/*

* Copyright (c) 1996, 2018, Oracle and/or its affiliates. All rights reserved.

* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

*

* This code is free software; you can redistribute it and/or modify it

* under the terms of the GNU General Public License version 2 only, as

* published by the Free Software Foundation. Oracle designates this

* particular file as subject to the "Classpath" exception as provided

* by Oracle in the LICENSE file that accompanied this code.

*

* This code is distributed in the hope that it will be useful, but WITHOUT

* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License

* version 2 for more details (a copy is included in the LICENSE file that

* accompanied this code).

*

* You should have received a copy of the GNU General Public License version

* 2 along with this work; if not, write to the Free Software Foundation,

* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

*

* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

* or visit www.oracle.com if you need additional information or have any

* questions.

*/

/*

* Portions Copyright (c) 1995 Colin Plumb. All rights reserved.

*/

package java.math;

import java.io.IOException;

import java.io.ObjectInputStream;

import java.io.ObjectOutputStream;

import java.io.ObjectStreamField;

import java.util.Arrays;

import java.util.Random;

import java.util.concurrent.ThreadLocalRandom;

import sun.misc.DoubleConsts;

import sun.misc.FloatConsts;

/**

* Immutable arbitrary-precision integers. All operations behave as if

* BigIntegers were represented in two's-complement notation (like Java's

* primitive integer types). BigInteger provides analogues to all of Java's

* primitive integer operators, and all relevant methods from java.lang.Math.

* Additionally, BigInteger provides operations for modular arithmetic, GCD

* calculation, primality testing, prime generation, bit manipulation,

* and a few other miscellaneous operations.

*

* <p>Semantics of arithmetic operations exactly mimic those of Java's integer

* arithmetic operators, as defined in <i>The Java Language Specification</i>.

* For example, division by zero throws an {@code ArithmeticException}, and

* division of a negative by a positive yields a negative (or zero) remainder.

* All of the details in the Spec concerning overflow are ignored, as

* BigIntegers are made as large as necessary to accommodate the results of an

* operation.

*

* <p>Semantics of shift operations extend those of Java's shift operators

* to allow for negative shift distances. A right-shift with a negative

* shift distance results in a left shift, and vice-versa. The unsigned

* right shift operator ({@code >>>}) is omitted, as this operation makes

* little sense in combination with the "infinite word size" abstraction

* provided by this class.

*

* <p>Semantics of bitwise logical operations exactly mimic those of Java's

* bitwise integer operators. The binary operators ({@code and},

* {@code or}, {@code xor}) implicitly perform sign extension on the shorter

* of the two operands prior to performing the operation.

*

* <p>Comparison operations perform signed integer comparisons, analogous to

* those performed by Java's relational and equality operators.

*

* <p>Modular arithmetic operations are provided to compute residues, perform

* exponentiation, and compute multiplicative inverses. These methods always

* return a non-negative result, between {@code 0} and {@code (modulus - 1)},

* inclusive.

*

* <p>Bit operations operate on a single bit of the two's-complement

* representation of their operand. If necessary, the operand is sign-

* extended so that it contains the designated bit. None of the single-bit

* operations can produce a BigInteger with a different sign from the

* BigInteger being operated on, as they affect only a single bit, and the

* "infinite word size" abstraction provided by this class ensures that there

* are infinitely many "virtual sign bits" preceding each BigInteger.

*

* <p>For the sake of brevity and clarity, pseudo-code is used throughout the

* descriptions of BigInteger methods. The pseudo-code expression

* {@code (i + j)} is shorthand for "a BigInteger whose value is

* that of the BigInteger {@code i} plus that of the BigInteger {@code j}."

* The pseudo-code expression {@code (i == j)} is shorthand for

* "{@code true} if and only if the BigInteger {@code i} represents the same

* value as the BigInteger {@code j}." Other pseudo-code expressions are

* interpreted similarly.

*

* <p>All methods and constructors in this class throw

* {@code NullPointerException} when passed

* a null object reference for any input parameter.

*

* BigInteger must support values in the range

* -2^{{@code Integer.MAX_VALUE}} (exclusive) to

* +2^{{@code Integer.MAX_VALUE}} (exclusive)

* and may support values outside of that range.

*

* The range of probable prime values is limited and may be less than

* the full supported positive range of {@code BigInteger}.

* The range must be at least 1 to 2^500000000.

*

* @implNote

* BigInteger constructors and operations throw {@code ArithmeticException} when

* the result is out of the supported range of

* -2^{{@code Integer.MAX_VALUE}} (exclusive) to

* +2^{{@code Integer.MAX_VALUE}} (exclusive).

*

* @see BigDecimal

* @author Josh Bloch

* @author Michael McCloskey

* @author Alan Eliasen

* @author Timothy Buktu

* @since JDK1.1

*/

public class BigInteger extends Number implements Comparable<BigInteger> {

/**

* The signum of this BigInteger: -1 for negative, 0 for zero, or

* 1 for positive. Note that the BigInteger zero <i>must</i> have

* a signum of 0. This is necessary to ensures that there is exactly one

* representation for each BigInteger value.

*

* @serial

*/

final int signum;

/**

* The magnitude of this BigInteger, in <i>big-endian</i> order: the

* zeroth element of this array is the most-significant int of the

* magnitude. The magnitude must be "minimal" in that the most-significant

* int ({@code mag[0]}) must be non-zero. This is necessary to

* ensure that there is exactly one representation for each BigInteger

* value. Note that this implies that the BigInteger zero has a

* zero-length mag array.

*/

final int[] mag;

// These "redundant fields" are initialized with recognizable nonsense

// values, and cached the first time they are needed (or never, if they

// aren't needed).

/**

* One plus the bitCount of this BigInteger. Zeros means unitialized.

*

* @serial

* @see #bitCount

* @deprecated Deprecated since logical value is offset from stored

* value and correction factor is applied in accessor method.

*/

@Deprecated

private int bitCount;

/**

* One plus the bitLength of this BigInteger. Zeros means unitialized.

* (either value is acceptable).

*

* @serial

* @see #bitLength()

* @deprecated Deprecated since logical value is offset from stored

* value and correction factor is applied in accessor method.

*/

@Deprecated

private int bitLength;

/**

* Two plus the lowest set bit of this BigInteger, as returned by

* getLowestSetBit().

*

* @serial

* @see #getLowestSetBit

* @deprecated Deprecated since logical value is offset from stored

* value and correction factor is applied in accessor method.

*/

@Deprecated

private int lowestSetBit;

/**

* Two plus the index of the lowest-order int in the magnitude of this

* BigInteger that contains a nonzero int, or -2 (either value is acceptable).

* The least significant int has int-number 0, the next int in order of

* increasing significance has int-number 1, and so forth.

* @deprecated Deprecated since logical value is offset from stored

* value and correction factor is applied in accessor method.

*/

@Deprecated

private int firstNonzeroIntNum;

/**

* This mask is used to obtain the value of an int as if it were unsigned.

*/

final static long LONG_MASK = 0xffffffffL;

/**

* This constant limits {@code mag.length} of BigIntegers to the supported

* range.

*/

private static final int MAX_MAG_LENGTH = Integer.MAX_VALUE / Integer.SIZE + 1; // (1 << 26)

/**

* Bit lengths larger than this constant can cause overflow in searchLen

* calculation and in BitSieve.singleSearch method.

*/

private static final int PRIME_SEARCH_BIT_LENGTH_LIMIT = 500000000;

/**

* The threshold value for using Karatsuba multiplication. If the number

* of ints in both mag arrays are greater than this number, then

* Karatsuba multiplication will be used. This value is found

* experimentally to work well.

*/

private static final int KARATSUBA_THRESHOLD = 80;

/**

* The threshold value for using 3-way Toom-Cook multiplication.

* If the number of ints in each mag array is greater than the

* Karatsuba threshold, and the number of ints in at least one of

* the mag arrays is greater than this threshold, then Toom-Cook

* multiplication will be used.

*/

private static final int TOOM_COOK_THRESHOLD = 240;

/**

* The threshold value for using Karatsuba squaring. If the number

* of ints in the number are larger than this value,

* Karatsuba squaring will be used. This value is found

* experimentally to work well.

*/

private static final int KARATSUBA_SQUARE_THRESHOLD = 128;

/**

* The threshold value for using Toom-Cook squaring. If the number

* of ints in the number are larger than this value,

* Toom-Cook squaring will be used. This value is found

* experimentally to work well.

*/

private static final int TOOM_COOK_SQUARE_THRESHOLD = 216;

/**

* The threshold value for using Burnikel-Ziegler division. If the number

* of ints in the divisor are larger than this value, Burnikel-Ziegler

* division may be used. This value is found experimentally to work well.

*/

static final int BURNIKEL_ZIEGLER_THRESHOLD = 80;

/**

* The offset value for using Burnikel-Ziegler division. If the number

* of ints in the divisor exceeds the Burnikel-Ziegler threshold, and the

* number of ints in the dividend is greater than the number of ints in the

* divisor plus this value, Burnikel-Ziegler division will be used. This

* value is found experimentally to work well.

*/

static final int BURNIKEL_ZIEGLER_OFFSET = 40;

/**

* The threshold value for using Schoenhage recursive base conversion. If

* the number of ints in the number are larger than this value,

* the Schoenhage algorithm will be used. In practice, it appears that the

* Schoenhage routine is faster for any threshold down to 2, and is

* relatively flat for thresholds between 2-25, so this choice may be

* varied within this range for very small effect.

*/

private static final int SCHOENHAGE_BASE_CONVERSION_THRESHOLD = 20;

/**

* The threshold value for using squaring code to perform multiplication

* of a {@code BigInteger} instance by itself. If the number of ints in

* the number are larger than this value, {@code multiply(this)} will

* return {@code square()}.

*/

private static final int MULTIPLY_SQUARE_THRESHOLD = 20;

/**

* The threshold for using an intrinsic version of

* implMontgomeryXXX to perform Montgomery multiplication. If the

* number of ints in the number is more than this value we do not

* use the intrinsic.

*/

private static final int MONTGOMERY_INTRINSIC_THRESHOLD = 512;

// Constructors

/**

* Translates a byte array containing the two's-complement binary

* representation of a BigInteger into a BigInteger. The input array is

* assumed to be in <i>big-endian</i> byte-order: the most significant

* byte is in the zeroth element.

*

* @param val big-endian two's-complement binary representation of

* BigInteger.

* @throws NumberFormatException {@code val} is zero bytes long.

*/

public BigInteger(byte[] val) {

if (val.length == 0)

throw new NumberFormatException("Zero length BigInteger");

if (val[0] < 0) {

mag = makePositive(val);

signum = -1;

} else {

mag = stripLeadingZeroBytes(val);

signum = (mag.length == 0 ? 0 : 1);

}

if (mag.length >= MAX_MAG_LENGTH) {

checkRange();

}

}

/**

* This private constructor translates an int array containing the

* two's-complement binary representation of a BigInteger into a

* BigInteger. The input array is assumed to be in <i>big-endian</i>

* int-order: the most significant int is in the zeroth element.

*/

private BigInteger(int[] val) {

if (val.length == 0)

throw new NumberFormatException("Zero length BigInteger");

if (val[0] < 0) {

mag = makePositive(val);

signum = -1;

} else {

mag = trustedStripLeadingZeroInts(val);

signum = (mag.length == 0 ? 0 : 1);

}

if (mag.length >= MAX_MAG_LENGTH) {

checkRange();

}

}

/**

* Translates the sign-magnitude representation of a BigInteger into a

* BigInteger. The sign is represented as an integer signum value: -1 for

* negative, 0 for zero, or 1 for positive. The magnitude is a byte array

* in <i>big-endian</i> byte-order: the most significant byte is in the

* zeroth element. A zero-length magnitude array is permissible, and will

* result in a BigInteger value of 0, whether signum is -1, 0 or 1.

*

* @param signum signum of the number (-1 for negative, 0 for zero, 1

* for positive).

* @param magnitude big-endian binary representation of the magnitude of

* the number.

* @throws NumberFormatException {@code signum} is not one of the three

* legal values (-1, 0, and 1), or {@code signum} is 0 and

* {@code magnitude} contains one or more non-zero bytes.

*/

public BigInteger(int signum, byte[] magnitude) {

this.mag = stripLeadingZeroBytes(magnitude);

if (signum < -1 || signum > 1)

throw(new NumberFormatException("Invalid signum value"));

if (this.mag.length == 0) {

this.signum = 0;

} else {

if (signum == 0)

throw(new NumberFormatException("signum-magnitude mismatch"));

this.signum = signum;

}

if (mag.length >= MAX_MAG_LENGTH) {

checkRange();

}

}

/**

* A constructor for internal use that translates the sign-magnitude

* representation of a BigInteger into a BigInteger. It checks the

* arguments and copies the magnitude so this constructor would be

* safe for external use.

*/

private BigInteger(int signum, int[] magnitude) {

this.mag = stripLeadingZeroInts(magnitude);

if (signum < -1 || signum > 1)

throw(new NumberFormatException("Invalid signum value"));

if (this.mag.length == 0) {

this.signum = 0;

} else {

if (signum == 0)

throw(new NumberFormatException("signum-magnitude mismatch"));

this.signum = signum;

}

if (mag.length >= MAX_MAG_LENGTH) {

checkRange();

}

}

/**

* Translates the String representation of a BigInteger in the

* specified radix into a BigInteger. The String representation

* consists of an optional minus or plus sign followed by a

* sequence of one or more digits in the specified radix. The

* character-to-digit mapping is provided by {@code

* Character.digit}. The String may not contain any extraneous

* characters (whitespace, for example).

*

* @param val String representation of BigInteger.

* @param radix radix to be used in interpreting {@code val}.

* @throws NumberFormatException {@code val} is not a valid representation

* of a BigInteger in the specified radix, or {@code radix} is

* outside the range from {@link Character#MIN_RADIX} to

* {@link Character#MAX_RADIX}, inclusive.

* @see Character#digit

*/

public BigInteger(String val, int radix) {

int cursor = 0, numDigits;

final int len = val.length();

if (radix < Character.MIN_RADIX || radix > Character.MAX_RADIX)

throw new NumberFormatException("Radix out of range");

if (len == 0)

throw new NumberFormatException("Zero length BigInteger");

// Check for at most one leading sign

int sign = 1;

int index1 = val.lastIndexOf('-');

int index2 = val.lastIndexOf('+');

if (index1 >= 0) {

if (index1 != 0 || index2 >= 0) {

throw new NumberFormatException("Illegal embedded sign character");

}

sign = -1;

cursor = 1;

} else if (index2 >= 0) {

if (index2 != 0) {

throw new NumberFormatException("Illegal embedded sign character");

}

cursor = 1;

}

if (cursor == len)

throw new NumberFormatException("Zero length BigInteger");

// Skip leading zeros and compute number of digits in magnitude

while (cursor < len &&

Character.digit(val.charAt(cursor), radix) == 0) {

cursor++;

}

if (cursor == len) {

signum = 0;

mag = ZERO.mag;

return;

}

numDigits = len - cursor;

signum = sign;

// Pre-allocate array of expected size. May be too large but can

// never be too small. Typically exact.

long numBits = ((numDigits * bitsPerDigit[radix]) >>> 10) + 1;

if (numBits + 31 >= (1L << 32)) {

reportOverflow();

}

int numWords = (int) (numBits + 31) >>> 5;

int[] magnitude = new int[numWords];

// Process first (potentially short) digit group

int firstGroupLen = numDigits % digitsPerInt[radix];

if (firstGroupLen == 0)

firstGroupLen = digitsPerInt[radix];

String group = val.substring(cursor, cursor += firstGroupLen);

magnitude[numWords - 1] = Integer.parseInt(group, radix);

if (magnitude[numWords - 1] < 0)

throw new NumberFormatException("Illegal digit");

// Process remaining digit groups

int superRadix = intRadix[radix];

int groupVal = 0;

while (cursor < len) {

group = val.substring(cursor, cursor += digitsPerInt[radix]);

groupVal = Integer.parseInt(group, radix);

if (groupVal < 0)

throw new NumberFormatException("Illegal digit");

destructiveMulAdd(magnitude, superRadix, groupVal);

}

// Required for cases where the array was overallocated.

mag = trustedStripLeadingZeroInts(magnitude);

if (mag.length >= MAX_MAG_LENGTH) {

checkRange();

}

}

/*

* Constructs a new BigInteger using a char array with radix=10.

* Sign is precalculated outside and not allowed in the val.

*/

BigInteger(char[] val, int sign, int len) {

int cursor = 0, numDigits;

// Skip leading zeros and compute number of digits in magnitude

while (cursor < len && Character.digit(val[cursor], 10) == 0) {

cursor++;

}

if (cursor == len) {

signum = 0;

mag = ZERO.mag;

return;

}

numDigits = len - cursor;

signum = sign;

// Pre-allocate array of expected size

int numWords;

if (len < 10) {

numWords = 1;

} else {

long numBits = ((numDigits * bitsPerDigit[10]) >>> 10) + 1;

if (numBits + 31 >= (1L << 32)) {

reportOverflow();

}

numWords = (int) (numBits + 31) >>> 5;

}

int[] magnitude = new int[numWords];

// Process first (potentially short) digit group

int firstGroupLen = numDigits % digitsPerInt[10];

if (firstGroupLen == 0)

firstGroupLen = digitsPerInt[10];

magnitude[numWords - 1] = parseInt(val, cursor, cursor += firstGroupLen);

// Process remaining digit groups

while (cursor < len) {

int groupVal = parseInt(val, cursor, cursor += digitsPerInt[10]);

destructiveMulAdd(magnitude, intRadix[10], groupVal);

}

mag = trustedStripLeadingZeroInts(magnitude);

if (mag.length >= MAX_MAG_LENGTH) {

checkRange();

}

}

// Create an integer with the digits between the two indexes

// Assumes start < end. The result may be negative, but it

// is to be treated as an unsigned value.

private int parseInt(char[] source, int start, int end) {

int result = Character.digit(source[start++], 10);

if (result == -1)

throw new NumberFormatException(new String(source));

for (int index = start; index < end; index++) {

int nextVal = Character.digit(source[index], 10);

if (nextVal == -1)

throw new NumberFormatException(new String(source));

result = 10*result + nextVal;

}

return result;

}

// bitsPerDigit in the given radix times 1024

// Rounded up to avoid underallocation.

private static long bitsPerDigit[] = { 0, 0,

1024, 1624, 2048, 2378, 2648, 2875, 3072, 3247, 3402, 3543, 3672,

3790, 3899, 4001, 4096, 4186, 4271, 4350, 4426, 4498, 4567, 4633,

4696, 4756, 4814, 4870, 4923, 4975, 5025, 5074, 5120, 5166, 5210,

5253, 5295};

// Multiply x array times word y in place, and add word z

private static void destructiveMulAdd(int[] x, int y, int z) {

// Perform the multiplication word by word

long ylong = y & LONG_MASK;

long zlong = z & LONG_MASK;

int len = x.length;

long product = 0;

long carry = 0;

for (int i = len-1; i >= 0; i--) {

product = ylong * (x[i] & LONG_MASK) + carry;

x[i] = (int)product;

carry = product >>> 32;

}

// Perform the addition

long sum = (x[len-1] & LONG_MASK) + zlong;

x[len-1] = (int)sum;

carry = sum >>> 32;

for (int i = len-2; i >= 0; i--) {

sum = (x[i] & LONG_MASK) + carry;

x[i] = (int)sum;

carry = sum >>> 32;

}

}

/**

* Translates the decimal String representation of a BigInteger into a

* BigInteger. The String representation consists of an optional minus

* sign followed by a sequence of one or more decimal digits. The

* character-to-digit mapping is provided by {@code Character.digit}.

* The String may not contain any extraneous characters (whitespace, for

* example).

*

* @param val decimal String representation of BigInteger.

* @throws NumberFormatException {@code val} is not a valid representation

* of a BigInteger.

* @see Character#digit

*/

public BigInteger(String val) {

this(val, 10);

}

/**

* Constructs a randomly generated BigInteger, uniformly distributed over

* the range 0 to (2^{{@code numBits}} - 1), inclusive.

* The uniformity of the distribution assumes that a fair source of random

* bits is provided in {@code rnd}. Note that this constructor always

* constructs a non-negative BigInteger.

*

* @param numBits maximum bitLength of the new BigInteger.

* @param rnd source of randomness to be used in computing the new

* BigInteger.

* @throws IllegalArgumentException {@code numBits} is negative.

* @see #bitLength()

*/

public BigInteger(int numBits, Random rnd) {

this(1, randomBits(numBits, rnd));

}

private static byte[] randomBits(int numBits, Random rnd) {

if (numBits < 0)

throw new IllegalArgumentException("numBits must be non-negative");

int numBytes = (int)(((long)numBits+7)/8); // avoid overflow

byte[] randomBits = new byte[numBytes];

// Generate random bytes and mask out any excess bits

if (numBytes > 0) {

rnd.nextBytes(randomBits);

int excessBits = 8*numBytes - numBits;

randomBits[0] &= (1 << (8-excessBits)) - 1;

}

return randomBits;

}

/**

* Constructs a randomly generated positive BigInteger that is probably

* prime, with the specified bitLength.

*

* <p>It is recommended that the {@link #probablePrime probablePrime}

* method be used in preference to this constructor unless there

* is a compelling need to specify a certainty.

*

* @param bitLength bitLength of the returned BigInteger.

* @param certainty a measure of the uncertainty that the caller is

* willing to tolerate. The probability that the new BigInteger

* represents a prime number will exceed

* (1 - 1/2^{{@code certainty}}). The execution time of

* this constructor is proportional to the value of this parameter.

* @param rnd source of random bits used to select candidates to be

* tested for primality.

* @throws ArithmeticException {@code bitLength < 2} or {@code bitLength} is too large.

* @see #bitLength()

*/

public BigInteger(int bitLength, int certainty, Random rnd) {

BigInteger prime;

if (bitLength < 2)

throw new ArithmeticException("bitLength < 2");

prime = (bitLength < SMALL_PRIME_THRESHOLD

? smallPrime(bitLength, certainty, rnd)

: largePrime(bitLength, certainty, rnd));

signum = 1;

mag = prime.mag;

}

// Minimum size in bits that the requested prime number has

// before we use the large prime number generating algorithms.

// The cutoff of 95 was chosen empirically for best performance.

private static final int SMALL_PRIME_THRESHOLD = 95;

// Certainty required to meet the spec of probablePrime

private static final int DEFAULT_PRIME_CERTAINTY = 100;

/**

* Returns a positive BigInteger that is probably prime, with the

* specified bitLength. The probability that a BigInteger returned

* by this method is composite does not exceed 2^-100.

*

* @param bitLength bitLength of the returned BigInteger.

* @param rnd source of random bits used to select candidates to be

* tested for primality.

* @return a BigInteger of {@code bitLength} bits that is probably prime

* @throws ArithmeticException {@code bitLength < 2} or {@code bitLength} is too large.

* @see #bitLength()

* @since 1.4

*/

public static BigInteger probablePrime(int bitLength, Random rnd) {

if (bitLength < 2)

throw new ArithmeticException("bitLength < 2");

return (bitLength < SMALL_PRIME_THRESHOLD ?

smallPrime(bitLength, DEFAULT_PRIME_CERTAINTY, rnd) :

largePrime(bitLength, DEFAULT_PRIME_CERTAINTY, rnd));

}

/**

* Find a random number of the specified bitLength that is probably prime.

* This method is used for smaller primes, its performance degrades on

* larger bitlengths.

*

* This method assumes bitLength > 1.

*/

private static BigInteger smallPrime(int bitLength, int certainty, Random rnd) {

int magLen = (bitLength + 31) >>> 5;

int temp[] = new int[magLen];

int highBit = 1 << ((bitLength+31) & 0x1f); // High bit of high int

int highMask = (highBit << 1) - 1; // Bits to keep in high int

while (true) {

// Construct a candidate

for (int i=0; i < magLen; i++)

temp[i] = rnd.nextInt();

temp[0] = (temp[0] & highMask) | highBit; // Ensure exact length

if (bitLength > 2)

temp[magLen-1] |= 1; // Make odd if bitlen > 2

BigInteger p = new BigInteger(temp, 1);

// Do cheap "pre-test" if applicable

if (bitLength > 6) {

long r = p.remainder(SMALL_PRIME_PRODUCT).longValue();

if ((r%3==0) || (r%5==0) || (r%7==0) || (r%11==0) ||

(r%13==0) || (r%17==0) || (r%19==0) || (r%23==0) ||

(r%29==0) || (r%31==0) || (r%37==0) || (r%41==0))

continue; // Candidate is composite; try another

}

// All candidates of bitLength 2 and 3 are prime by this point

if (bitLength < 4)

return p;

// Do expensive test if we survive pre-test (or it's inapplicable)

if (p.primeToCertainty(certainty, rnd))

return p;

}

}

private static final BigInteger SMALL_PRIME_PRODUCT

= valueOf(3L*5*7*11*13*17*19*23*29*31*37*41);

/**

* Find a random number of the specified bitLength that is probably prime.

* This method is more appropriate for larger bitlengths since it uses

* a sieve to eliminate most composites before using a more expensive

* test.

*/

private static BigInteger largePrime(int bitLength, int certainty, Random rnd) {

BigInteger p;

p = new BigInteger(bitLength, rnd).setBit(bitLength-1);

p.mag[p.mag.length-1] &= 0xfffffffe;

// Use a sieve length likely to contain the next prime number

int searchLen = getPrimeSearchLen(bitLength);

BitSieve searchSieve = new BitSieve(p, searchLen);

BigInteger candidate = searchSieve.retrieve(p, certainty, rnd);

while ((candidate == null) || (candidate.bitLength() != bitLength)) {

p = p.add(BigInteger.valueOf(2*searchLen));

if (p.bitLength() != bitLength)

p = new BigInteger(bitLength, rnd).setBit(bitLength-1);

p.mag[p.mag.length-1] &= 0xfffffffe;

searchSieve = new BitSieve(p, searchLen);

candidate = searchSieve.retrieve(p, certainty, rnd);

}

return candidate;

}

/**

* Returns the first integer greater than this {@code BigInteger} that

* is probably prime. The probability that the number returned by this

* method is composite does not exceed 2^-100. This method will

* never skip over a prime when searching: if it returns {@code p}, there

* is no prime {@code q} such that {@code this < q < p}.

*

* @return the first integer greater than this {@code BigInteger} that

* is probably prime.

* @throws ArithmeticException {@code this < 0} or {@code this} is too large.

* @since 1.5

*/

public BigInteger nextProbablePrime() {

if (this.signum < 0)

throw new ArithmeticException("start < 0: " + this);

// Handle trivial cases

if ((this.signum == 0) || this.equals(ONE))

return TWO;

BigInteger result = this.add(ONE);

// Fastpath for small numbers

if (result.bitLength() < SMALL_PRIME_THRESHOLD) {

// Ensure an odd number

if (!result.testBit(0))

result = result.add(ONE);

while (true) {

// Do cheap "pre-test" if applicable

if (result.bitLength() > 6) {

long r = result.remainder(SMALL_PRIME_PRODUCT).longValue();

if ((r%3==0) || (r%5==0) || (r%7==0) || (r%11==0) ||

(r%13==0) || (r%17==0) || (r%19==0) || (r%23==0) ||

(r%29==0) || (r%31==0) || (r%37==0) || (r%41==0)) {

result = result.add(TWO);

continue; // Candidate is composite; try another

}

}

// All candidates of bitLength 2 and 3 are prime by this point

if (result.bitLength() < 4)

return result;

// The expensive test

if (result.primeToCertainty(DEFAULT_PRIME_CERTAINTY, null))

return result;

result = result.add(TWO);

}

}

// Start at previous even number

if (result.testBit(0))

result = result.subtract(ONE);

// Looking for the next large prime

int searchLen = getPrimeSearchLen(result.bitLength());

while (true) {

BitSieve searchSieve = new BitSieve(result, searchLen);

BigInteger candidate = searchSieve.retrieve(result,

DEFAULT_PRIME_CERTAINTY, null);

if (candidate != null)

return candidate;

result = result.add(BigInteger.valueOf(2 * searchLen));

}

}

private static int getPrimeSearchLen(int bitLength) {

if (bitLength > PRIME_SEARCH_BIT_LENGTH_LIMIT + 1) {

throw new ArithmeticException("Prime search implementation restriction on bitLength");

}

return bitLength / 20 * 64;

}

/**

* Returns {@code true} if this BigInteger is probably prime,

* {@code false} if it's definitely composite.

*

* This method assumes bitLength > 2.

*

* @param certainty a measure of the uncertainty that the caller is

* willing to tolerate: if the call returns {@code true}

* the probability that this BigInteger is prime exceeds

* {@code (1 - 1/2^certainty)}. The execution time of

* this method is proportional to the value of this parameter.

* @return {@code true} if this BigInteger is probably prime,

* {@code false} if it's definitely composite.

*/

boolean primeToCertainty(int certainty, Random random) {

int rounds = 0;

int n = (Math.min(certainty, Integer.MAX_VALUE-1)+1)/2;

// The relationship between the certainty and the number of rounds

// we perform is given in the draft standard ANSI X9.80, "PRIME

// NUMBER GENERATION, PRIMALITY TESTING, AND PRIMALITY CERTIFICATES".

int sizeInBits = this.bitLength();

if (sizeInBits < 100) {

rounds = 50;

rounds = n < rounds ? n : rounds;

return passesMillerRabin(rounds, random);

}

if (sizeInBits < 256) {

rounds = 27;

} else if (sizeInBits < 512) {

rounds = 15;

} else if (sizeInBits < 768) {

rounds = 8;

} else if (sizeInBits < 1024) {

rounds = 4;

} else {

rounds = 2;

}

rounds = n < rounds ? n : rounds;

return passesMillerRabin(rounds, random) && passesLucasLehmer();

}

/**

* Returns true iff this BigInteger is a Lucas-Lehmer probable prime.

*

* The following assumptions are made:

* This BigInteger is a positive, odd number.

*/

private boolean passesLucasLehmer() {

BigInteger thisPlusOne = this.add(ONE);

// Step 1

int d = 5;

while (jacobiSymbol(d, this) != -1) {

// 5, -7, 9, -11, ...

d = (d < 0) ? Math.abs(d)+2 : -(d+2);

}

// Step 2

BigInteger u = lucasLehmerSequence(d, thisPlusOne, this);

// Step 3

return u.mod(this).equals(ZERO);

}

/**

* Computes Jacobi(p,n).

* Assumes n positive, odd, n>=3.

*/

private static int jacobiSymbol(int p, BigInteger n) {

if (p == 0)

return 0;

// Algorithm and comments adapted from Colin Plumb's C library.

int j = 1;

int u = n.mag[n.mag.length-1];

// Make p positive

if (p < 0) {

p = -p;

int n8 = u & 7;

if ((n8 == 3) || (n8 == 7))

j = -j; // 3 (011) or 7 (111) mod 8

}

// Get rid of factors of 2 in p

while ((p & 3) == 0)

p >>= 2;

if ((p & 1) == 0) {

p >>= 1;

if (((u ^ (u>>1)) & 2) != 0)

j = -j; // 3 (011) or 5 (101) mod 8

}

if (p == 1)

return j;

// Then, apply quadratic reciprocity

if ((p & u & 2) != 0) // p = u = 3 (mod 4)?

j = -j;

// And reduce u mod p

u = n.mod(BigInteger.valueOf(p)).intValue();

// Now compute Jacobi(u,p), u < p

while (u != 0) {

while ((u & 3) == 0)

u >>= 2;

if ((u & 1) == 0) {

u >>= 1;

if (((p ^ (p>>1)) & 2) != 0)

j = -j; // 3 (011) or 5 (101) mod 8

}

if (u == 1)

return j;

// Now both u and p are odd, so use quadratic reciprocity

assert (u < p);

int t = u; u = p; p = t;

if ((u & p & 2) != 0) // u = p = 3 (mod 4)?

j = -j;

// Now u >= p, so it can be reduced

u %= p;

}

return 0;

}

private static BigInteger lucasLehmerSequence(int z, BigInteger k, BigInteger n) {

BigInteger d = BigInteger.valueOf(z);

BigInteger u = ONE; BigInteger u2;

BigInteger v = ONE; BigInteger v2;

for (int i=k.bitLength()-2; i >= 0; i--) {

u2 = u.multiply(v).mod(n);

v2 = v.square().add(d.multiply(u.square())).mod(n);

if (v2.testBit(0))

v2 = v2.subtract(n);

v2 = v2.shiftRight(1);

u = u2; v = v2;

if (k.testBit(i)) {

u2 = u.add(v).mod(n);

if (u2.testBit(0))

u2 = u2.subtract(n);

u2 = u2.shiftRight(1);

v2 = v.add(d.multiply(u)).mod(n);

if (v2.testBit(0))

v2 = v2.subtract(n);

v2 = v2.shiftRight(1);