation guarantees primality and ismore efficient than probabilistic generation, and provides components for an efficientprimality proof. This paper details a protocol which takes in the proof componentsfrom the generation process, proves primality, and as an added benefit, supplies theuser with a subgroup generator.1 The Need for a Prime Proof ProtocolPrimes form the bases for many existing asymmetric cryptographic systems. Attacksagainst these systems often focus on primes themselves, introducing the idea of crypto-graphically strong, weak, secure, or even broken prime integers. If primes can be broken,then they are similar to cryptographic keys. It is essential to the security of the systemsto change this parameter regularly. We propose that cryptographic primes have life cycle,just as other cryptographic parameters.Current cryptographic systems using primes have not had the ability to change primesregularly. Fixed primes are the norm in most asymmetric systems based off the discretelogarithm problem. One of the main reasons for this glaring security hole is that updatinga prime isn’t quite as easy as updating most cryptographic parameters. We can generatenew primes easily enough, but exchanging new prime integers has some special challenges.A user who receives a new (possibly) prime integer P for use in finite field based asymmetricsystem must be sure:1• P is actually prime;• P has a cryptographically suitably sized subgroup, of order r[7];• r is prime;• the generator integer used, g, has order r;The protocol described in this paper does exactly this. It allows the proof of a primeto be transmitted and its primality and structure easily checked. The proof process alsoresults in a known generator of the the order required.2 Prime Generation BasicsThere are two general categories of prime generation techniques: probabilistic and prov-able. Let P be the integer we want to test for primality. Both categories are based on thesubgroup structure of multiplicative groups modulo P (i.e., modP ), and use exponentia-tion to gain information about this structure.Probabilistic techniques are fairly simple, theoretically, but require many large moduloP exponentiations to reduce the probability of P being composite. Even then, there isno guarantee that the number generated is prime. For cryptographic uses, the threatis compounded by the need for a second prime: if a prime P is needed for finite fieldcryptography, then a second large prime r must divide (P − 1) [7][8] to prevent grouporder based attacks. If either prime (P or r) is actually composite, the cryptographicalgorithms may be compromised[11].Provable prime generation[5], [10], [4], on the other hand, is theoretically more com-plex, but requires only a small number of exponentiations — generally only two. Basedoff Pocklington’s theorem1 (see appendix A, as well as [6] and [3]), provable primes aregenerated by bootstrapping from smaller known primes.The purpose of a prime tree (figure 1) is to prove that its root is prime. The leavesof the tree are all small primes whose primality is known. Working up from the leaves,proving nodes along the way results in an efficient prime proving algorithm.1Testing random numbers for primality can be done using AKS, but it is not computationally practical.2p = 1103, t = 2, g = 3p = 29, t = 1, g = 2 p = 19, t = 1, g = 2p = 7, t = 0 p = 3, t = 0Figure 1: Simple, concrete prime proof tree with p is the prime for the node, t is thenumber of children, and g is an integer modulo p used to prove primalityIn our algorithm, the prime proof tree is converted to a linear list. The algorithmworks through this list of unproven primes (input list), converting them into a list ofproven primes (output list). As the algorithm continues, primes from the output list areused (and removed) to prove primality on the input list integers, which are then addedto the output list. The end result (assuming a properly formed prime proof tree) is anempty input list and a single remaining prime (the root) on the output list.See examples (section B) for examples of how the proof progresses.3 Prime Proof AlgorithmThe prime proof protocol stores potential primes and the data for proving in a tree struc-ture. To prove an integer P is prime, one or more prime divisors of (P −1) and an element(integer) of a passable order.Two structure are used to organize the prime proof. For simplicity, a structures ele-ments will be written as a:b where a is a structure variable or a pointer to the variableand b is the element being referenced. The shorthand MPI is used to indicate a multipleprecision integer.1. PossiblePrime is used to store the prime proof information;2. prime is used to store a list of previously proved primes needed to proof future3primes.Data Structure: PossiblePrimePurpose: Linked list of primes and information which enables the primeproof protocolData: ▷ p: MPI, holds the prime being tested for primality;▷ numChild: integer, holds count of the number of prime childrenrequired to prove primality;▷ gen: MPI, holds the integer element which passes the prime testfor prime;▷ next: pointer to a PossiblePrime, holds the next prime elementin the list.Data Structure: primePurpose: Simple linked list of primesData: ▷ q : MPI, holding the known prime;▷ next: pointer to prime, holding the next prime in the list.▷ getNewPrime(p, list): allocates and returns a new prime for thelist, initializing it with a MPI (p) that is prime and a pointer (list)to the existing listAlgorithm 3.1: Non-Recursive Prime Proof ProtocolInput:proof: a pointer to the first PossiblePrime in theproof list;smallP: a list of small proven primes, generally pre-generated with the sieve of Eratosthenes.Output: a validation integer: status =−1 bad PossiblePrime tree0 prime proof failed1 prime has been validatedprime pointer: containing validated prime or nil (failure)4I :status =1: Contains success/failure code of proofprimes =∅ : prime, pointer to a list of proven primes;qDiv = 1 : MPI, stores the product of prime divisors of current primeminus 1qRem = 1 : MPI, stores the remaining integer after dividing the cur-rent prime (minus 1) by qDivq = 1 : MPI, stores current known prime that is being used atthe current stage of the proof;P = 1 : MPI, stores integer currently being tested for primality;g = 1 : MPI, stores base used to test current prime;num = 1 : integer, stores number of primes used to prove P is prime.Internal variables andinitial settings:II : while proof ̸= ∅ and status = 1: Continue while there areprimes left to check andno errors occurredA:P=proof:pg=proof:gennum=proof:numChildproof=proof:nextGet the next prime, gen-erator, and number ofchild primes from theproof list, and removethe first proof element.B: If num = 0 Current possible primeshould be in the smallprimes list1: if P is in smallP: primes = getNewPrime(P, primes)2: else: status = 0 failure – given prime isnot acceptableC : else:1:{qRem=P − 1qDiv=1Initialize remainder ofprime order and divisors2: if gqRem ̸≡ 1 mod P: status = 0 Not prime; fails Fermattest3: j = 04: while j < num and status = 1continue until all thechildren needed to proveprimality are used orfailurei: if primes = 0: status = −1 Failure: not enoughproven primes for thisstage of proof5ii: else:⋄{q=primes:qprimes=primes:nextGet the next knownprime off the list andupdate the known primelist⋄ if P ̸≡ 1 mod q: status = −1 Failure: child primedoes not divide the par-ent minus one⋄ else:⋄ while qRem ≡ 0 mod q:{qRem=qRem/qqDiv=qDiv · qDivide out all copies ofq from the remainder,multiply them to the di-visors⋄ if gcd((g(P−1)/q − 1 mod P), P)̸= 1: status = 0 Failure: failed Pockling-ton’s second testiii: j = j + 15: If Algorithm 3.2 with qRem, qDiv returns false: status =−1The known prime divi-sors were too small orfailed Pocklington’s ex-tended test6: else: primes = getNewPrime(P, primes) Prime is proved; Add toknown primes list.III : Return status and Primes.End of Algorithm 3.1Algorithm 3.2: Pocklington’s Extension TestInput: h Random portion of the primeR Known portion of the primeOutput: true if prime, false otherwiseI :PreliminaryConstants : A set of small primes {qj | 0 ≤ j < 1000},with q0 = 5, q1 = 7 an so on.Simple size: If h < R, return true: else if h > R2, return falseStatus : status = falseset constants, check ba-sic size constraints, andset status6II : Set b = (h mod R)2 b and a are multiple pre-cision integersIII : Set a = 4 ·⌊hR⌋IV : If b < a: neg= trueval=a− bComputing b − a, keep-ing track of the negativesignV : else neg= falseval=b− aVI : set j = 0VII : While j < 1000 and status = falseA: Compute v = val(qj−1)/2 mod qjB: if neg is true:1: if (qj − 1)/2 is odd and v = 1: status = true b−a is a quadratic non-residue2: else (qj − 1)/2 is even and v = qj − 1: status = true b−a is a quadratic non-residueC : else if v = (qj − 1): status = trueD: j = j + 1End of Algorithm 3.27A Pocklington’s TheoremTheorem A.1 (Pocklington, 1914): Let P, h,R be integers withP = hR+ 1R =t∏k=1rmkk(1)where rk are distinct prime integers. If there exists an integer gk for each rk withghRk ≡ 1 mod P (2)gcd((ghRrkk mod P)− 1, P)= 1 for all 1 ≤ k ≤ t (3)then all prime factors of P are congruent to one modulo R.Proof. The proof to this can be found in [6],[10], and others. The following is a shortsketch of the proof. Equations (2) and (3) imply that all factors of P have the form(Rhj + 1), or that:P =∏j(Rhj + 1) , for some hj ≥ 1. (4)If P is composite, it will have at least two factors andP = (Rh+ 1) ≥ (Rh0 + 1) (Rh1 + 1)≥ R2h0h1 +R (h0 + h1) + 1h ≥ Rh0h1 + (h0 + h1)If h ≤ R, then h0, h1 can not be greater than or equal to one. This implies only one factorcan exist, and P is prime.Note that for simplicity, a single g which works for all small factors, rk, is generallychosen (i.e., g = gk for all k).A.1 Extending Pocklington’s BoundPocklington based prime generation test (theorem A.1) restricts the size of the randomportion of the prime h, to less than the known portion, R. While this test allows the prime8to double in size at each iteration, there is a simple extension which allows the prime totriple in size at each iteration. Not only does this extension improve the growth rate ofprimes, but it increases entropy and reduces computation costs.The bound on Pocklington’s prime text can be extended ([2], theorem 5 and [4], lemma2) with a simple computation.Corollary A.2 (Extension to Pocklington’s): Let P,R, g be defined as in theorem A.1,satisfying equations (2) and (3); defineβ ≡ h mod R (5)γ =⌊hR⌋(6)If P ≤ R3 (i.e., h ≤ R2) and(β2 − 4γ)is not a perfect square, then P is prime.The extension (theorem A.2) changes the bound on h from h ≤ R to h ≤ R2. Theadded test is simple to implement, and can be done using single precision arithmetic.Assuming the integer passes the exponentiation tests and h < R2, then the only additionaltest is to check that((h mod R)2 − 4⌊hR⌋)is not a perfect square.While h, R are generally both multiple precision integers, the test for not being aperfect square can be reduced to single precision arithmetic. If an integer x is a perfectsquare, then it must be a quadratic residue modulo q for any prime q. If x is not aquadratic residue for any prime q, then x is not a perfect square.Algorithm 3.2 tests for quadratic residue modulo a set of small primes. If the integeris not a quadratic residue for even a single prime, it is not a perfect square and it passesthe extension test.B Primality Proving and Proof TreesB.1 Prockington’s prime Prove ExampleThe tree (figure 1) proves primality of 1103 in the following way:• 7, and 3 are small primes found/proved using the sieve of Eratosthenes.• 29 has only one child (7) and is proved using Pocklington’s theorem:91. 228 ≡ 1 mod 29;2. gcd(228/7 − 1 mod 29, 29)= 13. (28/7) ≤ 7proving that 29 is prime;• 19 has only one child (3) and is proved using Pocklington’s theorem:1. 218 ≡ 1 mod 19;2. gcd(218/3 − 1 mod 19, 19)= 1;3. 18/32 ≤ 32proving that 19 is prime;• Finally, 1103 has 2 children (19, 29):1. 31102 ≡ 1 mod 1103;2. gcd(31102/19 − 1 mod 1103, 1103)= 1;3. gcd(31102/29 − 1 mod 1103, 1103)= 1;4. 1102/(19 · 29) < 19 · 29proving that 1103 is prime.B.2 Pocklington’s example with the Prime Proof ProtocolThe tree in figure 1 converts to the following list of primes (p) and the number of childprimes (n) needed to prove primality.[p = 7n = 0]→[p = 29n = 1]→[p = 3n = 0]→[p = 19n = 1]→[p = 1103n = 2]Here’s how the algorithm progresses, starting with |in| = 5, |out| = 0 nodes in each list.1. The first node on the input list is a known prime2 as is indicated by n = 0. Afterchecking that this prime is in the small prime set, it is added to the output list.|in| = 4, |out| = 12The known prime list are small primes generated up to a certain bound with the sieve of Eratosthenes.102. Next, p = 29 is read. It has one child, so one prime is read off (and removed) fromthe output list – q = 7. After proving it is prime, 29 is added to the output list.|in| = 3, |out| = 13. 3 is read in (zero children), and checked in the small prime set. After it is verified,it is added to the output list. |in| = 2, |out| = 24. 19 is read in, with one child. 3 read from the output list (note the first-in-last-out access), and used to prove 19 is prime. 19 is added to the output list. |in| =2, |out| = 25. Finally, p = 1103 is read from the input list, with n = 2 children. 19 and 29 are readoff the output list, used to prove that 1103 is prime, then p = 1103 is put onto theoutput list, and returning the output list. |in| = 0, |out| = 1B.3 A more complex exampleFigure 2 shows a more complex prime proof tree. Leaf primes are small known primes,generally computed with the sieve of Eratosthenes up to some bound. From there, p(4)0can be proved, then p(3)0 . We can’t prove p(2)0 is prime until p(3)1 is proved, so the nextprimes read in will be1. p(4)1 (small prime),2. p(6)0 , p(6)1 (two more small primes),3. p(5)1 (proved using the last two primes),4. p(4)2 (proved using p(5)1 ),5. p(3)1 (proved using p(4)1 , p(4)2 ),and finally p(2)0 is proved, using p(3)0 and p(3)1 .11p(0)0p(0)1p(0)2 p(1)2p(0)3 p(1)3 p(2)3 p(3)3 p(4)3p(0)4 p(1)4 p(2)4 p(3)4 p(4)4p(0)5 p(1)5 p(2)5 p(3)5p(0)6 p(1)6 p(2)6(p(0)5 , 0) → (p(0)4 , 1) → (p(0)3 , 1) → (p(1)4 , 0) → (p(0)6 , 0) → (p(1)6 , 0) → (p(1)5 , 1) → (p(2)4 , 1) → (p(1)3 , 2) → (p(0)2 , 2)→ (p(2)6 , 0) → (p(2)5 , 1) → (p(3)5 , 0) → (p(3)4 , 2) → (p(2)3 , 1) → (p(4)4 , 0) → (p(3)3 , 1) → (p(4)3 , 0) → (p(1)2 3) → (p(0)1 , 2) → (p(0)0 , 1)Figure 2: Sample prime proof tree, with the number of children given by the tree structure12References[1] M. Agrawal, N. Kayal, and N. Saxena, Primes in p, Tech. report, In-dian Institute of Technology Kanpur, 2002, Updated document on web:http://www.cse.iitk.ac.in/users/manindra/primality_v6.pdf .[2] John Brillhart, D.H. Lehmer, and J.L. Selfridge, New primality criteria and factor-izations of 2m ± 1, Mathematics of Computation 29 (1975), no. 130, 620–647.[3] R. Crandall and C. Pomerance, Prime numbers: A computational perspective, seconded., ch. 4.1, p. 175, Springer-Verlag, 175 Fifth Avenue, New York, New York 10010,U.S.A., 2005.[4] Anna M. Johnston, Designer primes, Cryptology ePrint Archive, Report 2020/1535,2020, https://eprint.iacr.org/2020/1535.[5] Ueli M. Maurer, Fast generation of prime numbers and secure public?? key crypto-graphic parameters, Journal of Cryptology 8 (1995), 123–155.[6] William J. Miller and Nick G. Trbovich, Rsa public-key data encryption system havinglarge random prime number generating microprocessor or the like, 1982, US Patentassigned to Racal-Milgo Inc; expired 2000.[7] Henry C. Pocklington, The determination of the prime or composite nature of largenumbers by fermat’s theorem, Proceedings of the Cambridge Philosophical Society,no. 18, University of Cambridge, 1914–1916, pp. 29–30.[8] S.C. Pohlig and M.E. Hellman, An improved algorithm for computing logarithms overgf(p) and its cryptographic significance, Transactions on Information Theory, no. 24,IEEE, 1978, pp. 106–110.[9] J.M. Pollard, Monte carlo methods for index computation (mod p), Mathematics ofComputation, no. 32, 1978, pp. 918–924.[10] M.O. Rabin, Probabilistic algorithms for testing primality, Journal of Number Theory12 (1980), 128–138.13[11] J. Shawe-Taylor, Generating strong primes, Electronics Letters 22 (1986), 875–877.[12] Jake Massimo Steven D. Galbraith and Kenneth G. Paterson, Safety in numbers:On the need for robust diffie-hellman parameter validation, Public-Key Cryptography(PKC 2019) 11443 (2019), 379–407.14

Prime Proof Protocol

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive