- Source: Blum Blum Shub
- Manuel Blum
- Daftar algoritme
- Daftar topik teori bilangan
- Blum Blum Shub
- Manuel Blum
- Lenore Blum
- Blum–Shub–Smale machine
- List of random number generators
- Blum–Goldwasser cryptosystem
- Blum–Micali algorithm
- Michael Shub
- Shub
- BBS
Artikel: Blum Blum Shub GudangMovies21 Rebahinxxi
blum" target="_blank">Blum blum" target="_blank">Blum Shub (B.B.S.) is a pseudorandom number generator proposed in 1986 by Lenore blum" target="_blank">Blum, Manuel blum" target="_blank">Blum and Michael Shub that is derived from Michael O. Rabin's one-way function.
blum" target="_blank">Blum blum" target="_blank">Blum Shub takes the form
x
n
+
1
=
x
n
2
mod
M
{\displaystyle x_{n+1}=x_{n}^{2}{\bmod {M}}}
,
where M = pq is the product of two large primes p and q. At each step of the algorithm, some output is derived from xn+1; the output is commonly either the bit parity of xn+1 or one or more of the least significant bits of xn+1.
The seed x0 should be an integer that is co-prime to M (i.e. p and q are not factors of x0) and not 1 or 0.
The two primes, p and q, should both be congruent to 3 (mod 4) (this guarantees that each quadratic residue has one square root which is also a quadratic residue), and should be safe primes with a small gcd((p-3)/2, (q-3)/2) (this makes the cycle length large).
An interesting characteristic of the blum" target="_blank">Blum blum" target="_blank">Blum Shub generator is the possibility to calculate any xi value directly (via Euler's theorem):
x
i
=
(
x
0
2
i
mod
λ
(
M
)
)
mod
M
{\displaystyle x_{i}=\left(x_{0}^{2^{i}{\bmod {\lambda }}(M)}\right){\bmod {M}}}
,
where
λ
{\displaystyle \lambda }
is the Carmichael function. (Here we have
λ
(
M
)
=
λ
(
p
⋅
q
)
=
lcm
(
p
−
1
,
q
−
1
)
{\displaystyle \lambda (M)=\lambda (p\cdot q)=\operatorname {lcm} (p-1,q-1)}
).
Security
There is a proof reducing its security to the computational difficulty of factoring. When the primes are chosen appropriately, and O(log log M) lower-order bits of each xn are output, then in the limit as M grows large, distinguishing the output bits from random should be at least as difficult as solving the quadratic residuosity problem modulo M.
The performance of the BBS random-number generator depends on the size of the modulus M and the number of bits per iteration j. While lowering M or increasing j makes the algorithm faster, doing so also reduces the security. A 2005 paper gives concrete, as opposed to asymptotic, security proof of BBS, for a given M and j. The result can also be used to guide choices of the two numbers by balancing expected security against computational cost.
Example
Let
p
=
11
{\displaystyle p=11}
,
q
=
23
{\displaystyle q=23}
and
s
=
3
{\displaystyle s=3}
(where
s
{\displaystyle s}
is the seed). We can expect to get a large cycle length for those small numbers, because
g
c
d
(
(
p
−
3
)
/
2
,
(
q
−
3
)
/
2
)
=
2
{\displaystyle {\rm {gcd}}((p-3)/2,(q-3)/2)=2}
.
The generator starts to evaluate
x
0
{\displaystyle x_{0}}
by using
x
−
1
=
s
{\displaystyle x_{-1}=s}
and creates the sequence
x
0
{\displaystyle x_{0}}
,
x
1
{\displaystyle x_{1}}
,
x
2
{\displaystyle x_{2}}
,
…
{\displaystyle \ldots }
x
5
{\displaystyle x_{5}}
= 9, 81, 236, 36, 31, 202. The following table shows the output (in bits) for the different bit selection methods used to determine the output.
The following is a Python implementation that does check for primality.
The following Common Lisp implementation provides a simple demonstration of the generator, in particular regarding the three bit selection methods. It is important to note that the requirements imposed upon the parameters p, q and s (seed) are not checked.
References
= Citations
== Sources
=External links
GMPBBS, a C-language implementation by Mark Rossmiller
BlumBlumShub, a Java-language implementation by Mark Rossmiller
An implementation in Java
Randomness tests