3

Having look into Algebraic Eraser key exchange (AEDH) seems the private key matrix may not be random to prevent weak-key results from the key exchange.

From the documentation and articles available it is not really clear for me how to construct the private key matrix. This session paper states:

$M_A = \sum_{i=0}^{N-1} \alpha_i . M_i^0$

however I am unable to find what is meant by $\alpha_i$ and $M_i^0$

For my spare-time projects maybe I will be ok with a random private key matrix $M_A$, but when I'm learning something, lets do it properly.

Thank you in advance.

gusto2
  • 1,192
  • 7
  • 13
  • 1
    I think Algebraic Eraser is probably only valid for a toy crypto project. By which I mean implemented just for fun. Not something to be unleased on the world as part of an internet-connected children's toy. (Or any "real world" application.) – Future Security May 19 '18 at 18:56
  • @FutureSecurity: Indeed it is for a spare-fun-time project. I am aware of common attacks and even how AE can be made immune (as SecureRF claims). Except the last "Kalka, Teicher and Tsaban" attack with weak keys from random private key. This is where the "proprietary" thing comes in play and it doesn't give me much confidence either. The thing is - AE can be used for reasonably fast key exchange on low level devices (while RSA-DH or ECC-DH takes ages .. several seconds). Do you know any other option? – gusto2 May 19 '18 at 19:49
  • No. Don't think of it as "AE is asymmetric encryption so let's group it with RSA/ECC until research tells us to take it out." Instead "These algorithms have received enough scrutiny that I can be confident that they're safe, but for everything else we can't include them in the group yet... until research tells us to put them in." So the same goes for things besides AE, including candidates for post-quantum stuff (which likely will be even worse for your purposes). – Future Security May 19 '18 at 20:51
  • @FutureSecurity: Indeed I woudn't put AE to the same confidence level as RSA or ECC. And you've mentioned the quantum computing. From the little I know seems anything based on linear algbra smells awfully weak when it comes to quantum resistance. Thanks for the feedback. – gusto2 May 20 '18 at 07:28

1 Answers1

2

You copied the equation wrong! I just checked your link.

The matrix $M_0$ is chosen from the set of $n\times n$ invertible matrices over $GF(q)$ (a group under multiplicatin) by some "proprietary" method.

A private key polynomial $$\sum_{i=0}^{N-1} \alpha_i x^i,$$ over $GF(q)$ is specified and $M_A$ is this polynomial evaluated at the matrix $M_0:$

$$M_A = \sum_{i=0}^{N-1} \alpha_i M_0^i$$

kodlu
  • 22,423
  • 2
  • 27
  • 57