7

Is there perhaps some neural expository article on crypto systems based on non-abelian groups?

I've gleaned that Anshel–Anshel–Goldfeld key exchange is the most well-known cryptographic algorithm based upon non-abelian groups. Do people consider it respectably secure? Why? Why not?

Any opinions about the role of combinatorial group theory here?

I'm curious because, as I understand it, non-abelian finite groups aren't considered particularly useful in cryptography, due to the Coincident Group Orders Theorem that follows from the Classification of the Finite Simple Groups, but obviously infinite non-abelian groups are another matter.

Jeff Burdges
  • 1,116
  • 5
  • 16
  • Do you have any link or other reference to the Coincident Group Orders Theorem? I have never heard it before, and Google finds just this question. – Paŭlo Ebermann Nov 26 '11 at 01:32
  • I'll track one down but it's the fact that all finite simple groups has distinct orders except for B_n(q) and C_n(q) with q odd and n>2, and A_3(2) and A_2(4), amusingly even wikipedia states it sans citation : http://en.wikipedia.org/wiki/List_of_finite_simple_groups – Jeff Burdges Nov 26 '11 at 02:54
  • I'll verify further later but I believe the reference should be this article by Artin as well as its predecessor : http://onlinelibrary.wiley.com/doi/10.1002/cpa.3160080403/abstract – Jeff Burdges Nov 26 '11 at 03:05
  • There is an industry of identifying finite groups both simple and non-simple using Monte Carlo methods, called black box group theory. Afaik, non-simple groups are treated using variations on the component analysis techniques from the CFSGs. – Jeff Burdges Nov 26 '11 at 03:14
  • Thanks for the link, I now understand what you mean here. As far as I can see, often the actual group used is not the secret in group-based protocols (like Diffie-Hellman, ElGamal, DSA), so I don't see how it would be problematic that there are not so many different ones. (In RSA, we are not actually using a single group.) – Paŭlo Ebermann Nov 26 '11 at 14:30
  • There are cases where identifying a hidden subgroup has applications though. These results tell us that non-abelian finite simple groups cannot play the same role as prime numbers in cryptographic applications; hence my motivation for asking this question. – Jeff Burdges Nov 26 '11 at 21:37
  • 1
    Did you try to google with following terms: "non-abelian group" site:eprint.iacr.org ? – j.p. Nov 28 '11 at 19:11
  • 1
    Today, for example, the paper "Rubik's for cryptographers" was posted which is about the security of Cayley hash functions (based on non-abelian groups), see http://eprint.iacr.org/2011/638. – j.p. Nov 28 '11 at 19:14
  • https://crypto.stackexchange.com/questions/18680/how-dead-is-braid-based-cryptography – Jeff Burdges Feb 15 '16 at 03:48

2 Answers2

7

Almost all cryptographic algorithms which use groups actually work in subgroups generated by a conventional element; even if the group as a whole is non-abelian, the subgroup is cyclic, thus abelian. The Anshel-Anshel-Goldfeld protocol tries to use non-commutativity itself, and relies on "how much non-abelian" the group is.

All asymmetric cryptographic algorithms rely at some point on a presumably hard problem. We do not know whether hard problems really exist, neither asymptotically (that's the whole P=NP problem) nor in practice (when given a specific computational budget, e.g. $2^{80}$ elementary operations). Our only tool is accumulation of work: we take many cryptographers and mathematicians, we let them loose on the problem for a few decades, and we see if they find some way to solve the problem.

To be honest, I had never heard of the Anshel-Anshel-Goldfeld protocol before this morning. It is described in an article which was published in Mathematical Research Letters, which is not usually associated with cryptologic research. There is a bit of research on doing cryptography with braid groups (the AAG protocol is just an instance of that); see this page for a lot of relevant pointers. It is still a recent and widely unexplored area, so, regardless of its inherent merits, the AAG protocol cannot be deemed secure yet. Also, it is only a framework, explained generically over an unspecified non-abelian group; it cannot be declared secure in abstracto.

Infinite non-abelian groups, or anything infinite for that matter, have a slight practical issue: they do not fit well in actual computers which have only a finite amount of RAM. Even for infinite sets where each element can be encoded in a finite (but unbounded) amount of RAM, such as plain integers, variable size easily leads to side-channel leakage, and that's a bad thing.

Thomas Pornin
  • 86,974
  • 16
  • 242
  • 314
  • Interesting thank! I'd naively assume any implementation would use only a bounded fragment of the infinite object for computational reasons, which avoids that side channel attack. You wouldn't be creating a finite group by imposing this bound, but maybe the CFSG still worms it's way into the picture somehow. – Jeff Burdges Nov 25 '11 at 15:46
  • It's worth pointing out that we have no proof that factoring, for example, is NP. All that matters is the problem is "hard." The problem's complexity class is a complementary discussion. – Simon Johnson Nov 29 '11 at 07:10
  • Factoring is in NP - given a number N and p and q, you can verify in polynomial time whether N factors to p and q. It's not NP complete unless the polynomial hierarchy collapses, though. – pg1989 Nov 17 '15 at 22:31
5

In my experience, I never have found that cryptographers base their opinion of a cryptosystem on the properties of the underlying group. If its a braid group, abelian group, or finite field: that does not really matter. What matters is, as @Thomas notes, how hard do we think the problem is in a particular setting?

Cryptography in braid groups usually has security reductions to problems related to the simultaneous conjugacy search problem. This problem has definitely not been studied as closely as problems related to integer factorization or discrete logarithms; and it is likely less studied than finding multiplicands on elliptic curves or the shortest vector problem on ideal lattices.

The community warms up to an idea after "adequate" attention has been given to the underlying hard problem. What is "adequate" is a mix of time and attention. It also helps to have a company pushing and standardizing it (Certicome with ECC, NTRU with lattices). It can also help gather attention if there is some "killer app" other than efficiency (ECC was helped by pairings, lattices will likely be helped by fully homomorphic encryption).

Braid group cryptography has none of these. Its main selling point is efficiency, which is a tough sell. It used to be embedded systems and mobile devices, then smartcards, and now RFIDs and sensor networks. As technology gets better, small computational devices become more capable of implementing standard cryptography.

Further, protocols like AAG have had a number of attacks against them requiring further refinement of how parameters are chosen. This isn't necessarily devastating: it could be viewed as akin to moving to safe primes or away from certain curves, or it could be a sign of deeper problems.

To answer your questions directly... I am not sure what you mean by a neural exploratory article. I don't think many cryptographers consider AAG secure or broken; the jury is still out (and no sign of them coming back any time soon). I don't think the group theory it is based on has any role in people's opinion (other than how the group theory dictates the hardness of conjugacy search problems).

PulpSpy
  • 8,617
  • 1
  • 30
  • 46