arXiv 0801.47862008-01-30math.GR

Cryptanalysis of Anshel-Anshel-Goldfeld-Lemieux key agreement protocol

Alex D. Myasnikov, Alexander Ushakov

英文摘要：

The Anshel-Anshel-Goldfeld-Lemieux (abbreviated AAGL) key agreement protocol is proposed to be used on low-cost platforms which constraint the use of computational resources. The core of the protocol is the concept of an Algebraic Eraser (abbreviated AE) which is claimed to be a suitable primitive for use within lightweight cryptography. The AE primitive is based on a new and ingenious idea of using an action of a semidirect product on a (semi)group to obscure involved algebraic structures. The underlying motivation for AAGL protocol is the need to secure networks which deploy Radio Frequency Identification (RFID) tags used for identification, authentication, tracing and point-of-sale applications. In this paper we revisit the computational problem on which AE relies and heuristically analyze its hardness. We show that for proposed parameter values it is impossible to instantiate the secure protocol. To be more precise, in 100% of randomly generated instances of the protocol we were able to find a secret conjugator z generated by TTP algorithm (part of AAGL protocol).

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

阅读原文

阅读 PDF ↗

arXiv 页面 ↗HTML 原文 ↗

本文内容

英文摘要相关论文

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

继续探索

相关论文

Analysis of a certain polycyclic-group-based cryptosystem

We investigate security properties of the Anshel-Anshel-Goldfeld commutator key-establishment protocol used with certain polycyclic groups. We show that despite low success of the length based attack the protocol can be broken by a deterministic polynomial-time algorithm.

2015-04-20math.GR

The conjugacy search problem in public key cryptography: unnecessary and insufficient

The conjugacy search problem in a group G is the problem of recovering an x in G from given g in G and h=x^{-1}gx. This problem is in the core of several recently suggested public key exchange protocols, most notably the one due to Anshel, Anshel, and Goldfeld, and the one due to Ko, Lee at al. In this note, we make two observations that seem to have eluded most people's attention. The first observation is that solving the conjugacy search problem is not necessary for an adversary to get the common secret key in the Ko-Lee protocol. It is sufficient to solve an apparently easier problem of fin…

2004-11-29cs.CRmath.GR

Ore revisited: an algorithmic investigation of the simple commutator promise problem

Motivated by a desire to test the security of the pubic key exchange protocol of I. Anshel, M. Anshel, and D. Goldfeld, (``An Algebraic Method for Public-Key Cryptography'', Mathematical Research Letters, vol. 6, pp. 1-5, 1999), we study algorithmic approaches to the simple commutator decision and promise problems (SCDP/SCPP) for the braid groups B_n. We take as our point of departure a seminal paper of O. Ore, (``Some Remarks on Commutators'', Proceedings of the American Mathematical Society, Vol. 2, No. 2, pp.307-314, 1951), which studies the SCPP for the symmetric groups. Our results build …

2006-12-08math.GR

Non-associative public-key cryptography

We introduce a generalized Anshel-Anshel-Goldfeld (AAG) key establishment protocol (KEP) for magmas. This leads to the foundation of non-associative public-key cryptography (PKC), generalizing the concept of non-commutative PKC. We show that left selfdistributive systems appear in a natural special case of a generalized AAG-KEP for magmas, and we propose, among others instances, concrete realizations using $f$-conjugacy in groups and shifted conjugacy in braid groups. We discuss the advantages of our schemes compared with the classical AAG-KEP based on conjugacy in braid groups.

2012-10-31cs.CRmath.GR

Key-agreement based on automaton groups

We suggest several automaton groups as key-agreement platforms for Anshl-Anshel-Goldfeld metascheme, they include Grigorchuk and universal Grigorchuk groups, Hanoi 3-Towers group, Basilica group and a subgroup of the affine group with the unsolvable conjugacy problem

2019-05-08cs.CCcs.CRmath.GR

使用辫群中的米哈伊洛娃子群进行密钥交换构造

A Key Exchange Construction using Mihailova Subgroups in Braid groups

Shenzhen University（深圳大学）

研究利用辫群中米哈伊洛娃子群进行密钥交换构造，源于其成员问题不可解，引出商群公式，但代数事实不能提供完整安全证明，此构造是有代数动机的候选方案，完整密码安全性待进一步研究。

2026-07-10math.GR

更多相关论文收起更多论文

Length-based attacks in polycyclic groups

After the Anshel-Anshel-Goldfeld (AAG) key-exchange protocol was introduced in 1999, it was implemented and studied with braid groups and with the Thompson group as its underlying platforms. The length-based attack, introduced by Hughes and Tannenbaum, has been used to extensively study AAG with the braid group as the underlying platform. Meanwhile, a new platform, using polycyclic groups, was proposed by Eick and Kahrobaei. In this paper, we show that with a high enough Hirsch length, the polycyclic group as an underlying platform for AAG is resistant to the length-based attack. In particular…

2014-11-22cs.CRmath.GR

Constructions in public-key cryptography over matrix groups

The purpose of the paper is to give new key agreement protocols (a multi-party extension of the protocol due to Anshel-Anshel-Goldfeld and a generalization of the Diffie-Hellman protocol from abelian to solvable groups) and a new homomorphic public-key cryptosystem. They rely on difficulty of the conjugacy and membership problems for subgroups of a given group. To support these and other known cryptographic schemes we present a general technique to produce a family of instances being matrix groups (over finite commutative rings) which play a role for these schemes similar to the groups $Z\_n^*…

2005-06-10cs.CRmath-phmath.GR

A Practical Cryptanalysis of the Algebraic Eraser

Anshel, Anshel, Goldfeld and Lemieaux introduced the Colored Burau Key Agreement Protocol (CBKAP) as the concrete instantiation of their Algebraic Eraser scheme. This scheme, based on techniques from permutation groups, matrix groups and braid groups, is designed for lightweight environments such as RFID tags and other IoT applications. It is proposed as an underlying technology for ISO/IEC 29167-20. SecureRF, the company owning the trademark Algebraic Eraser, has presented the scheme to the IRTF with a view towards standardisation. We present a novel cryptanalysis of this scheme. For paramete…

2016-06-02cs.CRmath.GR

On the cryptanalysis of the generalized simultaneous conjugacy search problem and the security of the Algebraic Eraser

The Algebraic Eraser (AE) is a cryptographic primitive that can be used to obscure information in certain algebraic cryptosystems. The Colored Burau Key Agreement Protocol (CBKAP), which is built on the AE, was introduced by I. Anshel, M. Anshel, D. Goldfeld, and S. Lemieux in 2006 as a protocol suitable for use on platforms with constrained computational resources, such as RFID and wireless sensors. In 2009 A. Myasnikov and A. Ushnakov proposed an attack on CBKAP that attempts to defeat the generalized simultaneous conjugacy search problem, which is the public-key computational problem underl…

2011-05-05cs.CRmath.GR

Combinatorial group theory and public key cryptography

After some excitement generated by recently suggested public key exchange protocols due to Anshel-Anshel-Goldfeld and Ko-Lee et al., it is a prevalent opinion now that the conjugacy search problem is unlikely to provide sufficient level of security if a braid group is used as the platform. In this paper we address the following questions: (1) whether choosing a different group, or a class of groups, can remedy the situation; (2) whether some other "hard" problem from combinatorial group theory can be used, instead of the conjugacy search problem, in a public key exchange protocol. Another ques…

2004-10-04cs.CRmath.GR

Polynomial-time solutions of computational problems in noncommutative-algebraic cryptography

We introduce the \emph{linear centralizer method}, and use it to devise a provable polynomial time solution of the Commutator Key Exchange Problem, the computational problem on which, in the passive adversary model, the security of the Anshel--Anshel--Goldfeld 1999 \emph{Commutator} key exchange protocol is based. We also apply this method to the computational problem underlying the \emph{Centralizer} key exchange protocol, introduced by Shpilrain and Ushakov in 2006. This is the first provable polynomial time cryptanalysis of the Commutator key exchange protocol, hitherto the most important k…

2015-06-17cs.CRmath.GRmath.RT

Thompson's group and public key cryptography

Recently, several public key exchange protocols based on symbolic computation in non-commutative (semi)groups were proposed as a more efficient alternative to well established protocols based on numeric computation. Notably, the protocols due to Anshel-Anshel-Goldfeld and Ko-Lee et al. exploited the conjugacy search problem in groups, which is a ramification of the discrete logarithm problem. However, it is a prevalent opinion now that the conjugacy search problem alone is unlikely to provide sufficient level of security no matter what particular group is chosen as a platform. In this paper we…

2005-05-24cs.CRmath.GR

Aspects of Nonabelian Group Based Cryptography: A Survey and Open Problems

Most common public key cryptosystems and public key exchange protocols presently in use, such as the RSA algorithm, Diffie-Hellman, and elliptic curve methods are number theory based and hence depend on the structure of abelian groups. The strength of computing machinery has made these techniques theoretically susceptible to attack and hence recently there has been an active line of research to develop cryptosystems and key exchange protocols using noncommutative cryptographic platforms. This line of investigation has been given the broad title of noncommutative algebraic cryptography. This wa…

2011-03-22cs.CRmath.GR

Short expressions of permutations as products and cryptanalysis of the Algebraic Eraser

On March 2004, Anshel, Anshel, Goldfeld, and Lemieux introduced the \emph{Algebraic Eraser} scheme for key agreement over an insecure channel, using a novel hybrid of infinite and finite noncommutative groups. They also introduced the \emph{Colored Burau Key Agreement Protocol (CBKAP)}, a concrete realization of this scheme. We present general, efficient heuristic algorithms, which extract the shared key out of the public information provided by CBKAP. These algorithms are, according to heuristic reasoning and according to massive experiments, successful for all sizes of the security parameter…

2012-03-06cs.CRmath.COmath.GR