Lal and Chaturvedi proposed two authentication schemes based on the
difficulty of the Root Problem in the braid group. We point out that the first
scheme is not really as secure as the Root Problem, and describe an efficient
way to crack it. The attack works for any group.Comment: This paper has been withdrawn by the author. One of the claims is
  incorrect as written. We are working on correcting and generalizing it. This
  will be published in another pape

Tsaban, Boaz

English

arXiv

Lal and Chaturvedi proposed two authentication sche\-mes presumably
based on the difficulty of the Root Problem in the braid group.
We describe a deterministic linear time algorithm to crack
the first scheme, and show that
the second scheme is not more secure than schemes based on the
Conjugacy Search Problem, and can therefore be cracked by existing
heuristic attacks with very good success probability, as long as
the parameters are practical

Boaz Tsaban

Cryptology ePrint Archive

ON AN AUTHENTICATION SCHEME BASED ON THEROOT PROBLEM IN THE BRAID GROUPBOAZ TSABANAbstract. Lal and Chaturvedi proposed two authentication sche-mes presumably based on the difficulty of the Root Problem in thebraid group. We describe a deterministic linear time algorithm tocrack the first scheme, and show that the second scheme is not moresecure than schemes based on the Conjugacy Search Problem, andcan therefore be cracked by existing heuristic attacks with verygood success probability, as long as the parameters are practical.1. The first authentication schemeLal and Chaturvedi propose in [6] two authentication schemes basedon the difficulty of the Root Problem in the braid group. The basic defi-nitions are given in [6]. Their first scheme is defined as follows. We workin the braid group Bn where n is even. In the sequel, multiplicationof elements of Bn means concatenation and reduction to left canonicalform. Let LBn = 〈σ1, . . . , σn/2−1〉 and UBn = 〈σn/2+1, . . . , σn〉.Key Generation. Alice chooses integers r, s ≥ 2, a ∈ LBn, and b ∈UBn. The public key is (X = arbs, r, s), and the secret key is (a, b).Authentication. Bob chooses c ∈ UBn and d ∈ LBn, and sends Alicethe challenge Y = crds. Alice responds with (a hash image of) Z =arY bs. Bob verifies that Z = crXds.It is argued in [6] that the scheme is secure if the Root Problem offinding x given xr (r ≥ 2 fixed) in Bn is difficult.The first observation is that extraction of roots is not necessary inorder to crack this scheme.Claim 1. If one can, given xy where x ∈ LBn, and y ∈ UBn, find(x, y), then one can authenticate as Alice.Proof. Take x = ar and y = bs. Then xy is known. Find (x, y) =(ar, bs), and note that this suffices for the authentication. Supported by the Koshland Center for Basic Research.12 BOAZ TSABANClaim 1 together with the following proposition implies that thescheme is insecure.Proposition 2. Given xy where x ∈ LBn, and y ∈ UBn, there is anefficient algorithm to find (x, y).Proof (sketch). The approach adopted here was suggested to us byShmuel Kaplan. We merely had to prove that it works.Given a braid w ∈ Bn containing a strand starting at position i, thereis a well-defined braid ri(w) ∈ Bn−1 obtained by removing that strandfrom the braid w (and enumerating the starting an ending positions inthe unique order-preserving manner). Note that ri(w) can be computedin time polynomial in n and the number of Artin generators used towrite w.Similarly, for a set I ⊆ {1, . . . , n}, we can define rI(w) ∈ Bn−k to bethe braid obtained by removing all strands starting at positions whichare members of I (and then re-enumerating the starting and endingpositions in an order-preserving manner).Assume that x ∈ LBn and y ∈ UBn, and we are given a represen-tative a of the homotopy class of xy. a is homotopically equivalent tothe braid b which is the side-by-side concatenation of (represetativesof the homotopy classes of) x and y. Let I = {n/2 + 1, . . . , n}. ThenrI(a) is homotopically equivalent to rI(b) (the same homotopy works).But rI(b) = x.In summary, given xy, compute z = rI(xy). Then (in Bn) z = x,and we can compute x−1(xy) = y. The attack works for any group G with LBn and UBn replaced byany two commuting subgroups L,U of G with L ∩ U = {e}, providedthat for each x ∈ L and each y ∈ U , x and y can be efficiently recoveredfrom their product xy (note that the condition L∩U = {e} guaranteesthat such a decomposition is unique). This is the case, for example,with the subgroups As, Bs of Thompson’s group F , defined in Shpilrain-Ushakov’s paper [9] (see the proof of Proposition 1 of [9]).González-Vasco has pointed out to us that if L,U are as above, andin addition either L or U is a normal subgroup of G, then for eachknown w ∈ G, xwy can be efficiently (and uniquely) decomposed: IfL is a normal subgroup of G, then w−1xw ∈ L, and therefore wecan decompose w−1xwy into w−1xw and y (and then recover x fromw−1xw). The case that U is a normal subgroup of G is treated similarly.2. The second authentication schemeLal and Chaturvedi also propose a second scheme in [6], Scheme II :AUTHENTICATION IN THE BRAID GROUP 3Key Generation. Alice chooses integers r, s ≥ 2, a ∈ LBn, and c ∈ Bn.The public key is (X = arcas, c, r, s), and the secret key is a.Authentication. Bob chooses b ∈ UBn, and sends Alice the challengeY = brcbs. Alice responds with (a hash value of) Z = arY as. Bobverifies that Z = brXbs.The attack of Section 1 does not apply to Scheme II. To crack thisscheme, it suffices to solve the following Decomposition Problem:Given xcy where x, y ∈ LBn are unknown and c ∈ Bnis known, find x̃, ỹ ∈ LBn such that x̃cỹ = xcy.In principle, the generic attack described in [3, 8] applies to this prob-lem, and it seems that for practical parameters required to make thesystem usable, its success probability will not be negligible. However,the generic attack is much more time consuming than the one suggestedin Section 1, and to evaluate its feasibility, it must be tested againstpractical parameters, which so far have not been suggested.We therefore consider again the original Scheme II. Here too, thepowers are irrelevant for our discussion, so we consider instead thefollowing Generalized Scheme II : Fix a group G and subgroups A,Bof G such that A,B commute elementwise.Key Generation. Alice chooses a1, a2 ∈ A, and c ∈ G. The public keyis (X = a1ca2, c).Authentication. Bob chooses b1, b2 ∈ B, and sends Alice the challengeY = b1cb2. Alice responds with (a hash value of) Z = a1Y a2. Bobverifies that Z = b1Xb2.In order to crack Generalized Scheme II, it suffices to solve the fol-lowing.Problem 3. Given c, X = a1ca2, and Y = b1cb2 such that a1, a2 ∈ Aand b1, b2 ∈ B, find Z = a1Y a2 = b1Xb2.More precisely, the elements a1, a2, b1, b2, c are chosen according toknown distributions on the relevant spaces (A, B, and G), and one hasto find Z with a significant probability. Similar probabilistic adapta-tions can be made to all assertions in the sequel, but for clarity weoften omit those.Lemma 4. Consider an instance of Problem 3. If either b1 or b2is known to commute with c, then Z can be computed efficiently byanyone.4 BOAZ TSABANProof. If b1c = cb1, then cb1b2 = b1cb2 = Y is known, and therefore sois b1b2. It follows thatZ = a1Y a2 = a1b1cb2a2 = a1cb1b2a2 = a1ca2b1b2 = X(b1b2)is known. The case where b2c = cb2 is similar. Remark 5. Note that in the original Scheme II, b1, b2 are both powersof the same element b ∈ B, and if b commutes with c, then both b1 andb2 commute with c. It could, however, be the case that br commuteswith c, but bs does not: In Bn, the fundamental element ∆ does notcommute with all elements, but its square ∆2 does.As the roles of (a1, a2, Y ) and (b1, b2, X) in Problem 3 are symmetric,Lemma 4 implies the following.Lemma 6. Consider an instance of Problem 3. If either a1 or a2is known to commute with c, then Z can be computed efficiently byanyone. Assume now that Bob generates b1, b2 in a way that with a nontrivialprobability p, either b1 or b2 commute with c. Then, in about 2/p tries,false identification is possible: In each try, the pretender flips a coin toguess whether b1 or b2 commutes with c, and uses Lemma 4. This willsucceed with probability p/2.But actually, one could heuristically check whether b1 or b2 commutewith c. By Lemma 6, if c commutes with all elements of A (or com-mutes, with probability close to 1, with the elements of A generatedin the protocol, a fact that can be verified experimentally), then thesystem is insecure. Thus, we may assume that it is easy to generateelements a ∈ A which do not commute with c. Fix such an element a.ComputeW = (b1cb2)a(b1cb2)−1 = b1cb2ab−12 c−1b−11 == b1cab2b−12 c−1b−11 = b1cac−1b−11 .If b1c = cb1, thenW = cb1ac−1b−11 = cab1c−1b−11 = cac−1b1b−11 = cac−1,which can be verified as we know a and c. And if not, then it is unlikelythat W = cac−1, that is, that b1db−11 = d, where d = cac−1. The lastassertion just tells that cac−1 commutes with b1.A similar argument applies for b2: ComputingU = (b1cb2)−1a(b1cb2) = (b1cb2)−1a(b1cb2) = b−12 c−1acb2,we have that if b2c = cb2, then U = c−1ac, and otherwise, this isunlikely, as U = c−1ac if, and only if, b2 commutes with c−1ac.AUTHENTICATION IN THE BRAID GROUP 5We arrive at the following.Lemma 7. In instances of Problem 3, if it is easy to find elementsa ∈ A such that with a high probability, cac−1 (respectively, c−1ac) doesnot commute with b1 (respectively, b2), then it can be checked with highcertainty whether b1c = cb1 (respectively, b2c = cb2). In practical settings where c does not commute with all elementsof A, it is likely that any generic enough element of A will have theproperties required in Lemma 7. Moreover, since we can repeat thetest of commutation for many distinct a’s, the “high probability” inLemma 7 does not seem necessary.By symmetry, if c commutes with any of a1, a2, then this can alsobe detected heuristically, and by Lemmas 6 and 4, false identificationis possible in these cases, either.We may therefore assume that none of the generated elements com-mutes with c. In particular, there are many a ∈ A which do notcommute with c.The following approach is inspired by the beautiful observations usedby Chowdhury in a different context [2]. For the elements a which donot commute with c, we obtain as above the equationW = b1db−11with d = cac−1 being a rather generic element of G. Similarly, we canobtain conjugacy equations for b2, a1, and a2. This reduces the problemto the (strict) Simultaneous Conjugacy Search Problem:Given many equations W = xdx−1 where x ∈ B is un-known and d ∈ G is known, find x (modulo the centerof G).To see that this suffices, consider an instance of Problem 3, and assumethat h, g ∈ G are central (i.e., commute with all elements of G), andthat hb1, gb2 are known. Then(hb1)c(gb2) · Y −1 = (hg)(b1cb2) · Y −1 = (hg)Y · Y −1 = hgcan be computed, and therefore so can(hg)−1(hb1)X(gb2) = g−1b1Xgb2 = g−1gb1Xb2 = b1Xb2 = Z.Moreover, it suffices to know either of b1 or b2 modulo the center of Gin order to find the other modulo the center of G. Indeed, if h is in thecenter of G and b1h is known, thenc−1(b1h)−1Y = c−1(b1h)−1b1cb2 = c−1h−1cb2 = c−1ch−1b2 = h−1b26 BOAZ TSABANcan be computed, and is equal to b2 modulo the center of G. The casethat b2 is known modulo the center of G is treated similarly.In principle, there could exist a solution to the given equations W =xdx−1 which is not equal to x modulo the center of G, but this seems tobe unlikely in nontrivial scenarios. Indeed, if x̃ ∈ B is another solutionto all of these equations, then for each d used in the equations, xdx−1 =x̃dx̃−1, and therefore x̃−1x commutes with d. Since the attacker cangenerate as many such equations as desired and the elements d lookrather generic, it follows that x̃−1x is likely to belong to the center G,and therefore x̃ is equal to x modulo the center of G.This shows, heuristically, that Generalized Scheme II is not likelyto be more secure than schemes based on the simultaneous conjugacysearch problem.We now move back to the original setting, where G = Bn is thebraid group. There are a variety of efficient heuristic algorithms forthe simultaneous conjugacy search problem in Bn, which have verygood success rates [5, 7]. Moreover, since we can choose many elementsa ∈ A, we can produce as many families of conjugacy equations for b1(or for b2, a1 or a2) as we need and it suffices to solve correctly (modulothe group’s center) one such family of equations, the probability ofsuccess of the mentioned methods should get very close to 1.This suggests that in practical settings, Scheme II is likely to beinsecure, either.Acknowledgments. We thank Maŕıa Isabel González-Vasco and DimaRuinskiy for their useful suggestions. For a treatment of the standardroot problem in the braid group, see [4].References[1] J. S. Birman, V. Gebhardt, and J. Gonzalez-Meneses, Conjugacy in GarsideGroups III: Periodic braids, eprint http://arxiv.org/abs/math.GT/0609616(2006).[2] M. Chowdhury, On the security of new key exchange protocols based onthe triple decomposition problem, eprint http://arXiv.org/abs/cs/0611065(2006).[3] D. Garber, S. Kaplan, M. Teicher, B. Tsaban, and U. Vishne, Probabilisticsolutions of equations in the braid group, Advances in Applied Mathematics35 (2005), 323–334.[4] A. Groch, D. Hofheinz, and R. Steinwandt, A practical attack on the rootproblem in braid groups, Contemporary Mathematics 418 (2006), 121–132.[5] D. Hofheinz and R. Steinwandt, A Practical Attack on Some Braid GroupBased Cryptographic Primitives, Proceedings of PKC 2003, Lecture Notes inComputer Science 2567 (2003), 187–198.AUTHENTICATION IN THE BRAID GROUP 7[6] S. Lal and A. Chaturvedi, Authentication schemes using braid groups, eprinthttp://arXiv.org/cs.CR/0507066 (2005).[7] S. Maffre, A weak key test for braid based cryptography, Designs, Codes andCryptography 39 (2006), 347–373.[8] D. Ruinskiy, A. Shamir, and B. Tsaban, Length-based cryptanalysis: The caseof Thompson’s Group, Journal of Mathematical Cryptology, to appear.[9] V. Shpilrain and A. Ushakov, Thompson’s group and public key cryptography,ACNS 2005, Lecture Notes in Computer Science 3531 (2005), 151–164.Department of Mathematics, Weizmann Institute of Science, Re-hovot 76100, IsraelE-mail address: boaz.tsaban@weizmann.ac.ilURL: http://www.cs.biu.ac.il/~tsaban

On an authentication scheme based on the Root Problem in the braid group

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive