Quantum algorithm for discrete logarithm problem for matrices over finite group rings

Abstract

Abstract. We propose a polynomial time quantum algorithm for solving the discrete logarithm problem in matrices over finite group rings. The hardness of this problem was recently employed in the design of a key-exchange protocol proposed by D. Kahrobaei, C. Koupparis, and V. Shpilrain [4]. Our result implies that the Kahrobaei et al. protocol does not belong to the realm of post-quantum cryptography.

Cryptanalysis of Some Protocols Using Matrices over Group Rings

“…Note that for singular blocks, we need a slight modification of the procedure of [6], as proposed in [7].…”

“…Here the security is based on the supposed difficulty of the discrete logarithm problem in the group of invertible 3-by-3 matrices with coefficients in F 7 [S 5 ]. In [1], [2] and [7] a cryptanalysis of [4] is proposed. Their methods are somehow different.…”

“…In [2] one uses a slight modification of Shor's quantum algorithm to find the period of a singular matrix (there is no notion of order for such a matrix) and therby solving the discrete logarithm problem in semigroups. In [7], Mat 3 (F 7 [S 5 ]) is embeded in Mat 360 (F 7 ) and then one uses the same procedure as in [6] (adapted to singular matrices). The conclusion of all three papers above is that using a quantum computer one can break the key exchange protocol of [4].…”

New Asymmetric Cipher of Non-Commuting Cryptography Class Based on Matrix Power Function

“…This key agreement protocol was named as STR (Sakalauskas, Tvarijonas, Raulynaitis) and was studied in detail in several sources available on web (Ottaviani et al, 2011;Jacobs, 2011;Sracic, 2011). In 2012 it was concluded in Myasnikov and Ushakov (2012), that this algorithm does not provide strong security for quantum computers.…”

Quantum computation of discrete logarithms in semigroups

“…In fact, hardness of the semigroup discrete logarithm problem has been proposed as a cryptographic assumption that might be secure against quantum computers [11]. The particular scheme described in [11], based on matrix semigroups, has been broken by a quantum attack [16]. However, the algorithm of [16] uses a reduction from discrete logarithms in matrix groups to discrete logarithms in finite fields [14], so it does not apply to general semigroups.…”