击败Ben-Zvi，Blackburn和Tsaban攻击代数橡皮擦
Defeating the Ben-Zvi, Blackburn, and Tsaban Attack on the Algebraic Eraser
摘要：
代数橡皮擦Diffie-Hellman（AEDH）协议于2005年由Anshel-Anshel-Golden-Lemieux引入，并于2006年发布，作为一种适用于具有有限计算资源的平台的协议，如FPGA，ASIC和无线传感器。它是一个群论密码协议，允许两个用户通过Diffie-Hellman型方案在不安全的信道上构造共享秘密。基于2012年Kalka-Teichner-Tsaban的基于置换的攻击，2015年Ben-Zvi-Blackburn-Tsaban（BBT）提出了一种启发式攻击，试图恢复AEDH共享秘密。在他们的论文中，BBT参考了由SecureRF提交给ISO进行认证（ISO 29167-20）的AEDH协议。ISO草案包含两个使用代数橡皮擦的配置文件。其中一个配置文件不受此攻击的影响;第二个配置文件会受到攻击，前提是攻击是实时的。在大多数实际部署中并非如此。BBT攻击只是一种有针对性的攻击，不试图破坏方法，系统参数或恢复任何私钥。相反，其有限的重点是在单个事务中恢复共享秘密。此外，BBT攻击是基于几种假设，当参数根据标准分布选择时，这些假设是成立的，如果不能避免的话，也可以减轻。本文展示了如何选择特殊的分布，使这些结构不举行使BBT攻击无效的辫子群有足够多的股。此外，BBT攻击假设某些数据可供攻击者使用，但实际部署情况并非如此，使得攻击完全失败。总之，BBT攻击是有缺陷的（相对于SecureRF ISO草案），并且至少超出了其适用性。
英文摘要：
The Algebraic Eraser Diffie-Hellman (AEDH) protocol was introduced in 2005 and published in 2006 by Anshel-Anshel-Goldfeld-Lemieux as a protocol suitable for use on platforms with constrained computational resources, such as FPGAs, ASICs, and wireless sensors. It is a group-theoretic cryptographic protocol that allows two users to construct a shared secret via a Diffie-Hellman-type scheme over an insecure channel. Building on the refuted 2012 permutation-based attack of Kalka-Teichner-Tsaban, in 2015 Ben-Zvi-Blackburn-Tsaban (BBT) presented a heuristic attack that attempts to recover the AEDH shared secret. In their paper BBT reference the AEDH protocol as presented to ISO for certification (ISO 29167-20) by SecureRF. The ISO draft contains two profiles using the Algebraic Eraser. One profile is unaffected by this attack; the second profile is subject to their attack provided the attack runs in real time. This is not the case in most practical deployments. The BBT attack is simply a targeted attack that does not attempt to break the method, system parameters, or recover any private keys. Rather, its limited focus is to recover the shared secret in a single transaction. In addition, the BBT attack is based on several conjectures that are assumed to hold when parameters are chosen according to standard distributions, which can be mitigated, if not avoided. This paper shows how to choose special distributions so that these conjectures do not hold making the BBT attack ineffective for braid groups with sufficiently many strands. Further, the BBT attack assumes that certain data is available to an attacker, but there are realistic deployment scenarios where this is not the case, making the attack fail completely. In summary, the BBT attack is flawed (with respect to the SecureRF ISO draft) and, at a minimum, over-reaches as to its applicability.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
