Blum Blum Shub

From HandWiki

Blum Blum Shub (B.B.S.) is a pseudorandom number generator proposed in 1986 by Lenore Blum, Manuel Blum and Michael Shub[1] that is derived from Michael O. Rabin's one-way function.

Blum Blum Shub takes the form

[math]\displaystyle{ x_{n+1} = x_n^2 \bmod M }[/math],

where M = pq is the product of two large primes p and q. At each step of the algorithm, some output is derived from xn+1; the output is commonly either the bit parity of xn+1 or one or more of the least significant bits of xn+1.

The seed x0 should be an integer that is co-prime to M (i.e. p and q are not factors of x0) and not 1 or 0.

The two primes, p and q, should both be congruent to 3 (mod 4) (this guarantees that each quadratic residue has one square root which is also a quadratic residue), and should be safe primes with a small gcd((p-3)/2, (q-3)/2) (this makes the cycle length large).

An interesting characteristic of the Blum Blum Shub generator is the possibility to calculate any xi value directly (via Euler's theorem):

[math]\displaystyle{ x_i = \left( x_0^{2^i \bmod \lambda(M)} \right) \bmod M }[/math],

where [math]\displaystyle{ \lambda }[/math] is the Carmichael function. (Here we have [math]\displaystyle{ \lambda(M) = \lambda(p\cdot q) = \operatorname{lcm}(p-1, q-1) }[/math]).

Security

There is a proof reducing its security to the computational difficulty of factoring.[1] When the primes are chosen appropriately, and O(log log M) lower-order bits of each xn are output, then in the limit as M grows large, distinguishing the output bits from random should be at least as difficult as solving the quadratic residuosity problem modulo M.

Example

Let [math]\displaystyle{ p=11 }[/math], [math]\displaystyle{ q=23 }[/math] and [math]\displaystyle{ s=3 }[/math] (where [math]\displaystyle{ s }[/math] is the seed). We can expect to get a large cycle length for those small numbers, because [math]\displaystyle{ {\rm gcd}((p-3)/2, (q-3)/2)=2 }[/math]. The generator starts to evaluate [math]\displaystyle{ x_0 }[/math] by using [math]\displaystyle{ x_{-1}=s }[/math] and creates the sequence [math]\displaystyle{ x_0 }[/math], [math]\displaystyle{ x_1 }[/math], [math]\displaystyle{ x_2 }[/math], [math]\displaystyle{ \ldots }[/math] [math]\displaystyle{ x_5 }[/math] = 9, 81, 236, 36, 31, 202. The following table shows the output (in bits) for the different bit selection methods used to determine the output.

Parity bit Least significant bit
0 1 1 0 1 0 1 1 0 0 1 0

The following is a Python implementation that does check for primality. 

import sympy
def blum_blum_shub(p1, p2, seed, iterations):
  assert p1 % 4 == 3
  assert p2 % 4 == 3
  assert sympy.isprime(p1//2)
  assert sympy.isprime(p2//2)
  n = p1 * p2
  numbers = []
  for _ in range(iterations):
    seed = (seed ** 2) % n
    if seed in numbers:
      print(f"The RNG has fallen into a loop at {len(numbers)} steps")
      return numbers
    numbers.append(seed)
  return numbers

print(blum_blum_shub(11, 23, 3, 100))

The following Common Lisp implementation provides a simple demonstration of the generator, in particular regarding the three bit selection methods. It is important to note that the requirements imposed upon the parameters p, q and s (seed) are not checked. 

(defun get-number-of-1-bits (bits)
  "Returns the number of 1-valued bits in the integer-encoded BITS."
  (declare (type (integer 0 *) bits))
  (the (integer 0 *) (logcount bits)))

(defun get-even-parity-bit (bits)
  "Returns the even parity bit of the integer-encoded BITS."
  (declare (type (integer 0 *) bits))
  (the bit (mod (get-number-of-1-bits bits) 2)))

(defun get-least-significant-bit (bits)
  "Returns the least significant bit of the integer-encoded BITS."
  (declare (type (integer 0 *) bits))
  (the bit (ldb (byte 1 0) bits)))

(defun make-blum-blum-shub (&key (p 11) (q 23) (s 3))
  "Returns a function of no arguments which represents a simple
   Blum-Blum-Shub pseudorandom number generator, configured to use the
   generator parameters P, Q, and S (seed), and returning three values:
   (1) the number x[n+1],
   (2) the even parity bit of the number,
   (3) the least significant bit of the number.
   ---
   Please note that the parameters P, Q, and S are not checked in
   accordance to the conditions described in the article."
  (declare (type (integer 0 *) p q s))
  (let ((M    (* p q))       ;; M  = p * q
        (x[n] s))            ;; x0 = seed
    (declare (type (integer 0 *) M x[n]))
    #'(lambda ()
        ;; x[n+1] = x[n]^2 mod M
        (let ((x[n+1] (mod (* x[n] x[n]) M)))
          (declare (type (integer 0 *) x[n+1]))
          ;; Compute the random bit(s) based on x[n+1].
          (let ((even-parity-bit       (get-even-parity-bit       x[n+1]))
                (least-significant-bit (get-least-significant-bit x[n+1])))
            (declare (type bit even-parity-bit))
            (declare (type bit least-significant-bit))
            ;; Update the state such that x[n+1] becomes the new x[n].
            (setf x[n] x[n+1])
            (values x[n+1]
                    even-parity-bit
                    least-significant-bit))))))

;; Print the exemplary outputs.
(let ((bbs (make-blum-blum-shub :p 11 :q 23 :s 3)))
  (declare (type (function () (values (integer 0 *) bit bit)) bbs))
  (format T "~&Keys: E = even parity, L = least significant")
  (format T "~2%")
  (format T "~&x[n+1] | E | L")
  (format T "~&--------------")
  (loop repeat 6 do
    (multiple-value-bind (x[n+1] even-parity-bit least-significant-bit)
        (funcall bbs)
      (declare (type (integer 0 *) x[n+1]))
      (declare (type bit           even-parity-bit))
      (declare (type bit           least-significant-bit))
      (format T "~&~6d | ~d | ~d"
                x[n+1] even-parity-bit least-significant-bit))))

References

Citations

  1. ↑ 1.0 1.1 Blum, Blum & Shub 1986, pp. 364–383.

Sources

External links



Retrieved from "https://handwiki.org/wiki/index.php?title=Blum_Blum_Shub&oldid=3381458"