<commit_before>open Sexplib.Conv
open Uncommon

exception Invalid_public_key

type group = {
  p  : Z.t        ;  (* The prime modulus *)
  gg : Z.t        ;  (* Group generator *)
  q  : Z.t option ;  (* `gg`'s order, maybe *)
} with sexp

type secret = { x : Z.t } with sexp

(*
 * Estimates of equivalent-strength exponent sizes for the moduli sizes.
 * 2048-8192 are taken from "Negotiated FF DHE Parameters for TLS."
 * Sizes above and below are further guesswork.
 *)
let exp_equivalent = [
  (1024, 160); (2048, 225); (3072, 275); (4096, 325); (6144, 375); (8192, 400)
]
and exp_equivalent_max = 425

let exp_size bits =
  try snd @@ List.find (fun (g, _) -> g >= bits) exp_equivalent
  with Not_found -> exp_equivalent_max

let apparent_bit_size { p; _ } = Numeric.Z.bits p

(*
 * Current thinking:
 * g^y < 0 || g^y >= p : obviously not computed mod p
 * g^y = 0 || g^y = 1  : shared secret is 0, resp. 1
 * g^y = p - 1         : order of g^y is 2
 * g^y = g             : y mod (p-1) is 1
 *)
let bad_public_key { p; gg; _ } ggx =
  ggx <= Z.one || ggx >= Z.(pred p) || ggx = gg

let public_of_secret ({ p; gg; _ } as group) x =
  match Z.(powm gg x p) with
  | ggx when bad_public_key group ggx
        -> raise Invalid_public_key
  | ggx -> ({ x }, Numeric.Z.to_cstruct_be ggx)

let secret_of_cstruct group ~s =
  public_of_secret group (Numeric.Z.of_cstruct_be s)

(* XXX
 * - gen_bits: slight skew in `mod q` distribution
 * - set msb?
 * - exponentiation time
 *)
let rec gen_secret ?g ?bits ({ p; q; _ } as group) =
  let pb = Numeric.Z.bits p in
  let s  = Rng.Z.gen_bits ?g @@ min<commit_msg>tweak my thinking<commit_after>open Sexplib.Conv
open Uncommon

exception Invalid_public_key

type group = {
  p  : Z.t        ;  (* The prime modulus *)
  gg : Z.t        ;  (* Group generator *)
  q  : Z.t option ;  (* `gg`'s order, maybe *)
} with sexp

type secret = { x : Z.t } with sexp

(*
 * Estimates of equivalent-strength exponent sizes for the moduli sizes.
 * 2048-8192 are taken from "Negotiated FF DHE Parameters for TLS."
 * Sizes above and below are further guesswork.
 *)
let exp_equivalent = [
  (1024, 180); (2048, 225); (3072, 275); (4096, 325); (6144, 375); (8192, 400)
]
and exp_equivalent_max = 425

let exp_size bits =
  try snd @@ List.find (fun (g, _) -> g >= bits) exp_equivalent
  with Not_found -> exp_equivalent_max

let apparent_bit_size { p; _ } = Numeric.Z.bits p

(*
 * Current thinking:
 * g^y < 0 || g^y >= p : obviously not computed mod p
 * g^y = 0 || g^y = 1  : shared secret is 0, resp. 1
 * g^y = p - 1         : order of g^y is 2
 * g^y = g             : y mod (p-1) is 1
 *)
let bad_public_key { p; gg; _ } ggx =
  ggx <= Z.one || ggx >= Z.(pred p) || ggx = gg

let public_of_secret ({ p; gg; _ } as group) x =
  match Z.(powm gg x p) with
  | ggx when bad_public_key group ggx
        -> raise Invalid_public_key
  | ggx -> ({ x }, Numeric.Z.to_cstruct_be ggx)

let secret_of_cstruct group ~s =
  public_of_secret group (Numeric.Z.of_cstruct_be s)

(* XXX
 * - set msb?
 * - exponentiation time
 *)
let rec gen_secret ?g ?bits ({ p; q; _ } as group) =
  let pb = Numeric.Z.bits p in
  let s  = Rng.Z.gen_bits ?g @@ min
{'fraction_non_alphanumeric': 0.13457295934446895, 'fraction_numerical': 0.039079735266309486, 'mean_word_length': 2.7341176470588233, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 17, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5159287', 'n_tokens_mistral': 1336, 'n_tokens_neox': 1214, 'n_words': 402}