I'm trying to determine the residue requirements of Rabin-Williams. An older copy of P1363's Public Key Cryptography states the following in Section 8.1.3.2 RW key pairs:
An RW public key consists of a modulus n, which is the product of two odd positive prime integers $p$ and $q$, such that $p\not≡q\pmod8$, and an even public exponent $e\;$ ($2≤e<n$), which is an integer relatively prime to $(p – 1)(q – 1)/4$. [Note that these conditions imply that $p≡q≡3\pmod4$; moreover, one of the primes is congruent to $3\pmod8$ and the other is congruent to $7\pmod8$.]
I think Bernstein provides a survey of more relaxed conditions in RSA signatures and Rabin–Williams signatures: the state of the art. For example, in Section 4:
State-of-the-art systems use exponent 2 rather than exponent 3. This speeds up verification, and improves the signature-compression and signature-expansion features discussed in subsequent sections. The signer’s secret primes p and q are chosen from 3 + 4Z to simplify signing.
Eventually, Bernstein converges on the IEEE P1363 paper (and then surpasses it in Section 6 when he forgoes Jacobi symbols).
What are the minimum requirements for p and q in Rabin-Williams? Is it p, q ∈ 3 + 4Z; or is it p ∈ 3 + 8Z and q ∈ 7 + 8Z?
The practical problem I am facing is I don't know when to accept or reject a set of parameters during validation. I know p, q ∈ 3 + 4Z is less efficient, but I'm not sure it's forbidden.
