Shamir 秘密共享和拉格朗日插值 (OpenSSL BIGNUM)答案

【问题标题】：Shamir secret sharing and Lagrange interpolation (OpenSSL BIGNUM)Shamir 秘密共享和拉格朗日插值 (OpenSSL BIGNUM)
【发布时间】：2013-02-14 23:08:27
【问题描述】：

我之前发布过类似的问题，所以我提前道歉，但我只是无法在这里找到我要去哪里。

我正在使用 C 语言中的 OpenSSL 的 BIGNUM 库实现 Shamir 秘密共享。

在我做一轮拉格朗日插值后，我乘以key * numerator，然后我需要除以分母。

因为没有BN_mod_div函数，所以我改为在分母上使用BN_mod_inverse()，然后相乘，如下所示：

(key * numerator) * (inverse of denominator)

我注意到，如果我使用BN_mod_inverse(denom, denom, q, ctx);，那么应该反转的值保持不变：

Round Key: 2E
Numerator: 14
Denominator: 6  **<---- ORIGINAL DENOMINATOR**
Multiply key with numerator: 398 (POSITIVE)
Invert Denominator: 6 (POSITIVE) **<---------- INVERSE IS THE SAME???**
(Key*Numerator)*inv.Denom: 3FC (POSITIVE)

Round Key: 562
Numerator: A
Denominator: -2
Multiply key with numerator: 118 (POSITIVE)
Invert Denominator: -2 (NEGATIVE)
(Key*Numerator)*inv.Denom: 3AC (POSITIVE)

Round Key: 5D1
Numerator: 8
Denominator: 3
Multiply key with numerator: 584 (POSITIVE)
Invert Denominator: 3 (POSITIVE)
(Key*Numerator)*inv.Denom: 4D4 (POSITIVE)
Recovered Key: C4 (POSITIVE)
Key should = 4D2

如果我把它改成BN_mod_inverse(newBN, denom, q, ctx);，它就会变成零：

Round Key: 2E
Numerator: 14
Denominator: 6 **<---- ORIGINAL DENOMINATOR**
Multiply key with numerator: 398 (POSITIVE)
Invert Denominator: 0 (NEGATIVE)  **<------------ DENOMINATOR IS NOW ZERO??**
(Key*Numerator)*inv.Denom: 0 (NEGATIVE)

Round Key: 562
Numerator: A
Denominator: -2
Multiply key with numerator: 118 (POSITIVE)
Invert Denominator: 0 (NEGATIVE)
(Key*Numerator)*inv.Denom: 0 (NEGATIVE)

Round Key: 5D1
Numerator: 8
Denominator: 3
Multiply key with numerator: 584 (POSITIVE)
Invert Denominator: 0 (NEGATIVE)
(Key*Numerator)*inv.Denom: 0 (NEGATIVE)
Recovered Key: 0 (NEGATIVE)
Key should = 4D2

在任何一种情况下，组合键都是错误的。这里发生了什么？有解决方法吗？

这是我的代码：

BIGNUM *int2BN(int i)
{   
    BIGNUM *tmp = BN_new();
    BN_zero(tmp);

    int g;
    if(i < 0) { //If 'i' is negative
        for (g = 0; g > i; g--) {
            BN_sub(tmp, tmp, one);
        }
    } else { //If 'i' is positive
        for (g = 0; g < i; g++) {
            BN_add(tmp, tmp, one);
        }
    }
    return(tmp);
}   

static void
blah() {
int denomTmp, numTmp, numAccum, denomAccum;
int s, j;   
BIGNUM *accum[3], *bnNum, *bnDenom;
bnNum = BN_new();
bnDenom = BN_new();

/* Lagrange Interpolation */
for (s = 0; s < 3; s++) {
    numAccum = 1;
    denomAccum = 1;
    for (j = 0; j < 3; j++) {
        if(s == j) continue;
        else {
            /* 0 - i[k] = numTmp */
            numTmp = 0 - key[j].keynum;

            /* share - i[k] = denomTmp */
            denomTmp = key[s].keynum - key[j].keynum;

            /* Numerator accumulation: */
            numAccum *= numTmp;

            /* Denominator accumulation: */
            denomAccum *= denomTmp;
        }
    }
    accum[s] = BN_new();
    bnNum = int2BN(numAccum);
    bnDenom = int2BN(denomAccum);

    /* Multiply result by share */
    BN_mod_mul(accum[s], key[s].key, bnNum, q, ctx);

    /* Invert denominator */
    BN_mod_inverse(bnDenom, bnDenom, q, ctx);

    /* Multiply by inverted denominator */
    BN_mod_mul(accum[s], accum[s], bnDenom, q, ctx);

}

int a;
BIGNUM *total = BN_new();
BN_zero(total);
for(a = 0; a < 3; a++) { 
    BN_mod_add(total, total, accum[a], q, ctx);
}   

}

【问题讨论】：

就好像你向我们展示了一个程序的输出——而不是程序——并向我们询问有关它的问题。但这是不可能的，不是吗？我所能做的就是建议你检查BN_mod_inverse的文档
我的问题是“mod_inverse 可以处理小值和/或负值吗？”这个更大的问题。（文档没有涵盖），但我并没有真正说清楚。我把我的来源放进去。
你在哪里设置你的模数q？值是否正确？你解决了这个问题了吗？

标签： cryptography openssl bignum

【解决方案1】：

使用BN_div。余数是模数。即rem = a % d。

int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *a, const BIGNUM *d, BN_CTX *ctx);

BN_div() divides a by d and places the result in dv and the remainder in rem
(dv=a/d, rem=a%d). Either of dv and rem may be NULL, in which case the respective
value is not returned. The result is rounded towards zero; thus if a is negative,
the remainder will be zero or negative. For division by powers of 2, use
BN_rshift(3).

【讨论】：