/*

 * Copyright (c) 1996, 2007, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

/*

 * Portions Copyright (c) 1995  Colin Plumb.  All rights reserved.

 */

package java.math;

import java.util.Random;

import java.io.*;

/**

 * Immutable arbitrary-precision integers.  All operations behave as if

 * BigIntegers were represented in two's-complement notation (like Java's

 * primitive integer types).  BigInteger provides analogues to all of Java's

 * primitive integer operators, and all relevant methods from java.lang.Math.

 * Additionally, BigInteger provides operations for modular arithmetic, GCD

 * calculation, primality testing, prime generation, bit manipulation,

 * and a few other miscellaneous operations.

 *

 * <p>Semantics of arithmetic operations exactly mimic those of Java's integer

 * arithmetic operators, as defined in <i>The Java Language Specification</i>.

 * For example, division by zero throws an {@code ArithmeticException}, and

 * division of a negative by a positive yields a negative (or zero) remainder.

 * All of the details in the Spec concerning overflow are ignored, as

 * BigIntegers are made as large as necessary to accommodate the results of an

 * operation.

 *

 * <p>Semantics of shift operations extend those of Java's shift operators

 * to allow for negative shift distances.  A right-shift with a negative

 * shift distance results in a left shift, and vice-versa.  The unsigned

 * right shift operator ({@code >>>}) is omitted, as this operation makes

 * little sense in combination with the "infinite word size" abstraction

 * provided by this class.

 *

 * <p>Semantics of bitwise logical operations exactly mimic those of Java's

 * bitwise integer operators.  The binary operators ({@code and},

 * {@code or}, {@code xor}) implicitly perform sign extension on the shorter

 * of the two operands prior to performing the operation.

 *

 * <p>Comparison operations perform signed integer comparisons, analogous to

 * those performed by Java's relational and equality operators.

 *

 * <p>Modular arithmetic operations are provided to compute residues, perform

 * exponentiation, and compute multiplicative inverses.  These methods always

 * return a non-negative result, between {@code 0} and {@code (modulus - 1)},

 * inclusive.

 *

 * <p>Bit operations operate on a single bit of the two's-complement

 * representation of their operand.  If necessary, the operand is sign-

 * extended so that it contains the designated bit.  None of the single-bit

 * operations can produce a BigInteger with a different sign from the

 * BigInteger being operated on, as they affect only a single bit, and the

 * "infinite word size" abstraction provided by this class ensures that there

 * are infinitely many "virtual sign bits" preceding each BigInteger.

 *

 * <p>For the sake of brevity and clarity, pseudo-code is used throughout the

 * descriptions of BigInteger methods.  The pseudo-code expression

 * {@code (i + j)} is shorthand for "a BigInteger whose value is

 * that of the BigInteger {@code i} plus that of the BigInteger {@code j}."

 * The pseudo-code expression {@code (i == j)} is shorthand for

 * "{@code true} if and only if the BigInteger {@code i} represents the same

 * value as the BigInteger {@code j}."  Other pseudo-code expressions are

 * interpreted similarly.

 *

 * <p>All methods and constructors in this class throw

 * {@code NullPointerException} when passed

 * a null object reference for any input parameter.

 *

 * @see     BigDecimal

 * @author  Josh Bloch

 * @author  Michael McCloskey

 * @since JDK1.1

 */

public class BigInteger extends Number implements Comparable<BigInteger> {

    /**

     * The signum of this BigInteger: -1 for negative, 0 for zero, or

     * 1 for positive.  Note that the BigInteger zero <i>must</i> have

     * a signum of 0.  This is necessary to ensures that there is exactly one

     * representation for each BigInteger value.

     *

     * @serial

     */

    final int signum;

    /**

     * The magnitude of this BigInteger, in <i>big-endian</i> order: the

     * zeroth element of this array is the most-significant int of the

     * magnitude.  The magnitude must be "minimal" in that the most-significant

     * int ({@code mag[0]}) must be non-zero.  This is necessary to

     * ensure that there is exactly one representation for each BigInteger

     * value.  Note that this implies that the BigInteger zero has a

     * zero-length mag array.

     */

    final int[] mag;

    // These "redundant fields" are initialized with recognizable nonsense

    // values, and cached the first time they are needed (or never, if they

    // aren't needed).

     /**

     * One plus the bitCount of this BigInteger. Zeros means unitialized.

     *

     * @serial

     * @see #bitCount

     * @deprecated Deprecated since logical value is offset from stored

     * value and correction factor is applied in accessor method.

     */

    @Deprecated

    private int bitCount;

    /**

     * One plus the bitLength of this BigInteger. Zeros means unitialized.

     * (either value is acceptable).

     *

     * @serial

     * @see #bitLength()

     * @deprecated Deprecated since logical value is offset from stored

     * value and correction factor is applied in accessor method.

     */

    @Deprecated

    private int bitLength;

    /**

     * Two plus the lowest set bit of this BigInteger, as returned by

     * getLowestSetBit().

     *

     * @serial

     * @see #getLowestSetBit

     * @deprecated Deprecated since logical value is offset from stored

     * value and correction factor is applied in accessor method.

     */

    @Deprecated

    private int lowestSetBit;

    /**

     * Two plus the index of the lowest-order int in the magnitude of this

     * BigInteger that contains a nonzero int, or -2 (either value is acceptable).

     * The least significant int has int-number 0, the next int in order of

     * increasing significance has int-number 1, and so forth.

     * @deprecated Deprecated since logical value is offset from stored

     * value and correction factor is applied in accessor method.

     */

    @Deprecated

    private int firstNonzeroIntNum;

    /**

     * This mask is used to obtain the value of an int as if it were unsigned.

     */

    final static long LONG_MASK = 0xffffffffL;

    //Constructors

    /**

     * Translates a byte array containing the two's-complement binary

     * representation of a BigInteger into a BigInteger.  The input array is

     * assumed to be in <i>big-endian</i> byte-order: the most significant

     * byte is in the zeroth element.

     *

     * @param  val big-endian two's-complement binary representation of

     *         BigInteger.

     * @throws NumberFormatException {@code val} is zero bytes long.

     */

    public BigInteger(byte[] val) {

        if (val.length == 0)

            throw new NumberFormatException("Zero length BigInteger");

        if (val[0] < 0) {

            mag = makePositive(val);

            signum = -1;

        } else {

            mag = stripLeadingZeroBytes(val);

            signum = (mag.length == 0 ? 0 : 1);

        }

    }

    /**

     * This private constructor translates an int array containing the

     * two's-complement binary representation of a BigInteger into a

     * BigInteger. The input array is assumed to be in <i>big-endian</i>

     * int-order: the most significant int is in the zeroth element.

     */

    private BigInteger(int[] val) {

        if (val.length == 0)

            throw new NumberFormatException("Zero length BigInteger");

        if (val[0] < 0) {

            mag = makePositive(val);

            signum = -1;

        } else {

            mag = trustedStripLeadingZeroInts(val);

            signum = (mag.length == 0 ? 0 : 1);

        }

    }

    /**

     * Translates the sign-magnitude representation of a BigInteger into a

     * BigInteger.  The sign is represented as an integer signum value: -1 for

     * negative, 0 for zero, or 1 for positive.  The magnitude is a byte array

     * in <i>big-endian</i> byte-order: the most significant byte is in the

     * zeroth element.  A zero-length magnitude array is permissible, and will

     * result in a BigInteger value of 0, whether signum is -1, 0 or 1.

     *

     * @param  signum signum of the number (-1 for negative, 0 for zero, 1

     *         for positive).

     * @param  magnitude big-endian binary representation of the magnitude of

     *         the number.

     * @throws NumberFormatException {@code signum} is not one of the three

     *         legal values (-1, 0, and 1), or {@code signum} is 0 and

     *         {@code magnitude} contains one or more non-zero bytes.

     */

    public BigInteger(int signum, byte[] magnitude) {

        this.mag = stripLeadingZeroBytes(magnitude);

        if (signum < -1 || signum > 1)

            throw(new NumberFormatException("Invalid signum value"));

        if (this.mag.length==0) {

            this.signum = 0;

        } else {

            if (signum == 0)

                throw(new NumberFormatException("signum-magnitude mismatch"));

            this.signum = signum;

        }

    }

    /**

     * A constructor for internal use that translates the sign-magnitude

     * representation of a BigInteger into a BigInteger. It checks the

     * arguments and copies the magnitude so this constructor would be

     * safe for external use.

     */

    private BigInteger(int signum, int[] magnitude) {

        this.mag = stripLeadingZeroInts(magnitude);

        if (signum < -1 || signum > 1)

            throw(new NumberFormatException("Invalid signum value"));

        if (this.mag.length==0) {

            this.signum = 0;

        } else {

            if (signum == 0)

                throw(new NumberFormatException("signum-magnitude mismatch"));

            this.signum = signum;

        }

    }

    /**

     * Translates the String representation of a BigInteger in the

     * specified radix into a BigInteger.  The String representation

     * consists of an optional minus or plus sign followed by a

     * sequence of one or more digits in the specified radix.  The

     * character-to-digit mapping is provided by {@code

     * Character.digit}.  The String may not contain any extraneous

     * characters (whitespace, for example).

     *

     * @param val String representation of BigInteger.

     * @param radix radix to be used in interpreting {@code val}.

     * @throws NumberFormatException {@code val} is not a valid representation

     *         of a BigInteger in the specified radix, or {@code radix} is

     *         outside the range from {@link Character#MIN_RADIX} to

     *         {@link Character#MAX_RADIX}, inclusive.

     * @see    Character#digit

     */

    public BigInteger(String val, int radix) {

        int cursor = 0, numDigits;

        final int len = val.length();

        if (radix < Character.MIN_RADIX || radix > Character.MAX_RADIX)

            throw new NumberFormatException("Radix out of range");

        if (len == 0)

            throw new NumberFormatException("Zero length BigInteger");

        // Check for at most one leading sign

        int sign = 1;

        int index1 = val.lastIndexOf('-');

        int index2 = val.lastIndexOf('+');

        if ((index1 + index2) <= -1) {

            // No leading sign character or at most one leading sign character

            if (index1 == 0 || index2 == 0) {

                cursor = 1;

                if (len == 1)

                    throw new NumberFormatException("Zero length BigInteger");

            }

            if (index1 == 0)

                sign = -1;

        } else

            throw new NumberFormatException("Illegal embedded sign character");

        // Skip leading zeros and compute number of digits in magnitude

        while (cursor < len &&

               Character.digit(val.charAt(cursor), radix) == 0)

            cursor++;

        if (cursor == len) {

            signum = 0;

            mag = ZERO.mag;

            return;

        }

        numDigits = len - cursor;

        signum = sign;

        // Pre-allocate array of expected size. May be too large but can

        // never be too small. Typically exact.

        int numBits = (int)(((numDigits * bitsPerDigit[radix]) >>> 10) + 1);

        int numWords = (numBits + 31) >>> 5;

        int[] magnitude = new int[numWords];

        // Process first (potentially short) digit group

        int firstGroupLen = numDigits % digitsPerInt[radix];

        if (firstGroupLen == 0)

            firstGroupLen = digitsPerInt[radix];

        String group = val.substring(cursor, cursor += firstGroupLen);

        magnitude[numWords - 1] = Integer.parseInt(group, radix);

        if (magnitude[numWords - 1] < 0)

            throw new NumberFormatException("Illegal digit");

        // Process remaining digit groups

        int superRadix = intRadix[radix];

        int groupVal = 0;

        while (cursor < len) {

            group = val.substring(cursor, cursor += digitsPerInt[radix]);

            groupVal = Integer.parseInt(group, radix);

            if (groupVal < 0)

                throw new NumberFormatException("Illegal digit");

            destructiveMulAdd(magnitude, superRadix, groupVal);

        }

        // Required for cases where the array was overallocated.

        mag = trustedStripLeadingZeroInts(magnitude);

    }

    // Constructs a new BigInteger using a char array with radix=10

    BigInteger(char[] val) {

        int cursor = 0, numDigits;

        int len = val.length;

        // Check for leading minus sign

        int sign = 1;

        if (val[0] == '-') {

            if (len == 1)

                throw new NumberFormatException("Zero length BigInteger");

            sign = -1;

            cursor = 1;

        } else if (val[0] == '+') {

            if (len == 1)

                throw new NumberFormatException("Zero length BigInteger");

            cursor = 1;

        }

        // Skip leading zeros and compute number of digits in magnitude

        while (cursor < len && Character.digit(val[cursor], 10) == 0)

            cursor++;

        if (cursor == len) {

            signum = 0;

            mag = ZERO.mag;

            return;

        }

        numDigits = len - cursor;

        signum = sign;

        // Pre-allocate array of expected size

        int numWords;

        if (len < 10) {

            numWords = 1;

        } else {

            int numBits = (int)(((numDigits * bitsPerDigit[10]) >>> 10) + 1);

            numWords = (numBits + 31) >>> 5;

        }

        int[] magnitude = new int[numWords];

        // Process first (potentially short) digit group

        int firstGroupLen = numDigits % digitsPerInt[10];

        if (firstGroupLen == 0)

            firstGroupLen = digitsPerInt[10];

        magnitude[numWords - 1] = parseInt(val, cursor,  cursor += firstGroupLen);

        // Process remaining digit groups

        while (cursor < len) {

            int groupVal = parseInt(val, cursor, cursor += digitsPerInt[10]);

            destructiveMulAdd(magnitude, intRadix[10], groupVal);

        }

        mag = trustedStripLeadingZeroInts(magnitude);

    }

    // Create an integer with the digits between the two indexes

    // Assumes start < end. The result may be negative, but it

    // is to be treated as an unsigned value.

    private int parseInt(char[] source, int start, int end) {

        int result = Character.digit(source[start++], 10);

        if (result == -1)

            throw new NumberFormatException(new String(source));

        for (int index = start; index<end; index++) {

            int nextVal = Character.digit(source[index], 10);

            if (nextVal == -1)

                throw new NumberFormatException(new String(source));

            result = 10*result + nextVal;

        }

        return result;

    }

    // bitsPerDigit in the given radix times 1024

    // Rounded up to avoid underallocation.

    private static long bitsPerDigit[] = { 0, 0,

        1024, 1624, 2048, 2378, 2648, 2875, 3072, 3247, 3402, 3543, 3672,

        3790, 3899, 4001, 4096, 4186, 4271, 4350, 4426, 4498, 4567, 4633,

        4696, 4756, 4814, 4870, 4923, 4975, 5025, 5074, 5120, 5166, 5210,

                                           5253, 5295};

    // Multiply x array times word y in place, and add word z

    private static void destructiveMulAdd(int[] x, int y, int z) {

        // Perform the multiplication word by word

        long ylong = y & LONG_MASK;

        long zlong = z & LONG_MASK;

        int len = x.length;

        long product = 0;

        long carry = 0;

        for (int i = len-1; i >= 0; i--) {

            product = ylong * (x[i] & LONG_MASK) + carry;

            x[i] = (int)product;

            carry = product >>> 32;

        }

        // Perform the addition

        long sum = (x[len-1] & LONG_MASK) + zlong;

        x[len-1] = (int)sum;

        carry = sum >>> 32;

        for (int i = len-2; i >= 0; i--) {

            sum = (x[i] & LONG_MASK) + carry;

            x[i] = (int)sum;

            carry = sum >>> 32;

        }

    }

    /**

     * Translates the decimal String representation of a BigInteger into a

     * BigInteger.  The String representation consists of an optional minus

     * sign followed by a sequence of one or more decimal digits.  The

     * character-to-digit mapping is provided by {@code Character.digit}.

     * The String may not contain any extraneous characters (whitespace, for

     * example).

     *

     * @param val decimal String representation of BigInteger.

     * @throws NumberFormatException {@code val} is not a valid representation

     *         of a BigInteger.

     * @see    Character#digit

     */

    public BigInteger(String val) {

        this(val, 10);

    }

    /**

     * Constructs a randomly generated BigInteger, uniformly distributed over

     * the range 0 to (2<sup>{@code numBits}</sup> - 1), inclusive.

     * The uniformity of the distribution assumes that a fair source of random

     * bits is provided in {@code rnd}.  Note that this constructor always

     * constructs a non-negative BigInteger.

     *

     * @param  numBits maximum bitLength of the new BigInteger.

     * @param  rnd source of randomness to be used in computing the new

     *         BigInteger.

     * @throws IllegalArgumentException {@code numBits} is negative.

     * @see #bitLength()

     */

    public BigInteger(int numBits, Random rnd) {

        this(1, randomBits(numBits, rnd));

    }

    private static byte[] randomBits(int numBits, Random rnd) {

        if (numBits < 0)

            throw new IllegalArgumentException("numBits must be non-negative");

        int numBytes = (int)(((long)numBits+7)/8); // avoid overflow

        byte[] randomBits = new byte[numBytes];

        // Generate random bytes and mask out any excess bits

        if (numBytes > 0) {

            rnd.nextBytes(randomBits);

            int excessBits = 8*numBytes - numBits;

            randomBits[0] &= (1 << (8-excessBits)) - 1;

        }

        return randomBits;

    }

    /**

     * Constructs a randomly generated positive BigInteger that is probably

     * prime, with the specified bitLength.

     *

     * <p>It is recommended that the {@link #probablePrime probablePrime}

     * method be used in preference to this constructor unless there

     * is a compelling need to specify a certainty.

     *

     * @param  bitLength bitLength of the returned BigInteger.

     * @param  certainty a measure of the uncertainty that the caller is

     *         willing to tolerate.  The probability that the new BigInteger

     *         represents a prime number will exceed

     *         (1 - 1/2<sup>{@code certainty}</sup>).  The execution time of

     *         this constructor is proportional to the value of this parameter.

     * @param  rnd source of random bits used to select candidates to be

     *         tested for primality.

     * @throws ArithmeticException {@code bitLength < 2}.

     * @see    #bitLength()

     */

    public BigInteger(int bitLength, int certainty, Random rnd) {

        BigInteger prime;

        if (bitLength < 2)

            throw new ArithmeticException("bitLength < 2");

        // The cutoff of 95 was chosen empirically for best performance

        prime = (bitLength < 95 ? smallPrime(bitLength, certainty, rnd)

                                : largePrime(bitLength, certainty, rnd));

        signum = 1;

        mag = prime.mag;

    }

    // Minimum size in bits that the requested prime number has

    // before we use the large prime number generating algorithms

    private static final int SMALL_PRIME_THRESHOLD = 95;

    // Certainty required to meet the spec of probablePrime

    private static final int DEFAULT_PRIME_CERTAINTY = 100;

    /**

     * Returns a positive BigInteger that is probably prime, with the

     * specified bitLength. The probability that a BigInteger returned

     * by this method is composite does not exceed 2<sup>-100</sup>.

     *

     * @param  bitLength bitLength of the returned BigInteger.

     * @param  rnd source of random bits used to select candidates to be

     *         tested for primality.

     * @return a BigInteger of {@code bitLength} bits that is probably prime

     * @throws ArithmeticException {@code bitLength < 2}.

     * @see    #bitLength()

     * @since 1.4

     */

    public static BigInteger probablePrime(int bitLength, Random rnd) {

        if (bitLength < 2)

            throw new ArithmeticException("bitLength < 2");

        // The cutoff of 95 was chosen empirically for best performance

        return (bitLength < SMALL_PRIME_THRESHOLD ?

                smallPrime(bitLength, DEFAULT_PRIME_CERTAINTY, rnd) :

                largePrime(bitLength, DEFAULT_PRIME_CERTAINTY, rnd));

    }

    /**

     * Find a random number of the specified bitLength that is probably prime.

     * This method is used for smaller primes, its performance degrades on

     * larger bitlengths.

     *

     * This method assumes bitLength > 1.

     */

    private static BigInteger smallPrime(int bitLength, int certainty, Random rnd) {

        int magLen = (bitLength + 31) >>> 5;

        int temp[] = new int[magLen];

        int highBit = 1 << ((bitLength+31) & 0x1f);  // High bit of high int

        int highMask = (highBit << 1) - 1;  // Bits to keep in high int

        while(true) {

            // Construct a candidate

            for (int i=0; i<magLen; i++)

                temp[i] = rnd.nextInt();

            temp[0] = (temp[0] & highMask) | highBit;  // Ensure exact length

            if (bitLength > 2)

                temp[magLen-1] |= 1;  // Make odd if bitlen > 2

            BigInteger p = new BigInteger(temp, 1);

            // Do cheap "pre-test" if applicable

            if (bitLength > 6) {

                long r = p.remainder(SMALL_PRIME_PRODUCT).longValue();

                if ((r%3==0)  || (r%5==0)  || (r%7==0)  || (r%11==0) ||

                    (r%13==0) || (r%17==0) || (r%19==0) || (r%23==0) ||

                    (r%29==0) || (r%31==0) || (r%37==0) || (r%41==0))

                    continue; // Candidate is composite; try another

            }

            // All candidates of bitLength 2 and 3 are prime by this point

            if (bitLength < 4)

                return p;

            // Do expensive test if we survive pre-test (or it's inapplicable)

            if (p.primeToCertainty(certainty, rnd))

                return p;

        }

    }

    private static final BigInteger SMALL_PRIME_PRODUCT

                       = valueOf(3L*5*7*11*13*17*19*23*29*31*37*41);

    /**

     * Find a random number of the specified bitLength that is probably prime.

     * This method is more appropriate for larger bitlengths since it uses

     * a sieve to eliminate most composites before using a more expensive

     * test.

     */

    private static BigInteger largePrime(int bitLength, int certainty, Random rnd) {

        BigInteger p;

        p = new BigInteger(bitLength, rnd).setBit(bitLength-1);

        p.mag[p.mag.length-1] &= 0xfffffffe;

        // Use a sieve length likely to contain the next prime number

        int searchLen = (bitLength / 20) * 64;

        BitSieve searchSieve = new BitSieve(p, searchLen);

        BigInteger candidate = searchSieve.retrieve(p, certainty, rnd);

        while ((candidate == null) || (candidate.bitLength() != bitLength)) {

            p = p.add(BigInteger.valueOf(2*searchLen));

            if (p.bitLength() != bitLength)

                p = new BigInteger(bitLength, rnd).setBit(bitLength-1);

            p.mag[p.mag.length-1] &= 0xfffffffe;

            searchSieve = new BitSieve(p, searchLen);

            candidate = searchSieve.retrieve(p, certainty, rnd);

        }

        return candidate;

    }

   /**

    * Returns the first integer greater than this {@code BigInteger} that

    * is probably prime.  The probability that the number returned by this

    * method is composite does not exceed 2<sup>-100</sup>. This method will

    * never skip over a prime when searching: if it returns {@code p}, there

    * is no prime {@code q} such that {@code this < q < p}.

    *

    * @return the first integer greater than this {@code BigInteger} that

    *         is probably prime.

    * @throws ArithmeticException {@code this < 0}.

    * @since 1.5

    */

    public BigInteger nextProbablePrime() {

        if (this.signum < 0)

            throw new ArithmeticException("start < 0: " + this);

        // Handle trivial cases

        if ((this.signum == 0) || this.equals(ONE))

            return TWO;

        BigInteger result = this.add(ONE);

        // Fastpath for small numbers

        if (result.bitLength() < SMALL_PRIME_THRESHOLD) {

            // Ensure an odd number

            if (!result.testBit(0))

                result = result.add(ONE);

            while(true) {

                // Do cheap "pre-test" if applicable

                if (result.bitLength() > 6) {

                    long r = result.remainder(SMALL_PRIME_PRODUCT).longValue();

                    if ((r%3==0)  || (r%5==0)  || (r%7==0)  || (r%11==0) ||

                        (r%13==0) || (r%17==0) || (r%19==0) || (r%23==0) ||

                        (r%29==0) || (r%31==0) || (r%37==0) || (r%41==0)) {

                        result = result.add(TWO);

                        continue; // Candidate is composite; try another

                    }

                }

                // All candidates of bitLength 2 and 3 are prime by this point

                if (result.bitLength() < 4)

                    return result;

                // The expensive test

                if (result.primeToCertainty(DEFAULT_PRIME_CERTAINTY, null))

                    return result;

                result = result.add(TWO);

            }

        }

        // Start at previous even number

        if (result.testBit(0))

            result = result.subtract(ONE);

        // Looking for the next large prime

        int searchLen = (result.bitLength() / 20) * 64;

        while(true) {

           BitSieve searchSieve = new BitSieve(result, searchLen);

           BigInteger candidate = searchSieve.retrieve(result,

                                                 DEFAULT_PRIME_CERTAINTY, null);

           if (candidate != null)

               return candidate;

           result = result.add(BigInteger.valueOf(2 * searchLen));

        }

    }

    /**

     * Returns {@code true} if this BigInteger is probably prime,

     * {@code false} if it's definitely composite.

     *

     * This method assumes bitLength > 2.

     *

     * @param  certainty a measure of the uncertainty that the caller is

     *         willing to tolerate: if the call returns {@code true}

     *         the probability that this BigInteger is prime exceeds

     *         {@code (1 - 1/2<sup>certainty</sup>)}.  The execution time of

     *         this method is proportional to the value of this parameter.

     * @return {@code true} if this BigInteger is probably prime,

     *         {@code false} if it's definitely composite.

     */

    boolean primeToCertainty(int certainty, Random random) {

        int rounds = 0;

        int n = (Math.min(certainty, Integer.MAX_VALUE-1)+1)/2;

        // The relationship between the certainty and the number of rounds

        // we perform is given in the draft standard ANSI X9.80, "PRIME

        // NUMBER GENERATION, PRIMALITY TESTING, AND PRIMALITY CERTIFICATES".

        int sizeInBits = this.bitLength();

        if (sizeInBits < 100) {

            rounds = 50;

            rounds = n < rounds ? n : rounds;

            return passesMillerRabin(rounds, random);

        }

        if (sizeInBits < 256) {

            rounds = 27;

        } else if (sizeInBits < 512) {

            rounds = 15;

        } else if (sizeInBits < 768) {

            rounds = 8;

        } else if (sizeInBits < 1024) {

            rounds = 4;

        } else {

            rounds = 2;

        }

        rounds = n < rounds ? n : rounds;

        return passesMillerRabin(rounds, random) && passesLucasLehmer();

    }

    /**

     * Returns true iff this BigInteger is a Lucas-Lehmer probable prime.

     *

     * The following assumptions are made:

     * This BigInteger is a positive, odd number.

     */

    private boolean passesLucasLehmer() {

        BigInteger thisPlusOne = this.add(ONE);

        // Step 1

        int d = 5;

        while (jacobiSymbol(d, this) != -1) {

            // 5, -7, 9, -11, ...

            d = (d<0) ? Math.abs(d)+2 : -(d+2);

        }

        // Step 2

        BigInteger u = lucasLehmerSequence(d, thisPlusOne, this);

        // Step 3

        return u.mod(this).equals(ZERO);

    }

    /**

     * Computes Jacobi(p,n).

     * Assumes n positive, odd, n>=3.

     */

    private static int jacobiSymbol(int p, BigInteger n) {

        if (p == 0)

            return 0;

        // Algorithm and comments adapted from Colin Plumb's C library.

        int j = 1;

        int u = n.mag[n.mag.length-1];

        // Make p positive

        if (p < 0) {

            p = -p;

            int n8 = u & 7;

            if ((n8 == 3) || (n8 == 7))

                j = -j; // 3 (011) or 7 (111) mod 8

        }

        // Get rid of factors of 2 in p

        while ((p & 3) == 0)

            p >>= 2;

        if ((p & 1) == 0) {

            p >>= 1;

            if (((u ^ (u>>1)) & 2) != 0)

                j = -j; // 3 (011) or 5 (101) mod 8

        }

        if (p == 1)

            return j;

        // Then, apply quadratic reciprocity

        if ((p & u & 2) != 0)   // p = u = 3 (mod 4)?

            j = -j;

        // And reduce u mod p

        u = n.mod(BigInteger.valueOf(p)).intValue();

        // Now compute Jacobi(u,p), u < p

        while (u != 0) {

            while ((u & 3) == 0)

                u >>= 2;

            if ((u & 1) == 0) {

                u >>= 1;

                if (((p ^ (p>>1)) & 2) != 0)

                    j = -j;     // 3 (011) or 5 (101) mod 8

            }

            if (u == 1)

                return j;

            // Now both u and p are odd, so use quadratic reciprocity

            assert (u < p);

            int t = u; u = p; p = t;

            if ((u & p & 2) != 0) // u = p = 3 (mod 4)?

                j = -j;

            // Now u >= p, so it can be reduced

            u %= p;

        }

        return 0;

    }

    private static BigInteger lucasLehmerSequence(int z, BigInteger k, BigInteger n) {

        BigInteger d = BigInteger.valueOf(z);

        BigInteger u = ONE; BigInteger u2;

        BigInteger v = ONE; BigInteger v2;

        for (int i=k.bitLength()-2; i>=0; i--) {

            u2 = u.multiply(v).mod(n);

            v2 = v.square().add(d.multiply(u.square())).mod(n);

            if (v2.testBit(0))

                v2 = v2.subtract(n);

            v2 = v2.shiftRight(1);

            u = u2; v = v2;

            if (k.testBit(i)) {

                u2 = u.add(v).mod(n);

                if (u2.testBit(0))

                    u2 = u2.subtract(n);

                u2 = u2.shiftRight(1);

                v2 = v.add(d.multiply(u)).mod(n);

                if (v2.testBit(0))

                    v2 = v2.subtract(n);

                v2 = v2.shiftRight(1);

                u = u2; v = v2;

            }

        }

        return u;

    }

    private static volatile Random staticRandom;

    private static Random getSecureRandom() {

        if (staticRandom == null) {

            staticRandom = new java.security.SecureRandom();

        }

        return staticRandom;

    }

    /**

     * Returns true iff this BigInteger passes the specified number of

     * Miller-Rabin tests. This test is taken from the DSA spec (NIST FIPS

     * 186-2).

     *

     * The following assumptions are made:

     * This BigInteger is a positive, odd number greater than 2.

     * iterations<=50.

     */

    private boolean passesMillerRabin(int iterations, Random rnd) {

        // Find a and m such that m is odd and this == 1 + 2**a * m

        BigInteger thisMinusOne = this.subtract(ONE);

        BigInteger m = thisMinusOne;

        int a = m.getLowestSetBit();

        m = m.shiftRight(a);

        // Do the tests

        if (rnd == null) {

            rnd = getSecureRandom();

        }

        for (int i=0; i<iterations; i++) {

            // Generate a uniform random on (1, this)

            BigInteger b;

            do {

                b = new BigInteger(this.bitLength(), rnd);

            } while (b.compareTo(ONE) <= 0 || b.compareTo(this) >= 0);

            int j = 0;

            BigInteger z = b.modPow(m, this);

            while(!((j==0 && z.equals(ONE)) || z.equals(thisMinusOne))) {

                if (j>0 && z.equals(ONE) || ++j==a)

                    return false;

                z = z.modPow(TWO, this);

            }

        }

        return true;

    }

    /**

     * This internal constructor differs from its public cousin

     * with the arguments reversed in two ways: it assumes that its

     * arguments are correct, and it doesn't copy the magnitude array.

     */

    BigInteger(int[] magnitude, int signum) {

        this.signum = (magnitude.length==0 ? 0 : signum);

        this.mag = magnitude;

    }

    /**

     * This private constructor is for internal use and assumes that its

     * arguments are correct.

     */

    private BigInteger(byte[] magnitude, int signum) {

        this.signum = (magnitude.length==0 ? 0 : signum);

        this.mag = stripLeadingZeroBytes(magnitude);

    }

    //Static Factory Methods

    /**

     * Returns a BigInteger whose value is equal to that of the

     * specified {@code long}.  This "static factory method" is

     * provided in preference to a ({@code long}) constructor

     * because it allows for reuse of frequently used BigIntegers.

     *

     * @param  val value of the BigInteger to return.

     * @return a BigInteger with the specified value.

     */

    public static BigInteger valueOf(long val) {

        // If -MAX_CONSTANT < val < MAX_CONSTANT, return stashed constant

        if (val == 0)

            return ZERO;

        if (val > 0 && val <= MAX_CONSTANT)

            return posConst[(int) val];

        else if (val < 0 && val >= -MAX_CONSTANT)

            return negConst[(int) -val];

        return new BigInteger(val);

    }

    /**

     * Constructs a BigInteger with the specified value, which may not be zero.

     */

    private BigInteger(long val) {

        if (val < 0) {

            val = -val;

            signum = -1;

        } else {

            signum = 1;

        }

        int highWord = (int)(val >>> 32);

        if (highWord==0) {

            mag = new int[1];

            mag[0] = (int)val;

        } else {

            mag = new int[2];

            mag[0] = highWord;

            mag[1] = (int)val;

        }

    }

    /**

     * Returns a BigInteger with the given two's complement representation.

     * Assumes that the input array will not be modified (the returned

     * BigInteger will reference the input array if feasible).

     */

    private static BigInteger valueOf(int val[]) {

        return (val[0]>0 ? new BigInteger(val, 1) : new BigInteger(val));

    }

    // Constants

    /**

     * Initialize static constant array when class is loaded.