几种群密码体制的安全性评估
Assessing security of some group based cryptosystems
摘要：
将离散对数问题推广到任意群的一种可能是所谓的共轭搜索问题（有时被错误地称为共轭问题）：给定群G的两个元素a，b，并且对于某个x \in G，a^x=b，找到至少一个这样的特定元素x。这里a^x代表xax^{-1}。这个问题在某些特定群中的计算难度已经被用于几个基于群的密码系统中。最近，一些预印本已经在流通，提出了各种“邻域搜索”类型的启发式攻击的共轭搜索问题。本调查的目的是强调一个（可能是众所周知的）事实，这些启发式攻击本身是不是一个威胁到密码系统的安全性，更重要的是，建议一个更可信的方法来评估基于组的密码系统的安全性。这种方法必须基于算法的平均情况复杂度（或预期运行时间）的概念。这些论点支持以下结论：虽然它通常是可行的基础上的共轭搜索问题的困难的密码系统的安全性，G本身（“平台”）必须非常小心地选择。特别是，迄今为止收集的实验和理论证据表明，辫群似乎不是平台的好选择。我们也考虑了可能的替代品。
英文摘要：
One of the possible generalizations of the discrete logarithm problem to arbitrary groups is the so-called conjugacy search problem (sometimes erroneously called just the conjugacy problem): given two elements a, b of a group G and the information that a^x=b for some x \in G, find at least one particular element x like that. Here a^x stands for xax^{-1}. The computational difficulty of this problem in some particular groups has been used in several group based cryptosystems. Recently, a few preprints have been in circulation that suggested various "neighbourhood search" type heuristic attacks on the conjugacy search problem. The goal of the present survey is to stress a (probably well known) fact that these heuristic attacks alone are not a threat to the security of a cryptosystem, and, more importantly, to suggest a more credible approach to assessing security of group based cryptosystems. Such an approach should be necessarily based on the concept of the average case complexity (or expected running time) of an algorithm. These arguments support the following conclusion: although it is generally feasible to base the security of a cryptosystem on the difficulty of the conjugacy search problem, the group G itself (the "platform") has to be chosen very carefully. In particular, experimental as well as theoretical evidence collected so far makes it appear likely that braid groups are not a good choice for the platform. We also reflect on possible replacements.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
