Talk:Blum Blum Shub

message: At the moment, it appears as so much gobbledygook to an average reader like myself. It uses obscure terms and references concepts that few people will readily understand.
I'd make an attempt at it myself but there's so little to go on that I would do more harm than good.
Perhaps someone who understands the subject would be prepared to present the concepts in plain English?
LuciusAeliusSejanus (talk) 14:03, 24 February 2016 (UTC)
thread_title: This article needs to be rewritten so that a non-technical user can understand it.

message: Tried to get a feeling what BBS is producing, and how fast it will be on 32bit CPU.
I tried these params: M = 0xffffffe9 = 4294967273 = 10847 * 395959;
p = 10847, phi(p-1) = 4480 = 2^7 * 5 * 7;
q = 395959, phi(q-1) = 131984 = 2^4 * 73 * 113;
gcd(phi(p-1),phi(q-1)) = 2^4 - not "big", right?
seed is, of course, shouldn't be 0 or 1.
Yet, starting with seed 3, I get
9
81
6561
43046721
3793632897
2038349057
2324068865
120648705
1995565057
2418266113
2840043521
1989099521
2099150849
977076225
1954152449
3908304897
3521642497
2748317697
1201668097
2403336193
511705089
1023410177
2046820353
4093640705
3892314113
3489660929
2684354561
1073741825
2147483649
1
1
...
Seeds 5 and 7 perform similarly...
Seems like there are some additional requiremens on params and/or seeds? In case I made silly mistake, code is:
-- most seeds have exactly the same cycle length, some seeds not but uncommun (what are the bad seeds ??)
 #include <stdio.h>
 #define NEXT(x) ((x)*(x)) % 0xffffffe9
 int main() {
        unsigned i = 7;
        while(1) {
                i = NEXT(i);
                printf("%u\n", i);
        }
        return 0;
 }
Googled some BBS related info: http://www.ciphersbyritter.com/NEWS2/TESTSBBS.HTM
:Your M is too large for 32-bit ints. (x)*(x) will cause integer overflow when x > 0xffff. Your code seems to work fine when using 64-bit ints.Ufretin 07:54, 10 January 2007 (UTC)
thread_title: Good example of particular parameters?

message: I don't like the name "Blum Blum Shub" for this page.  I think this material should exist at "Blum-Blum-Shub pseudorandom generator" because (1) that title makes it clear what the article is about, and (2) the standard in crypto literature is to hyphenate author names when written out, eg. Diffie-Hellman key exchange, Goldwasser-Micali cryptosystem, Boneh-Franklin IBE, et cetera.  Actually, now that I think about it, I may try to start a naming convention for crypto articles, because a lot of them are named badly.  Anyway, that's why I moved the page.  Mangojuice 02:06, 21 January 2006 (UTC)
thread_title:  Move page? 

message: Is the Big O function supposed to be "log log M" or is that just a typo?  Is it supposed to be the log of the log of M? Zero 13:15, 12 September 2006 (UTC)
thread_title:  Possible Mistake 

message: The page says that p and q should be primes, but q=15 in the example doesn't seem like a prime to me. Either there is a mistake in the example, or the description of the algorithm is somehow misleading. -- Samuli, 1 September 2006.
:There is yet another mistake in the example. For p = 11 and q = 19 the resulting bits would be b0b1...b5 = 1 0 0 0 0 0. Michael Prager 13:29, 15 November 2006 (UTC)
replies: text: The writer probably meant that b_i is determined by taking the bit parity of x_i. I tried to clarify this. -- Jitse Niesen (talk) 02:24, 16 November 2006 (UTC)
thread_title:  Mistake in the Example? 

message: If I want to understand the example, but have no idea what phi means. How may I go about finding what it means in context? It is un-googlable.  —Preceding unsigned comment added by 70.189.96.232 (talk) 01:57, 26 February 2008 (UTC)
replies: text: A link on the symbol \varphi already directs its definition, i.e. the article on Euler's totient function. But, the link is indeed easy to overlook. 85.2.120.226 (talk) 06:22, 26 February 2008 (UTC)
replies: text: Neat. At the first mention. I see it now. I had actually landed on that page earlier via a list of symbols on the wiki but dismissed it because it looks different on that page.70.189.96.232 (talk) 23:45, 26 February 2008 (UTC)
thread_title:  Math is Thick 

message: At the end of the first paragraph in "Example":
"The following table shows different output bits of different bit is used to determine the output."
It might just be me, but as far as I can tell, that makes no sense. I for one am completely unable to figure out what it means. Was this a relic from someone's revisions of the section? Could someone who has an idea what it is meant to mean fix it up?
:I've just made an attempt to clarify this (and answer the question below). Wocky (talk) 01:39, 5 November 2009 (UTC)
thread_title:  Relic of Revisions? 

message: In the worked example p=11 q=19 and s=3. x-1 is set at s, what is s? if it's arbitary variable as p,q then why not just say an x-1 is picked. Elsewise how about a description of s?86.132.9.254 (talk)  —Preceding undated comment added 21:09, 9 August 2009 (UTC)
replies: text: I would image that s stands for seed, as that’s the role it takes here. It’s slightly nicer (aesthetically) to say the algorithm is defined by the tuple (p,q,s) than (p,q,x−1). —Stephen Morley (talk) 07:20, 23 September 2009 (UTC)
thread_title:  But then who was S? 

message: The formula for calculating x_i directly states that  x_i = \left( x_0^{2^i \bmod (p-1)(q-1)} \right) \bmod M. 
However, in the original paper the formula is given as x_i = \left( x_0^{2^i \bmod \lambda(M)} \right) \bmod M where \lambda is the Carmichael function.
Since M = pq, then \lambda(pq) = lcm \left( \lambda(p), \lambda(q) \right) = lcm ( p - 1, q - 1), which is not always equal to (p-1)(q-1) (for example, when p = 5 and q = 7, (p-1)(q-1) = 24 but lcm(p-1, q-1) = 12).
Is there a problem with my math or is the article incorrect?
Thanks. Rapidflash (talk) 04:38, 10 November 2010 (UTC)
thread_title:  Error in formula for calculating <math>x_i</math>? 

message: The summary says that p and q should be primes, and that "gcd(φ(p), φ(q)) should be small".
Assuming this is correct, it's unnecessarily complicated, because Euler's_totient_function states that for prime p, φ(p) = p-1.  Therefore, that could be written more clearly as "gcd(p - 1, q - 1)".
The example, however, refers "gcd(φ(p - 1), φ(q - 1))". I suspect that this was intended to be "gcd(p - 1, q - 1)", since that's consistent with the "gcd(φ(p), φ(q))" above.
Stevie-O (talk) 18:57, 23 September 2019 (UTC)
thread_title:  Inconsistent/confusing use of φ in summary/example