Factoring Products of Braids via Garside Normal Form
Braid groups are infinite non-abelian groups naturally arising from geometric braids. For two decades they have been proposed for cryptographic use. In braid group cryptography public braids often contain secret braids as factors and it is hoped that rewriting the product of braid words hides individual factors. We provide experimental evidence that this is in general not the case and argue that under certain conditions parts of the Garside normal form of factors can be found in the Garside normal form of their product. This observation can be exploited to decompose products of braids of the form ABC when only B is known.
Our decomposition algorithm yields a universal forgery attack on WalnutDSATM, which is one of the 20 proposed signature schemes that are being considered by NIST for standardization of quantum-resistant public-key cryptography. Our attack on WalnutDSATM can universally forge signatures within seconds for both the 128-bit and 256-bit security level, given one random message-signature pair. The attack worked on 99.8% and 100% of signatures for the 128-bit and 256-bit security levels in our experiments.
Furthermore, we show that the decomposition algorithm can be used to solve instances of the conjugacy search problem and decomposition search problem in braid groups. These problems are at the heart of other cryptographic schemes based on braid groups.
The authors would like to thank Ward Beullens and the anonymous reviewers for their helpful feedback. This work was produced as part of a master’s thesis of the first author at the University of Oxford. He is now supported by the EPSRC as part of the Centre for Doctoral Training in Cyber Security at Royal Holloway, University of London (EP/P009301/1).
- 1.About SecureRF. https://www.securerf.com/about-us/. Accessed 21 Nov 2018
- 2.Anshel, I., Atkins, D., Goldfeld, P., Gunnels, D.: Kayawood, a key agreement protocol (2017). Preprint: https://eprint.iacr.org/2017/1162. Version 30 Nov 2017
- 6.Anshel, I., Atkins, D., Goldfeld, D., Gunnells, P.E.: WalnutDSA: a quantum resistant group theoretic digital signature algorithm (2017). Preprint available at https://eprint.iacr.org/2017/058, 30 Nov 2017
- 10.Beullens, W., Blackburn, S.: Practical attacks against the Walnut digital signature scheme (2018). Accepted to Asiacrypt 2018. Preprint: https://eprint.iacr.org/2018/318/20180404
- 12.Birman, J.S.: Braids, Links, and Mapping Class Groups. (AM-82), vol. 82. Princeton University Press, Princeton (1975)Google Scholar
- 21.Epstein, D., Cannon, J., Holt, D., Levy, S., Paterson, M., Thurston, W.: Word Processing in Groups (1992)Google Scholar
- 22.Garber, D.: Braid group cryptography. In: Braids: Introductory Lectures On Braids, Configurations and Their Applications, pp. 329–403. World Scientific (2010)Google Scholar
- 28.Goldwasser, S., Bellare, M.: Lecture notes on cryptography. Summer course “Cryptography and computer security” at MIT (1996)Google Scholar
- 30.Hughes, J., Tannenbaum, A.: Length-based attacks for certain group based encryption rewriting systems. arXiv preprint cs/0306032 (2003)Google Scholar
- 34.Kotov, M., Menshov, A., Ushakov, A.: An attack on the Walnut digital signature algorithm. Des. Codes Crypt. 1–20 (2018)Google Scholar
- 35.McEliece, R.: A public-key cryptosystem based on algebraic coding theory. Deep. Space Netw. Prog. Rep. 44, 114–116 (1978)Google Scholar
- 36.Merz, S.P.: Non obfuscating power of Garside normal forms (2018). GitHub repository at https://github.com/SimonMerz/Non-obfuscating-power-of-Garside-normal-forms
- 39.National Institute for Standards and Technology (NIST): Post-quantum crypto standardization (2016). https://csrc.nist.gov/projects/post-quantum-cryptography
- 40.NIST PQC Forum. https://groups.google.com/a/list.nist.gov/forum/#!forum/pqc-forum. Accessed 21 Nov 2018
- 41.Shor, P.W.: Algorithms for quantum computation: discrete logarithms and factoring. In: 35th Annual Symposium on Foundations of Computer Science, 1994 Proceedings, pp. 124–134. IEEE (1994)Google Scholar