A simple generalization of the ElGamal cryptosystem to non-abelian groups II

0.15 MB·English

by  Ayan Mahalanobis

March 6, 2009
A SIMPLE GENERALIZATION OF THE ELGAMAL
CRYPTOSYSTEM TO NON-ABELIAN GROUPS II
AYANMAHALANOBIS
9
0 ABSTRACT. ThisisastudyoftheMORcryptosystemusingthespecial
0 linear groupover finite fields. The automorphismgroup of the special
2
lineargroupisanalyzedforthispurpose. Atourcurrentstateofknowl-

r
a edge, I show that the MOR cryptosystem has better security than the
M
ElGamalcryptosystemoverfinitefields.

6

]
R
1. INTRODUCTION
C
.
s TheMORcryptosystemisageneralizationoftheElGamalcryptosystem,
c
[ where the discrete logarithmproblem works in the automorphismgroup of

4 a group G, instead of the group G itself. The framework for the MOR
v
cryptosystem was first proposed in Crypto2001 by Paeng et al. [13]. Ma-
5
0 halanobis [10] used the group of unitriangularmatrices for the MOR cryp-
3
tosystem. Thateffortwassuccessful,theMORcryptosystemoverthegroup
3
6. of unitriangular matrices became as secure as the ElGamal cryptosystem
0
overfinitefields.
7
0 InthispaperIofferanotherMORcryptosystem,thistimeusingthegroup
:
v of unimodular matrices. More precisely SL(d,q), the special linear group
i
X of matrices of degree d over the finite field F is used. Since the automor-
q
r phisms for the special linear group and the projective special linear group
a
arethesameandsoisthestructureoftheirautomorphismgroup,everything
I say about thespecial linear group can be said about theprojectivespecial
lineargroup too.
In thisMOR cryptosystem,Iam workingwith matrices of degreed over
F . To encrypt(decrypt)a plaintext(ciphertext)one works overthefield F .
q q
To break this cryptosystem one has to solve a discrete logarithm problem
in F . Even for a small integer d, this provides us with a considerable
qd2
2000MathematicsSubjectClassification. 94A60,20G40.
Keywordsandphrases. MORcryptosystem,speciallineargroups.
SubmittedtotheJournalofAlgebraandApplicationson06March2009.
1
security advantage. This is the central idea I am trying to “market” in this
paper.
There are some challenges in implementation of this cryptosystem. Im-
plementing matrix multiplicationis hard. Though we have not reached the
optimumspeed for that [4], it might always stay harder than multiplication
in a finite field. So one needs to find an optimum strategy to present the
automorphisms and the underlying group for the MOR cryptosystem, see
Section8 formoredetails.
At the end I provide parameters for the proposed MOR cryptosystem.
I suspect that the parameters are too conservative and the degree of the
matrix is unnecessarily big. The overly conservative estimates are to show
that for chosen parameters, the MOR cryptosystem is almost as good as
the ElGamal cryptosystem over elliptic curves (in terms of security); the
golden standard in public key cryptography. For most practical purposes,
thedegreeofthematrixcan bechosensmaller.
It seems that the MOR cryptosystem is a gold mine for cryptography.
There are definitely groups out there for which the cryptosystem is secure.
Thereare two kindsofautomorphismsfora groupG, onethatacts by con-
jugation and the other that does not. In this paper I refer to them as A and
B respectively. ForSL(d,q)thesizeofB becameverysmallandsowehad
to rely on the the automorphisms from A only. However, if we can find
groups where B is large, then those groups might provide us with a secure
MORcryptosystem;inwhichthesecuritycannotbereducedtothediscrete
logarithmproblemin afinitefield.
Therearemanyimportantaspectstoapublickeycryptosystem. Someof
thoseare:
i: “ProvableSecurity”orsemanticsecurity.
ii: Fast andsecure implementationofthecryptosystem.
iii: Security oftheunderlyingcryptographicprimitive.
In this paper we make no attempt to study the “provable security” of this
MORcryptosystem. Iprovideparametersandstudyimplementationofthis
MORcryptosystem;however,the majoremphasisof thispaper is thecom-
putational security of the MOR cryptosystem, i.e., security of the underly-
ingcryptographicprimitive.
2
2. THE MOR CRYPTOSYSTEM
This section contains a bare-bone description of the MOR cryptosys-
tem [13], see also [12]. A description and a critical analysis of the MOR
cryptosystemisalso in[10]and thereferences there.
2.1. Description of the MOR cryptosystem. Let G = hg ,g ,...,g i,
1 2 τ
τ ∈ N be a finite group and φ a non-trivial automorphism of G. Alice’s
keysareas follows:
PublicKey: {φ(g )}τ and {φm(g )}τ , m ∈ N.
i i=1 i i=1
PrivateKey: m.
Encryption.
a: Tosendamessage(plaintext)a ∈ GBob computesφr andφmr for
arandomr ∈ N.
b: Theciphertextis({φr(g )}τ ,φmr(a)).
i i=1
Decryption.
a: Alice knows m, so if she receives the ciphertext (φr,φmr(a)), she
computes φmr from φr and then φ−mr and then from φmr(a) com-
putesa.
Alice can compute φ−mr two ways; if she has the information necessary
to find out the order of the automorphism φ then she can use the identity
φt−1 = φ−1 whenever φt = 1. Also, she can find out the order of some
subgroup in which φ belongs and use the same identity. However, smaller
thesubgroup,moreefficientthedecryptionalgorithm.
2.2. MOR cryptosystem as a generalization ofthe ElGamalcryptosys-
tem. LetG = hgibeafinitecyclicgroupofordernwrittenadditively;then
one can define φ : g 7→ kg for some k ∈ N. In this case φm : g 7→ kmg;
sinceg is apublicinformation,thepublicinformationofφ and φm is iden-
ticaltothepublicinformationofk mod nandkm mod n. Sothediscrete
logarithm problem in the automorphism group of G, i.e., given φ and φm
find m reduces to given k mod n and km mod n find m. This is the
discrete logarithm problem [18, Chapter 6]. This clearly shows that the
MORcryptosystemas defined aboveisastraightforward generalizationof
theElGamal cryptosystem[18, Cryptosystem6.1] from a cyclic group to a
non-abeliangroup.
3
3. THE UNIMODULAR GROUP OF DEGREE d OVER F
q
ThegroupSL(d,q)isthesetofallmatricesofdegreedwithdeterminant
1. ItiswellknownthatSL(d,q)isanormalsubgroupofGL(d,q)thegroup
ofnon-singularmatricesofdegreedoverF . InthisarticleIconsiderF to
q q
beafiniteextensionofthegroundfield Z ofdegreeγ whereγ ≥ 1.
p
Definition 1. For distinct ordered pair (i,j), define a matrix unit e as a
i,j
matrixofdegreed,suchthat,allentriesine are0,excepttheintersection
i,j
of the ith row and the jth column; which is 1 (the identity in the field F ).
q
Matrices of the form 1+λe , λ ∈ F×, are called the elementary matrices
i,j q
or elementary transvections. Here 1 is the identity matrix of degree d. I
shallabusethenotationa littlebitand use1 fortheidentityofthefield and
thematrixgroup simultaneously.
It is known that the group SL(d,q) is generated by elementary transvec-
tions [14, Theorem 8.8]. The fundamental relations for the elementary
transvectionsaretherelationsinthefield and theones statedbelow:
1+λµe if j = k, i 6= l
i,l
(1) [1+λe ,1+µe ] = 1−λµe if i = l, j 6= k
i,j k,l  k,j
 1 otherwise


(2) (1+λe )(1+µe ) = 1+(λ+µ)e
i,j i,j i,j
(3) (1+λe )−1 = (1−λe )
i,j i,j
(4) (1+λe )k = 1+kλe k ∈ N
i,j i,j
whereλ,µ ∈ F .
q
4. AUTOMORPHISMS OF THE UNIMODULAR GROUP OVER F
q
ItiswellknownthattheautomorphismsofSL(d,q)arethefollowing[3,
5,17]:
DiagonalAutomorphism: This is conjugation by a non-scalar diag-
onal matrix. Notice that: since diagonal matrices are not of deter-
minant 1, the diagonal matrices are not in SL(d,q). So a diagonal
automorphismis notan innerautomorphism.
Inner Automorphism: Thisisthemostwellknownautomorphismof
anon-abeliangroupG, defined by x 7→ g−1xg forg ∈ G.
4
GraphAutomorphism: The graph automorphism induces the map
A 7→ (A−1)T, A ∈ SL(d,q). Clearly, graph automorphisms are
involutions,i.e., oforder twoand arenotinnerautomorphisms.
FieldAutomorphism: Thisautomorphismsistheactionofafieldau-
tomorphismoftheunderlyingfieldtotheindividualentriesofama-
trix.
In this section I am interested in a special class of inner automorphisms,
“permutation automorphisms”. For a permutation automorphism the con-
jugator g in the inner automorphism is a permutation matrix. It is well
knownthat for a permutationmatrix P, det(P) = ±1 and P−1 = PT. The
permutation matrix is constructed by taking the identity matrix 1 and then
exchanging the rows based on some permutation α. If the permutation α
is even then the determinant of P is 1 otherwise it is −1. Note that if the
determinant is −1, then conjugation by that permutation matrix is not an
inner automorphism; but it is close to being one and I will treat it like an
innerautomorphisminthispaper.
4.0.1. Effect of a permutation automorphism on an elementary transvec-
tions. If A is an elementary transvection, i.e., A = 1 + λe and P be a
i,j
permutationmatrix,thenP−1AP = 1+λeα−1(i),α−1(j).
4.0.2. Effect of a diagonal automorphism on an elementary transvection.
Let D = [w ,w ,...,w ] be a diagonal matrix. If A = 1 + λe then
1 2 d i,j
D−1AD = 1 + (w−1λw )e . Let us fix a (i,j) such that 1 ≤ i,j ≤ d,
i j i,j
thenlookattherootsubgrouph1+λe i,λ ∈ F . Thissubgroupisclearly
i,j q
isomorphictoF+.
q
Assume for a moment that I am using the MOR cryptosystem as de-
scribedinSection2.1withGastherootsubgroupdefinedaboveandφasa
diagonalautomorphism. Then clearly forsomek ∈ F×.
q
φ : 1+e 7→ 1+ke
i,j i,j
φm : 1+e 7→ 1+kme .
i,j i,j
Clearly we see that this MOR cryptosystem is identical to the ElGamal
cryptosystem over finite fields. Since SL(d,q) is generated by elementary
transvections,I claim that usingthe diagonal automorphismsof the special
lineargroupsoverfinitefields,theMORcryptosystemisidenticaltotheEl-
Gamal cryptosystemover finite fields. It is reasonable to assumethat there
5
areotherautomorphisms,compositionofwhichwiththediagonalautomor-
phismswillprovideuswithbettersecurity.
4.0.3. Theeffectofthegraphautomorphismonanelementarytransvection.
It is easy to see from the definition of the graph automorphism that if A =
1+λe then(A−1)T = 1−λe .
i,j j,i
4.0.4. Theeffectoffieldautomorphismsonanelementarytransvections. It
is well known that the field automorphisms form a cyclic group generated
by the Frobenius automorphism of the field F , given by λ 7→ λp, where p
q
is the characteristic of the field F . Then the action of field automorphism
q
onan elementary transvectionis1+λe 7→ 1+λpie where1 ≤ i < γ.
i,j i,j
5. MOR WITH MONOMIAL AUTOMORPHISMS
Assume for a moment that I am only using the composition of a diago-
nal and an inner automorphism of SL(d,q), i.e., I am using MOR (Section
2.1) where φ = φ ◦ φ where φ is a diagonal automorphism and φ is a
1 2 1 2
permutation automorphism. Then clearly φ is a monomial automorphism,
conjugationbyamonomialmatrix. Thediagonalautomorphismφ changes
1
1+e to1+λ e forsomeλ ∈ F×. Notethattheλ dependson the
i,j i,j i,j i,j q i,j
diagonalautomorphismandoncethediagonalautomorphismisfixedλ is
i,j
alsofixedforaparticular(i,j). Thepermutationautomorphismφ changes
2
1 + λ e to 1 + λ e where β = α−1. Here α is the permuta-
i,j i,j i,j β(i),β(j)
tion that gives rise to the permutation matrix P, used in the permutation
automorphism.
I now look at the action of the exponentiation of the automorphism φ =
φ ◦φ ontheelementary transvection1+e . Noticethatif
1 2 i,j
(5) φ : 1+e −d−ia−go−n→al 1+λ e −p−e−rm−u−tat−i→on 1+λ e ,
i,j i,j i,j i,j β(i),β(j)
then
m
(6) φm : 1+ei,j −−−→ 1+ λβl(i)βl(j)eβm(i),βm(j)
l=0
Q
Nowletus assumethattheorderofβ,◦(β) = ν then
ν
φν : 1+e 7→ 1+ λ e .
i,j βl(i)βl(j) i,j
l=0
Y
This shows that a cycle is formed and if ν < m, then this reduces the dis-
crete logarithmproblemin hφi to a discretelogarithmproblem in the finite
6
field F . Though it is well known that in the symmetric group S , acting
q n
on n points, one can get elements with very high order. In our problem I
am actually interested in the length of the orbit formed by the action of a
cyclicsubgroupofS , generated byβ,ontheset ofdistinctordered pairof
n
{1,2,...,n}. It isknownthattheseorbitsarequitesmall.
Sincethepermutationβ iseasytofindfromthepublicinformationφand
φm, unlessthedegreeofthematrixd isastronomicallybig, wedonot have
any chance for a MOR cryptosystem which is more secure than that of the
ElGamalcryptosystemoverfinitefields.
Since the conjugacy problem is easy in GL(d,q), from the public infor-
mationofφ andφ onecancomputetheconjugatormonomialmatricesfor
1 2
φ and φ modulo an element of the center of GL(d,q). I shall come back
1 2
tothistopiclater(Section 7.2)inmoredetails.
6. STRUCTURE OF THE AUTOMORPHISM GROUP OF SL(d,q)
Let us start with a well known theorem describing the structure of the
automorphism group of SL(d,q). Let A be the group of automorphisms
generatedbythediagonalandtheinnerautomorphismsandB bethegroup
generated by the graph and the field automorphisms. Recall that the center
ofthegroup GL(d,q) is theset ofall scalar matrices λ1 where λ ∈ F× and
q
1is theidentitymatrixofdegreed. IshalldenotethecenterofGL(d,q)by
GL(d,q)
Z and theprojectivegenerallineargroup byPGL(d,q).
Z
A brief warning about the notation. To increase readability of the text,
from now on, the image of a under f will be denoted either by af or by
f(a). Also,ImightdenotetheconjugationofX by Aas XA.
Theorem 6.1. The group A is isomorphic to PGL(d,q) and Aut(SL(d,q))
isasemidirectproductofA withB.
Proof. From [2, Theorem 2.12] we know that any element in GL(d,q) is
generated by the set consisting of all invertible diagonal matrices and all
transvections. Then we can define a map ̥ : GL(d,q) → A defined by
̥(A) maps X 7→ XA, clearly ̥ is an epimorphism and Ker(̥) = Z.
Fromfirst isomorphismtheoremwehavethatPGL(d,q) ∼= A.
We are left to show that Aut(SL(d,q)) is a semidirect product of A
with B. To prove this we need to show that A is a normal subgroup of
7
Aut(SL(d,q))and Aut(SL(d,q)) = AB. Noticethat any f ∈ B isan auto-
morphismofGL(d,q). Withthisin mindweseethat forA ∈ GL(d,q) and
X ∈ SL(d,q)
XfAf−1 = f A−1f−1(X)A = f(A)−1Xf(A) = Xf(A).
(cid:0) (cid:1)
Thisprovesthat Ais anormalsubgroupofAut(SL(d,q)). Now noticethat
f
for any f ∈ B, A−1XfA = (A−1)f−1XAf−1 , where A ∈ GL(d,q).
This proves that we can move(cid:16)elements of B to (cid:17)the right of the product of
automorphisms. Thisprovesourtheorem. •
NownoticethattheorderofAisactuallybig,itisqd(d−1)(qd−1)···(q−
2
2)buttheorderofBissmall. ThegroupBisthedirectproductofthegraph
and field automorphisms. The order of B is 2γ, where γ is the degree for
theextensionF overthegroundfield. Let γ = 2γ.
q 1
Let φ and φm be as in Section 2.1, then from the previous theorem φ =
Aψ and φm = A′ψ , where A,A′ ∈ A and ψ ,ψ ∈ B. I shall consider
1 2 1 2
A ∈ A as the conjugator as well, this is clearly the case because A ∼=
PGL(d,q).
Nowifφ = Aψ1, thenφm = AAψ1 ···Aψ1m−2Aψ1m−1ψ1m. In thiscase
AAψ1···Aψ1m−2Aψ1m−1 ∈ Aand ψm ∈ B.
1
Now if γ < m and since the order of ψ divides γ , there are r and
1 1 1 1
r such that m − 1 = k γ + r , where 0 ≤ r < γ and r = m
2 1 1 1 1 1 2
mod γ1. Then AAψ1 ···Aψ1m−1ψ1m = Ak11AAψ1 ···Aψ1r1ψ1r2, where A1 =
AAψ1···Aψ1γ1−1. From the information of φ and φm we then have the in-
formation of ψ and ψr2. For all practical purposes of implementing this
1 1
cryptosystem, the degree of the field extension cannot be too large, in this
case one can do a exhaustivesearch on thecosets of A and find out ψ and
1
ψr2 and do another exhaustive search to solve the discrete logarithm prob-
1
leminψ andfindther . Theinformationofr givesusavitalinformation
1 2 2
about the secret key m. This is clearly unacceptable. So the only way out
ofthissituationis nottouseautomorphismsfrom B.
Then for X ∈ SL(d,q)the automorphismsφ and φm as in Section 2.1 is
givenby
(7) φ(X) = A−1XA forsome A ∈ GL(d,q)
(8) φm(X) = A′−1XA′ forsome A′ ∈ GL(d,q)
8
Nownotice,inthedescriptionoftheMORprotocol,wepresentedtheauto-
morphisms as action on generators and furthermore a set of generators for
SL(d,q)aretheelementary transvections.
In this case from the publicinformation of φ and φm one can find A and
A′. This problem is known to be easy in GL(d,q) and is often refereed to
as the special conjugacy problem [12,13]. However, notice that A and A′
are not unique. For example, if A and A′ satisfy the above equations then
sowillAz and A′z′ foranyz,z′ ∈ Z,seeSection 7.1.
WejustsawthattheonlywaytobuildasecureMORcryptosystemusing
SL(d,q) is using automorphisms from A. Henceforth, whenever we are
talking about the MOR cryptosystem, we are using the group SL(d,q) and
theautomorphismsfromA.
7. SECURITY OF THE PROPOSED MOR CRYPTOSYSTEM
This paper is primarily focused on the discrete logarithm problem in the
automorphismgroup ofa non-abeliangroup. There are two kindsofattack
on the discrete logarithm problem over finite fields. One is the generic
attack,thisattackusesablackboxgroupalgorithmandtheotherisanindex
calculusattack.
Since theblack box group algorithmswork in any group, they will work
in the automorphism group too, see [9, Theorem 1]. We have no way to
prevent that. On the other hand, these generic attacks are of exponential
timecomplexityand so isoftheleastconcern.
The biggest computational threat to any cryptosystem using the discrete
logarithm problem is the subexponential attack like the index calculus at-
tack[15]. It isoften argued [8,16]thatthereis noindexcalculusalgorithm
for the elliptic curve cryptosystem that has subexponential time complex-
ity. Thisfactispresentedoften topromoteellipticcurvecryptosystemover
a finite field cryptosystem [8]. So, the best we can hope from the present
MOR cryptosystem is that there is no index calculus attack or the index
calculus attack becomes exponential. There are three issues with a MOR
cryptosystem:
7.1. Membership Problem. Please refer back to Equations 7 and 8. We
know that solving conjugacy problem (special conjugacy problem) is easy
in GL(d,q) but the solution is not unique. If I fix A, then to solve the
9
discrete logarithmproblem, I need to find Am. This means that I must find
thatA′ forwhich A′ ∈ hAi.
Noticethat,thepublicinformationoftheautomorphismsφandφm,isits
actiononasetofgeneratorsofSL(d,q),viz.thesetofelementarytransvec-
tions. TofindAandA′,theadversaryneedstocomputetheimageofφand
φm on some X ∈ SL(d,q). Then the adversary sees A and A−1XA. Now
for some centralizer Y of X in SL(d,q), (YA)−1X(YA) = A−1XA. So
there is no unique solution to the equation, given X and A−1XA, find A.
Therearemanysolutionstothat,allelementsofthecenterwillbecontained
inthecentralizer. Thepracticalsolutionisevenmorecomplicated,because
oneneeds to findAand A′ inthesameambiguousway.
Notice that for any X ∈ SL(d,q), Xl, l ∈ N is contained in the central-
izer. So if we can find a X ∈ SL(d,q), which is an involution (order 2)
with small centralizer, then there is a real possibility that this MOR cryp-
tosystem will become as secure as the DLP in F . In that case the security
q
of this cryptosystem will be the same as working with non-singular linear
transformationsofafinitedimensionalvectorspaceoverafinitefield.
7.2. Innerautomorphismsasmatrices. Asitturnsouttheonlywaythata
secureMORcryptosystemmightworkfortheunimodulargroupisthrough
conjugationofmatrices,i.e.,automorphismsfromA. ThisMORcryptosys-
temcanbeseenasworkingwithinnerautomorphismsofGL(d,q). Itiswell
known that the inner automorphisms work linearly on the d2-dimensional
algebra of matrices of degree d over F . For a fixed basis, any linear op-
q
erator on a vector space can be represented as a matrix. So, the discrete
logarithm problem on hφi (Section 2.1) is now reduced to the discrete log-
arithm problem in GL(d2,q)1. The question is, how easy is it to solve this
discretelogarithmproblem?
ThebestalgorithmforsolvingthediscretelogarithmprobleminGL(k,q)
was given by Menezes and Wu [11]. In this case the authors show that for
X,Y ∈ GL(k,q), such that, Xl = Y, l ∈ N; we can solve the discrete
logarithm problem if χ(x) the characteristic polynomial of X factors into
irreducible polynomials of small degree. If the characteristic polynomial
1I am makingan optimistic assumptionthat the reductioncan be actuallycarried out.
The reason I say that is, the automorphisms are presented as action on generators of
SL(d,q). However,IdonotknowanybasisforthematrixalgebrathatbelongtoSL(d,q).
10