Potential Weaknesses of the Commutator Key Agreement Protocol Based on Braid Groups

Abstract

Abstract. The braid group with its conjugacy problem is one of the recent hot issues in cryptography. At CT-RSA 2001, Anshel, Anshel, Fisher, and Goldfeld proposed a commutator key agreement protocol (KAP) based on the braid groups and their colored Burau representation. Its security is based on the multiple simultaneous conjugacy problem (MSCP) plus a newly adopted key extractor. This article shows how to reduce finding the shared key of this KAP to the list-MSCPs in a permutation group and in a matrix group over a finite field. We also develop a mathematical algorithm for the MSCP in braid groups. The former implies that the usage of colored Burau representation in the key extractor causes a new weakness, and the latter can be used as a tool to investigate the security level of their KAP.

Random Subgroups of Braid Groups: An Approach to Cryptanalysis of a Braid Group Based Cryptographic Protocol

“…a r }, and Without the restriction x ∈ A, this would be a well-known (multiple simultaneous) conjugacy search problem. While the latter problem for braid groups is not known to have polynomial-time solution, some important recently made inroads [7], [12] suggest that it may be solved quite efficiently by a deterministic algorithm for at least some inputs, e.g. if one of the tuples g or h consists of positive braid words only.…”

“…In that case, the corresponding multiple simultaneous conjugacy search problem can be efficiently solved by the method of [12] (using super summit sets).…”

“…Therefore, any solution of the multiple simultaneous conjugacy search problem obtained by using, say, the method of [12] mentioned above, will differ from the actual Alice's (Bob's) private key by a factor lying in the center of B n . This will yield the correct common secret key K because K is the commutator K = A −1 B −1 AB, and therefore its value does not change if either A or B or both are multiplied by elements from the center of the ambient group B n .…”

“…We note that by increasing the crucial parameters L 1 and L 2 (and therefore increasing the lengths of the private keys), it is probably possible to downsize the relevant subgroup so that the method of [12] would not work. However, for public sets with longer elements, length-based attacks, as described in [6], [9], [10], may become a threat, although it seems that the existing experimental base is insufficient to draw any definitive conclusions on using longer keys in the AAG protocol.…”

Right-Invariance: A Property for Probabilistic Analysis of Cryptography Based on Infinite Groups

“…key agreement protocol or public key encryption) [24,9,[21][22][23]13, 2] and a few ways of analyses of attacks (e.g. deterministic or empirical) [3,10,17,12,11,16,7]. A natural question is how we can proceed one more step.…”