A small serving of mash: (Quantum) algorithms for SPDH-Sign with small parameters

Andrew Mendelsohn; Edmund Dable-Heath; Cong Ling

doi:10.1515/jmc-2024-0025

Article Open Access

A small serving of mash: (Quantum) algorithms for SPDH-Sign with small parameters

Andrew Mendelsohn , Edmund Dable-Heath and Cong Ling

Published/Copyright: March 4, 2025

Published by

Become an author with De Gruyter Brill

Submit Manuscript Author Information

From the journal Journal of Mathematical Cryptology Volume 19 Issue 1

Abstract

We find an efficient method to solve the semidirect discrete logarithm problem (SDLP) over finite nonabelian groups of order p 3 and exponent p 2 for certain exponentially large parameters. This implies an attack on SPDH-Sign,^[1] a signature scheme based on the SDLP, for such parameters. In particular, SDLP instances over such groups are parameterised by an n < ( p − 1 ) p 6 : we develop a method to solve instances when n ≤ poly ( log p ) ⋅ p . Letting λ be the security parameter of SPDH-Sign, which is taken p = exp λ , we find we may solve instances of SDLP corresponding to SPDH-Sign instances with exponentially large p . However, for n ≈ p 2 and larger, our method no longer completely solves the SDLP instances. We also study the linear hidden shift problem for a group action corresponding to SDLP and take a step towards proving the quantum polynomial time equivalence of SDLP and the semidirect computational Diffie–Hellman problem.

Keywords: semidirect product; discrete logarithm; signatures; group actions; cryptanalysis

MSC 2010: 11T71; 94A60; 68Q12

1 Introduction

In [1], the authors introduced a key exchange protocol. The security of their scheme was based on a discrete logarithm problem (DLP): given a group element g that generates a finite group G , and the element g x for some x ∈ N , can one recover x ? Efficient classical solutions to the general DLP remain elusive, but Shor [2] gave an efficient quantum algorithm to solve the aforementioned problem. Thus, cryptography relying on the aforementioned discrete logarithm assumption is not post-quantum secure. However, the fruitfulness of the discrete logarithm assumption for classical cryptography has led to widespread use of diverse protocols relying on DLPs.

The field of post-quantum cryptography comprises several distinct topics: lattices, isogenies of elliptic curves, multivariate polynomials, and codes have all been used to develop cryptosystems believed no more vulnerable to attack by quantum adversaries than by classical adversaries. Another line of work refers back to the DLP above, asking: can the DLP be tweaked to yield a quantum-hard cryptographic problem? If this were possible, such a “tweaked” DLP may perhaps allow a large number of existing discrete logarithm-based protocols to be ported into a post-quantum setting.

One contribution into this direction is the semidirect discrete logarithm problem (SDLP). This problem replaces the underlying finite cyclic group of [1] with a noncommutative group, constructed as the semidirect product of two groups, in an effort to boost the hardness of the problem. Informally, for some x ∈ N , some finite group element g ∈ G , and an element in the automorphism group of G , ϕ ∈ Aut ( G ) , given the element

s g , ϕ ( x ) ≔ ϕ x − 1 ( g ) ⋅ ϕ x − 2 ( g ) ⋅ … ⋅ ϕ ( g ) ⋅ g ,

the problem asks an adversary to recover x . Moving to this setting prevents an adversary from straightforwardly running the algorithm of Shor, which appears not to apply to such groups. Without loss of generality, x may be considered to be sampled from some finite group Z ⁄ n Z for some integer n dividing the order of the group, ∣ G ∣ . Note when ϕ is the identity map, we recover the standard DLP.

This problem was recently analysed by Battarbee et al. [3,4]. In the former article, the authors gave a subexponential- (but not polynomial-) time algorithm for SDLP. In the latter article, the authors develop a signature scheme, SPDH-Sign, based on the hardness of the SDLP problem. In particular, the authors use the group

G = G p ≔ a b 0 1 : a , b ∈ Z p 2 , a ≡ 1 mod p

to instantiate the SDLP problem, where Z p 2 ≔ Z ⁄ p 2 Z . To ensure a suitable level of security, one takes p to be a “cryptographic”-sized prime.

In this study, we contribute to the cryptanalysis of that scheme by performing further analysis on the SDLP problem using G p .

1.1 Contributions

In this work, we provide four contributions to the study of SDLP. The first of these is to show that the structure of G p enables an adversary to recover x mod ( p − 1 ) from s g , ϕ ( x ) in SDLP instances defined on elements of G p . This allows one to recover x when x is defined modulo a small multiple of p . This is because of the semidirect product isomorphism

G p ≅ Z ⁄ p 2 Z ⋊ Z ⁄ p Z ,

which is efficiently computable. We obtain

Theorem 4

Let ( g , ϕ ) ∈ G p ⋊ Aut ( G p ) , where g = ( a , φ ) ∈ G p , and x ∈ Z ⁄ n Z , where s g , ϕ ( n ) = 1 . Then, given s g , ϕ ( x ) , there is a quantum polynomial time algorithm to find x mod ( p − 1 ) .

The intuition behind this result is that the second coordinate of multiplication in the semidirect product G p ≅ Z ⁄ p 2 Z ⋊ Z ⁄ p Z behaves like multiplication in Z ⁄ p Z , and this enables one to extract information about x from the second coordinate of the element s g , ϕ ( x ) .

We have a simple implementation of our attack, which can be made available upon request of the authors.

In a different approach, we then show that one can recover ϕ x ( g ) from the publicly available data g , ϕ , s g , ϕ ( x ) and that this also leaks information on x due to the structure of the automorphisms of G p . In both of the aforementioned cases, we can recover x only when it is defined modulo a small multiple of p . When the security parameter of a scheme is denoted by λ , one has p = exp ( λ ) ; so our attacks hold against exponentially large parameter sizes. However, the element x may be defined modulo a larger integer than p , prima facie modulo an integer up to the size of the group used to instantiate the SDLP problem. Since ∣ G p ⋊ Aut ( G ) ∣ = ( p − 1 ) p 6 , in the case of SPDH-Sign, one may take x to be defined in general as large as ( ( p − 1 ) ⁄ p i ) ⋅ p 6 , where p i is the smallest prime factor of p − 1 (see Theorem 3 for more details), and in these larger parameter instances, say x ∈ Z ⁄ ( p − 1 ) i p j Z for i + j ≥ 2 , we do not currently see how to recover all of x .

After this, we turn to abstract properties of the SDLP problem, which we consider as a group action problem. The action is of the abelian group Z ⁄ n Z acting on the set X g , ϕ ≔ { s g , ϕ ( i ) : i ∈ Z ⁄ n Z } ; more details can be found below. We consider the “linear hidden shift” (LHS) problem and find that, as a corollary to our cryptanalytic attack, we can solve a special case of the LHS in quantum polynomial time. The particular LHS problem we consider in G p , informally, is given ( g , ϕ ) ∈ G p ⋊ Aut ( G p ) , x i ∈ ( Z ⁄ n Z ) ℓ , and s g , ϕ ( ∑ j s j x i j + y ) for i = 1 , … , m and some unknown y , to recover s = ( s 1 s 2 … s ℓ ) T ← { 0 , 1 } ℓ . The assumption of the hardness of the LHS problem has been used to build advanced functionalities from group actions such as key-dependent message public key encryption [5], trapdoor claw-free functions [6], and pseudorandom generators [7]. We have

Theorem 5

Let g ∈ G p and ϕ ∈ Aut ( G p ) . Let m ≥ ℓ + 1 . Then, there is a quantum polynomial time algorithm to solve LHS Z ⁄ n Z , X g , ϕ , s , y .

It may thus be the case that it is not possible, or significantly more difficult, to build the advanced functionalities mentioned earlier from the SDLP, and it would be of interest to show that such functionalities can be built, since it would imply that the LHS property is stronger than necessary to realise group action-based protocols with those properties.

We then turn to an open problem from the study of Battarbee et al. [4]. In addition to SDLP, another problem, semidirect computational Diffie-Hellman (SCDH), was considered. This is the problem, given g , ϕ , s g , ϕ ( x ) and s g , ϕ ( y ) , of computing s g , ϕ ( x + y ) . Of course, if one can solve SDLP, one may simply compute x from s g , ϕ ( x ) and y from s g , ϕ ( y ) and then compute s g , ϕ ( x + y ) directly; but it is unknown if a solution to SCDH implies a solution to SDLP. We partially resolve this problem by demonstrating a quantum algorithm, which, given an oracle for a particular form of SCDH, which returns s g , ϕ ( 2 a ) when given s g , ϕ ( a ) for any a (denoted SCDH g , ϕ , x 2 ), reduces SDLP to a hidden subgroup problem (HSP) instance, which can be efficiently solved with Shor’s period finding algorithm:

Theorem 6

There is a quantum polynomial-time reduction from SDLP g , ϕ , x to SCDH g , ϕ , x 2 .

We close by discussing the obstacles to a direct solution to SDLP via Shor’s algorithm.

1.2 Prior work

There is a burgeoning literature on noncommutative variants of the DLP, or schemes based on similar problems [3,4,8–11]. Attacks on variants of this problem can be found in previous studies [12–14]. The literature on cryptographic group actions includes refs [5,15–18].

We note the result [3, Theorem 6], which gives a method to solve SDLP, given access to a group action discrete logarithm oracle. This contrasts our work insofar as we merely require a discrete logarithm oracle for finite abelian groups.

In a concurrent and independent work (uploaded to the IACR Eprint server shortly prior to this article), Imran and Ivanyos [19] also provided cryptanalysis of the SDLP problem, in the idealised setting of black-box groups with unique labellings. We note the similarity to our work and note the greater generality of their approach, which applies to a variety of finite groups. However, our article includes results (on outer automorphisms, and relating SDLP and SCDH, for example) not covered by Imran and Ivanyos [19], and we consider our methods tailored to the choice of group suggested for SPDH-Sign a valuable contribution to the study of SDLP.

2 Preliminaries

2.1 Notations

We may write [ n ] to denote the set { 1 , … , n } . The arrow “←” may denote sampling from a set or sampling according to a distribution over a set; context will make which clear. If we write “ ← $ ,” we mean sampling uniformly at random. The identity element of a group G will be denoted by e .

2.2 Group endomorphisms

To any finite group G are attached endomorphisms:

Definition 1

An endomorphism ϕ : G → G is a homomorphism of groups from G to G .

If a group endomorphism ϕ is an isomorphism, we call ϕ an automorphism. The collection of all automorphisms of a finite group G forms a group, denoted Aut ( G ) . The set of endomorphisms of G is denoted End ( G ) .

2.3 Group actions

We define and give properties of group actions.

Definition 2

(Group action) A group action of a finite group G on a set X (sometimes called a G -set) is a map ⋆ : G × X → X satisfying

for any x ∈ X , e ⋆ x = x , and
for any g , h ∈ G and any x ∈ X , ( g h ) ⋆ x = g ⋆ ( h ⋆ x ) .

A group action is effective if ∣ G ∣ < ∞ and standard group-theoretic operations can be performed in polynomial time. The following are standard properties of group actions:

Definition 3

A group action of G on X is

transitive, if for any x 1 , x 2 ∈ X , there exists a g ∈ G satisfying x 2 = g ⋆ x 1 ;
faithful, if one has g ⋆ x = x for all x ∈ X if and only if g = e ;
free, if one has g = e if and only if there exists an x ∈ X such that x = g ⋆ x .

A free and transitive group action is called regular.

2.4 Semidirect product

We define the semidirect prodcuct of two groups.

Definition 4

(Semidirect product) Let G and H be finite groups. If there is an injective homomorphism

ρ : H ↪ Aut ( G ) ,

then we can form a product of G and H , G ⋊ ρ H , defined by the following multiplication rule: for ( g , ϕ ) , ( h , ψ ) ∈ G × H ,

( g , ϕ ) ⋅ ( h , ψ ) = ( ρ ( ψ ) ( g ) ⋅ h , ϕ ψ ) ,

where ρ ( ψ ) ( ⋅ ) is the action of the automorphism; this could be exponentiation ( g ψ ) or conjugation ( ψ g ψ − 1 ) or something more complicated. Note that this new group is noncommutative, i.e., swapping the order of multiplication can change the resulting group element on the right-hand side. If H ⊆ Aut ( G ) , we can take ρ as the identity map and write G ⋊ H . In the literature, the product G ⋊ Aut ( G ) is sometimes called the holomorph of G , and denoted Hol ( G ) . This construction is called the external semidirect product of G and H . It is a standard fact that ∣ G ⋊ H ∣ = ∣ G ∣ ∣ H ∣ .

2.5 SDLP and SCDH

Recall the DLP in a finite abelian group G . Fix g ∈ G , which we will consider to be public. A challenger selects an integer x , computes h = g x , and gives h to an adversary. The adversary has to recover x , which is defined modulo the order of g ∈ G . This can be solved in quantum polynomial time via Shor’s algorithm [2], but is classically only solvable in exponential time.

Battarbee et al. [4] replace G with G ⋊ H . Let ( g , ϕ ) ∈ G ⋊ H . Select, for instance, x = 2 , and compute

( g , ϕ ) 2 = ( g , ϕ ) ⋅ ( g , ϕ ) = ( ϕ ( g ) g , ϕ 2 ) .

If a challenger gave an adversary the resulting group element, they could take the second component ϕ 2 , solve the (abelian) DLP in H , and find that x = 2 . Alternatively, they could solve a DLP in the cyclic group generated by ( g , ϕ ) , denoted ⟨ ( g , ϕ ) ⟩ . More generally, for an arbitrary choice of x , we have

( g , ϕ ) x = ( ϕ x − 1 ( g ) ⋅ … ⋅ ϕ ( g ) g , ϕ x ) .

Clearly, if x < ∣ H ∣ , an adversary could always solve an abelian DLP to find x . If x ≥ ∣ H ∣ , they could solve an abelian discrete logarithm to find x mod ∣ H ∣ . So one cannot release the second coordinate of ( g , ϕ ) x and maintain secrecy of x . This leads to

Definition 5

(SDLP) The semidirect product DLP, SDLP g , ϕ , x , is given

s g , ϕ ( x ) ≔ ϕ x − 1 ( g ) ⋅ … ⋅ ϕ ( g ) g ,

for some x ∈ Z + and ( g , ϕ ) ∈ G ⋊ H , to find x .

One can see that x is only defined modulo ∣ G ⋊ H ∣ = ∣ G ∣ × ∣ H ∣ . Moreover, it is in fact only defined modulo the order of the group element chosen, o ( g , ϕ ) , since if x > o ( g , ϕ ) , then ( g , ϕ ) x = ( g , ϕ ) x mod o ( g , ϕ ) . As a consequence, we may take x ∈ Z ⁄ n Z for some n ∣ o ( g , ϕ ) . When one fixes a choice of ( g , ϕ ) and sets n to be the smallest integer such that s g , ϕ ( n ) = 1 , the corresponding group action has particularly useful properties. We denote such a problem instance by SDLP g , ϕ , x .

A related problem to SDLP is the SCDH problem:

Definition 6

(SCDH). Let G be a finite group, and let ( g , ϕ ) ∈ G ⋊ Aut ( G ) . Let x , y ∈ N and suppose we are given ( g , ϕ ) , s g , ϕ ( x ) , and s g , ϕ ( y ) . The SCDH problem, SCDH g , ϕ , x , y , is to compute s g , ϕ ( x + y ) .

In the study of Battarbee et al. [3], a subexponential quantum algorithm was given for SDLP over semigroups. In the following, a family of (semi)groups indexed by κ is “easy” if for a fixed κ , pairs ( g , ϕ ) , ( g ′ , ϕ ′ ) ∈ G κ ⋊ End ( G κ ) , and values f ( κ ) , f ′ ( κ ) (resp. g ( κ ) , g ′ ( κ ) ) denoting the number of operations required to solve SDLP (resp. SCDH) for ( g , ϕ ) and ( g ′ , ϕ ′ ) , respectively, then we have f ( κ ) = O ( f ′ ( κ ) ) (resp. g ( κ ) = O ( g ′ ( κ ) ) ) . Then:

Theorem 1

[3, Theorem 10] Let { G κ } κ be an easy family of semigroups, and fix κ . For any pair ( g , ϕ ) ∈ G κ ⋊ End ( G κ ) , there is a quantum algorithm solving SDLP with respect to ( g , ϕ ) with time and query complexity 2 O ( log κ ) .

In this work, we consider groups, rather than semigroups. We also note a group action interpretation of SDLP. Define

X g , ϕ ≔ { s g , ϕ ( i ) : i ∈ Z ⁄ n Z } .

Then,

Definition 7

Let ( g , ϕ ) ∈ G ⋊ H and n be the smallest integer such that s g , ϕ ( n ) = 1 . Define a group action of Z ⁄ n Z on X g , ϕ by

Z ⁄ n Z ↻ X g , ϕ : x ∗ s g , ϕ ( y ) = s g , ϕ ( x + y ) .

This group action is free and transitive. We call this group action the semidirect product group action (SDPGA).

2.6 SPDH-sign

In the study of Battarbee et al. [4], a signature scheme was designed based on SDLP. The key generation and signing algorithms require multiple instances of SDLP to be published; we denote the number of samples by N , and refer to SPDH - Sign g , ϕ ( N ) below. The key generation and signing algorithms are given by

Algorithm 1 Key generation algorithm
Gen ( N ) :
for i ← 1 , … , N do
X i ← $ X g , ϕ
s i ← $ Z n
Y i ← s i ⋆ X i
end for
s k ← ( s 1 , … , s N )
p k ← ( ( X 1 , … , X N ) , ( Y 1 , … , Y N ) )
return ( s k , p k )

Algorithm 2 Signing algorithm
Sg ( m , ( s k , p k ) ) :
for i ← 1 , … , N do
t i ← $ Z n
I i ← t i ⋆ X i
end for
I ← ( I 1 , … , I N )
c ← H ( I , m )
for i ← 1 , … , N
if c i = 0 then
p i ← t i
else
p i ← t i − s i
end if
end for
p ← ( p 1 , … , p N )
( σ 1 , σ 2 ) ← ( I , p )
return ( σ 1 , σ 2 )

Note that it suffices to solve SDLP to break the scheme: if one can solve the SDLP problem, one can take the public key p k = ( ( X 1 , … , X N ) , ( Y 1 , … , Y N ) ) of SPDH-Sign and extract the s i , which comprise the secret key. For more on the security of SPDH-Sign, we refer the reader to the study of Battarbee et al. [4].

For the use of SPDH-Sign, one has to pick a particular group with which the scheme will be instantiated; the authors propose the use of the group

G = G p ≔ a b 0 1 : a , b ∈ Z p 2 , a ≡ 1 mod p .

We note that we have G p ≅ Z ⁄ p 2 Z ⋊ Z ⁄ p Z , where Z ⁄ p Z acts on Z ⁄ p 2 Z via a ⋆ b = b 1 + p a . This isomorphism and its inverse are plainly efficiently computable.

When using such a group, p would be chosen to be a cryptographic prime, i.e., p = exp ( λ ) , where λ is the security parameter of a SLDP-based scheme, such as SPDH-Sign.

Finally, in this section, we note an incorrect statement in the study of Battarbee et al. [4]. The authors write:

Theorem 2

[4, Theorem 9] Let ( g , ϕ ) ∈ G p ⋊ Aut ( G p ) , where p is an odd prime. Suppose n is the smallest integer for which s g , ϕ ( n ) = 1 . Then,

n ∈ { p , p 2 , p 3 , p 4 , p 5 , p 6 , ( p − 1 ) , p ( p − 1 ) , p 2 ( p − 1 ) , p 3 ( p − 1 ) , p 4 ( p − 1 ) , p 5 ( p − 1 ) } .

The reasoning runs as follows. Since n ∣ ord ( ( g , ϕ ) ) , and ord ( ( g , ϕ ) ) ∣ G p ⋉ Aut ( G ) , we must have n ∣ ( p − 1 ) p 6 for some odd prime p , and n ≠ ( p − 1 ) p 6 since this would imply G p ⋊ Aut ( G p ) were cyclic.

The reasoning is sound; the conclusion of the theorem statement, however, is false when p ≠ 3 : since p is prime, p − 1 is not prime, and thus, the set of possibilities for n includes all elements of the set of divisors of p − 1 multiplied by powers of p , up to p 6 – not just the 12 values stated earlier. For instance, n = 2 p is a possibility for all p . The statement should read:

Theorem 3

Let ( g , ϕ ) ∈ G p ⋊ Aut ( G p ) , where p is an odd prime. Suppose n is the smallest integer for which s g , ϕ ( n ) = 1 . Let { p 1 , … , p t } be the set of prime divisors of p − 1 . Then,

n ∈ { p j ∏ i ∈ S p i } j , S ,

where S ⊂ [ t ] runs over multisets S such that ∏ i ∈ S p i denotes the products of the p i indexed by a subset of possible indices such that ∏ i ∈ S p i ∣ p − 1 , and j satisfies j ∈ [ 5 ] if S satisfies ∏ i ∈ S p i = p − 1 and j ∈ [ 6 ] otherwise.

We point this out for its relevance to our results in Section 4. If the number of prime factors of p − 1 is bounded, one can compute n efficiently (quantumly) given p , g , and ϕ , using the methods of [4, Section 5] or [3, Algorithm 1].

3 On G p and its automorphisms

In this section, we discuss properties of G p , which we will exploit in the following, and in particular, give an explicit form for its automorphisms. Any finite group G has a set of automorphisms, denoted Aut ( G ) , which form a group under composition. The structure of Aut ( G ) comprises two factors: the inner and outer automorphisms. These each form a subgroup of Aut ( G ) .

Inner automorphisms are defined by conjugation: if g ∈ G is an arbitrary group element, the map c h : g ↦ h g h − 1 can be checked to be an automorphism. The group formed by such maps is denoted Inn ( G ) . Clearly, if h commutes with all other group elements, c h is the trivial map; thus, when counting the number of inner automorphisms, we find that there are ∣ Inn ( G ) ∣ = ∣ G ∣ ∣ Z ( G ) ∣ of them, where Z ( G ) = { g ∈ G : g h = h g for all h ∈ G } denotes the centre of the group.

The group of outer automorphisms, Out ( G ) , is defined as

Out ( G ) ≔ Aut ( G ) ⁄ Inn ( G ) .

Hence, there are ∣ Out ( G ) ∣ = ∣ Aut ( G ) ∣ ⁄ ∣ Inn ( G ) ∣ outer automorphisms. We are interested in determining explicit forms of elements of these groups when G = G p , for our subsequent cryptanalysis of SPDH-Sign. In the following, we let g ∈ G p and write g = 1 + p m b 0 1 for some m ∈ Z ⁄ p Z and b ∈ Z ⁄ p 2 Z . As in the study of Conrad [20], G p is generated by elements r and s , where

r = 1 + p 0 0 1 and s = 1 1 0 1 .

So a generic group element g = 1 + p m b 0 1 may be written g = s b r m , and group multiplication can be expressed

s b r m ⋅ s b ′ r m ′ = s b + b ′ + p m b ′ r m + m ′ .

3.1 Inner automorphisms of G p

We first consider inner automorphisms. Note that ( s c r n ) − 1 = ( r n ) − 1 ( s c ) − 1 = r − n s − c = s p c n s − c r − n , since s p c n s − c r − n ⋅ s c r n = s p c n s − p c n r 0 = 1 . The inner automorphisms act on s b r m by conjugation; i.e., if ϕ ∈ Inn ( G p ) , then for some c and n ,

ϕ ( s b r m ) = ( s c r n ) − 1 s b r m ( s c r n ) = ( s c r n ) − 1 s b + c + p m c r m + n = s p c n s − c r − n s b + c + p m c r m + n = s p c n s b + p m c − p n ( b + c ) r m = s p n c + b + p m c − p n b − p n c r m = s b + p ( m c − n b ) r m .

We summarise this as

Lemma 1

Let ϕ be an inner automorphism of G p corresponding to conjugation by s c r n . Then, the action of ϕ on a generic group element g = s b r m is given by

ϕ ( g ) = s b + p ( m c − n b ) r m .

We note that there are ∣ Inn ( G p ) ∣ = ∣ G p ∣ ∣ Z ( G p ) ∣ = p 3 p = p 2 inner automorphisms, since the centre of G p is

Z ( G p ) = 1 b 0 1 : b ∈ Z ⁄ p 2 Z , b ≡ 0 mod p = 1 p 0 1 mod p 2 .

3.2 Outer automorphisms of G p

The form of the outer automorphisms is less obvious than that of the inner automorphsims; we have

Proposition 1

The outer automorphisms of G p are given by the maps

ϕ ( s b r m ) = s b w + p m u r m ,

where ϕ corresponds to a pair ( u , w ) ∈ Z ⁄ p Z ⋊ ( Z ⁄ p Z ) × .

Proof

Clearly, we have ϕ : G p → G p such that ϕ ( e ) = e . Let g = s b r m and g ′ = s b ′ r m ′ . Observe

ϕ ( g g ′ ) = ϕ ( s b r m ⋅ s b ′ r m ′ ) = ϕ ( s b + b ′ + p m b ′ r m + m ′ ) = s w ( b + b ′ + p m b ′ ) + p ( m + m ′ ) u r m + m ′

and

ϕ ( g ) ϕ ( g ′ ) = s b w + p m u r m s b ′ w + p m ′ u r m ′ = s b w + p m u + b ′ w + p m ′ u + p m ( b ′ w + p m ′ u ) r m + m ′ = s b w + p m u + b ′ w + p m ′ u + p m b ′ w r m + m ′ .

So ϕ is indeed multiplicative. Moreover, these are not inner automorphisms, which can be seen by inspecting the “twist” of b in the exponent by w . Note that there are ∣ Out ( G p ) ∣ = ∣ Aut ( G p ) ∣ ⁄ ∣ Inn ( G p ) ∣ = ( p − 1 ) p 3 ⁄ p 2 = ( p − 1 ) p outer automorphisms, and since the automorphisms mentioned earlier are obtained by pairs from Z ⁄ p Z ⋊ ( Z ⁄ p Z ) × , and ∣ Z ⁄ p Z ⋊ ( Z ⁄ p Z ) × ∣ = p ( p − 1 ) , we conclude we have found all the outer automorphisms.□

We conclude this section with the important observation.

Corollary 1

Let ϕ ∈ Aut ( G p ) . Then, for any g = s b r m , we have ϕ ( g ) = s b ′ r m for some b ′ ; i.e., ϕ leaves r m unchanged.

Proof

Observation of the results of Lemma 1 and Proposition 1.□

4 “Making Mash ” when n ≤ poly ( log p ) p

Here, we outline an attack on SPDH when n is “small” (although still exponential in the security parameter). The attack uses the structure of G p to extract information on x from g , ϕ , and s g , ϕ ( x ) . We begin with a proposition:

Proposition 2

Let G = M ⋊ N be a semidirect product of finite groups with N acting on M via automorphisms. Consider the holomorph of G , ( M ⋊ N ) ⋊ Aut ( G ) . Then, if N is simple, the maps induced on N by elements of Aut ( G ) are either the constant map N → { e } or automorphisms.

Proof

Let ϕ ∈ Aut ( G ) . Writing ϕ ( m , n ) = ( m ′ , n ′ ) , consider the induced map ψ : N → N , n ↦ n ′ . Since

ϕ ( ( m , n ) ) ϕ ( ( m ′ , n ′ ) ) = ϕ ( ( m , n ) ( m ′ , n ′ ) ) = ϕ ( ( n ′ ( m ) m ′ , n n ′ ) ) ,

we have ψ ( n ) ϕ ′ ( n ′ ) = ψ ( n n ′ ) . Moreover,

ϕ ( ( m , e ) ) ϕ ( ( m ′ , e ) ) = ϕ ( ( m , e ) ( m ′ , e ) ) = ϕ ( m m ′ , e ) ,

so ψ ( e ) ψ ( e ) = ψ ( e ) 2 = ψ ( e ) and ψ ( e ) is an idempotent in a finite group; hence, ψ ( e ) = e . Thus, ψ is an endomorphism of N .

Since the image of a group under an endomorphism is a subgroup, we find that either ψ ( N ) = N or ψ ( N ) = { e } . In the latter case, every element is mapped to e , and in the former, we have a homomorphism between finite groups of trivial kernel and thus an automorphism.□

We note that when N = Z ⁄ p Z , End ( Z ⁄ p Z ) = Z ⁄ p Z .

We now give a general method to recover x when n is at most a small multiple of ∣ Aut ( N ) ∣ , subject to a constraint on the group element ( g , ϕ ) ∈ G ⋊ Aut ( G ) , where G = M ⋊ N is a semidirect product with M and N finite abelian, and N simple as in the previous proposition, and g = ( a , φ ) ∈ G . We then specialise to the particular case of G p .

Theorem 4

Let G = M ⋊ N be a semidirect product with M and N finite abelian, and N simple. Suppose ∣ Aut ( N ) ∣ = ∏ i p i for distinct primes p i . Let ( g , ϕ ) ∈ G ⋊ Aut ( G ) , where g = ( a , φ ) ∈ G . Suppose that ϕ acts on φ as an automorphism ψ , sending φ ↦ φ α for some α ≠ 0 . Then, given s g , ϕ ( x ) for any x ∈ Z ⁄ n Z , there is a quantum polynomial time algorithm to find x mod ∣ Aut ( N ) ∣ .

Proof

The SDLP instance is to recover x from s g , ϕ ( x ) , which we may write

s g , ϕ ( x ) = ϕ x − 1 ( ( a , φ ) ) ϕ x − 2 ( ( a , φ ) ) … ϕ ( a , φ ) ( a , φ ) ,

where g = ( a , φ ) ∈ M ⋊ N . If ϕ acts as an induced automorphism ψ on φ sending φ to φ α for some α , then since ( g , ϕ ) is public, evaluating ϕ ( g ) for φ α and appealing to an abelian discrete logarithm oracle yields α . We can write s g , ϕ ( x ) as

ϕ x − 1 ( ( a , φ ) ) ϕ x − 2 ( ( a , φ ) ) … ϕ ( ( a , φ ) ) ( a , φ ) = ( ⋅ , ψ x − 1 ( φ ) ψ x − 2 ( φ ) … ψ ( φ ) φ ) ,

for some unspecified first entry. The second entry above can be rewritten

( φ α x − 1 ) ( φ α x − 2 ) … ( φ α ) φ = φ α x − 1 + α x − 2 + … + α + 1 .

Another appeal to an abelian discrete logarithm oracle obtains the exponent

α x − 1 + α x − 2 + … + α + 1 mod ∣ Aut ( N ) ∣ .

We now split into two cases: if α = 1 , then α x − 1 + α x − 2 + … + α + 1 = x mod ∣ Aut ( N ) ∣ and we are done. So suppose we are in the case of α ≠ 1 .

By the chinese remainder theorem, it suffices to recover x mod p i from

b ≔ α x − 1 + α x − 2 + … + α + 1 mod p i ,

for all prime factors p i of ∣ Aut ( N ) ∣ (which can be found efficiently with a quantum algorithm). To do this, rewrite

b = α x − 1 + α x − 2 + … + α + 1 = α x − 1 α − 1 mod p i

and rearrange for

α x = b ( α − 1 ) + 1 mod p i ,

which can be done since we assumed α ≠ 1 . A third appeal to an abelian discrete logarithm oracle gives x mod p i , and hence, x mod ∣ Aut ( N ) ∣ .□

Corollary 2

Let n = poly ( log p ) p and ( g , ϕ ) ∈ G p ⋊ Aut ( G p ) . Then, there is a quantum polynomial time algorithm to solve SDLP g , ϕ , x .

Proof

We apply the theorem with M = Z ⁄ p 2 Z and N = Z ⁄ p Z , since as noted above, we have G p ≅ Z ⁄ p 2 Z ⋊ Z ⁄ p Z , and note that by Corollary 1, any automorphism leaves the r component of a group element fixed, and so in the notation of the theorem, we always have α = 1 . We then obtain x mod ∣ Aut ( N ) ∣ = x mod ( p − 1 ) as in the proof of the theorem. If n = poly ( log p ) p , we can then find the true value of x by exhaustion in polynomial time, since there are n ⁄ ( p − 1 ) = poly ( log p ) p ⁄ ( p − 1 ) = poly ( log p ) options for the true value of x .□

We note that such values for n are possible by Theorem 3.

The consequence of all this is that when instantiating SPDH-Sign with G = G p , one should choose n to be at least n ≈ p 2 .

5 Attack in the style of Brown et al. [14]

In the study of Brown et al. [14], the scheme “MAKE” [8] was cryptanalysed, and Monico [21] extended the attack to the scheme “MOBS” [22]. The scheme uses square matrices whose entries are bitstrings of k bits equipped with the logical operations of OR and AND. Brown et al. [14] found (in the notation of Battarbee et al. [23]) that, given such a matrix M and an automorphism h of the space of such matrices, and writing A ≔ h x − 1 ( M ) … h ( M ) M , one could obtain h ( A ) M = h x ( M ) A . From this, it was argued that MAKE and MOBS were insecure, since by linear algebra h x ( M ) , and then h x and finally, x , could be computed (although the efficacy of the attack was disputed in the study of Battarbee et al. [23]).

We note that one can obtain ϕ x ( g ) given g , ϕ and s g , ϕ ( x ) , by computing

ϕ x ( g ) = ϕ ( s g , ϕ ( x ) ) g ⋅ s g , ϕ ( x ) − 1 ,

somewhat in the style of the attacks on MAKE and MOBS. It was known prior to this work that this element could be computed. Here, however, we observe that since we know g , one can then obtain further information on x .

In more detail and for G = G p , suppose we have g ∈ G p . Write g = 1 + p a b 0 1 for some a ∈ Z ⁄ p Z and b ∈ Z ⁄ p 2 Z . We then compute ϕ x ( g ) = 1 + p a ′ b ′ 0 1 for some a ′ ∈ Z ⁄ p Z and b ′ ∈ Z ⁄ p 2 Z . Here, we consider the case of inner automorphisms Inn ( G p ) and of elements in Out ( G p ) ≔ Aut ( G p ) ⁄ Inn ( G p ) .

First, consider inner automorphisms. Recall that the inner automorphisms act on s b r m by conjugation, and that by Lemma 1 if ϕ ∈ Inn ( G p ) , then

ϕ ( s b r m ) = s b + p ( m c − n b ) r m .

We then compute

ϕ x ( s b r m ) = s b + x p ( m c − n b ) r m .

We can multiply by r − m to obtain s b + x p ( m c − n b ) , use a discrete logarithm oracle to find b + x p ( m c − n b ) mod p 2 , and then if m c − n b ≢ 0 mod p rearrange to find x mod p .

In the case of outer automorphisms, we found in Proposition 1 that these are given by the maps

ϕ ( s b r m ) = s b w + p m u r m ,

where ϕ corresponds to a pair ( u , w ) ∈ Z ⁄ p Z ⋊ ( Z ⁄ p Z ) × . We then compute

ϕ x ( g ) = s b w x + p m u ( w x − 1 + … + w + 1 ) r m .

We can cancel the r m , since it is public, for

s b w x + p m u ( w x − 1 + … + w + 1 ) ,

and we can hence recover b w x + p m u ( w x − 1 + … + w + 1 ) mod p 2 by solving the DLP instance. If we apply this to ϕ x − 1 ( g ) as well, we may compute

s b w x + p m u ( w x − 1 + … + w + 1 ) ⋅ s − b w x − 1 − p m u ( w x − 2 + … + w + 1 ) = s b w x − b w − 1 + p m u ( w x − 1 + … + w + 1 ) − p m u ( w x − 2 + … + w + 1 ) = s b w x − 1 ( w − 1 ) + p m u w x − 1 ,

and we can then obtain b w x − 1 ( w − 1 ) + p m u w x − 1 mod p 2 = w x − 1 ( b ( w − 1 ) + p m u ) mod p 2 . If b ( w − 1 ) ≢ 0 mod p , we can cancel the righthand factor for w x − 1 and recover x − 1 mod p from a discrete logarithm oracle.

We summarise the above as

Proposition 3

Suppose x ∈ Z ⁄ n Z , ( g , ϕ ) ∈ G p ⋊ Aut ( G p ) , g = s b r m , and s g , ϕ ( x ) is a SDLP instance. Then, if ϕ is an inner automorphism, there is a quantum polynomial time algorithm to compute x mod p , and if ϕ is an outer automorphism corresponding to a pair ( u , w ) ∈ Z ⁄ p Z ⋊ ( Z ⁄ p Z ) × such that b ( w − 1 ) ≢ 0 mod p , then there is also a quantum polynomial time algorithm to recover x mod p .

Finally, we note all automorphisms are obtained from composing inner and outer automorphisms.

6 SPDH and the LHS problem

In this section, we show that Theorem 4 implies a solution to a special case of the LHS problem defined in the study of Alamati et al. [5]. We begin by defining this problem formally. Let ⟨ g i , s ⟩ ≔ ∏ j g i j s j , where g i j ∈ G and G is written multiplicatively.

Definition 8

The search LHS problem LHS G , X , s is hard over a regular group action ( G , X , ⋆ ) if for any m = poly ( λ ) , s ← { 0 , 1 } ℓ , and for any PPT attacker A , we have

Pr [ A ( { ( x i , g i , ( ⟨ g i , s ⟩ ) ⋆ x i ) } i ∈ [ m ] ) outputs s ] ≤ negl ( λ ) ,

where g i ← G ℓ and x i ← X are sampled independently, over all random coins in the experiment.

For SDPGA: the search LHS problem is hard over ( Z ⁄ n Z , X g , ϕ , ⋆ ) if for any m = poly ( λ ) and for any PPT attacker A , we have

Pr [ A ( { ( s g , ϕ ( y i ) , x i , ( ⟨ x i , s ⟩ ) ⋆ s g , ϕ ( y i ) ) } i ∈ [ m ] ) outputs s ] ≤ negl ( λ ) ,

where x i ← ( Z ⁄ n Z ) ℓ , s ← { 0 , 1 } ℓ , ( g , ϕ ) ← G p ⋊ Aut ( G p ) , and s g , ϕ ( y i ) ← X g , ϕ are sampled independently, over all random coins in the experiment. Note that additively,

( ⟨ x i , s ⟩ ) ⋆ s g , ϕ ( y i ) = ∑ j s j x i j ⋆ s g , ϕ ( y i ) = s g , ϕ ∑ j s j x i j + y i .

We consider the special case in which the same s g , ϕ ( y ) is used for all s g , ϕ ( y i ) , i = 1 , … , ℓ . We denote this case by LHS Z ⁄ n Z , X g , ϕ , s , y . We now prove our result:

Theorem 5

Let ( g , ϕ ) ∈ G p ⋊ Aut ( G p ) and let m ≥ ℓ + 1 . Then, there is a quantum polynomial time algorithm to solve LHS Z ⁄ n Z , X g , ϕ , s , y .

Proof

Write x ′ = ∑ j s j x i j . We are given the ( g , ϕ ) , x i , and s g , ϕ ( x ′ + y ) . We therefore use the method of Theorem 4 to find b i ≔ x ′ + y mod ( p − 1 ) , for i = 1 , … , m . This gives us the m equations

b 1 = ∑ j s j x 1 j + y mod ( p − 1 ) ⋮ b m = ∑ j s j x m j + y mod ( p − 1 ) .

This is m equations in the ℓ + 1 unknown values of s 1 , … , s ℓ , y with known coefficients x i j mod ( p − 1 ) . We may set x i j + 1 = 1 for all i as the “coefficient” of y . Since s i ∈ { 0 , 1 } for all i the modulo operation leaves s i unchanged. Thus, when m ≥ ℓ + 1 , we can solve this system of equations for the s i ( and y mod ( p − 1 ) ) , and so solve the search LHS instance.□

7 On the equivalence of SCDH and SDLP

Here, we reduce SDLP to the SCDH problem via an efficient quantum algorithm. Since SCDH reduces to SDLP trivially, this establishes the quantum polynomial equivalence of the two problems, stated as an open problem in [4]. We note the results of previous studies [24,25] on the corresponding problem in the commutative case; our result is analogous to [24, Theorem 1]. We do this by transforming SDLP instances into HSP instances, assuming the presence of a SCDH oracle. Recall:

Definition 9

(HSP) Let f : G → S be a function from finite group G to a set S that is constant on the cosets of some H ≤ G ; i.e. f ( g ) = f ( g ′ ) if and only if g H = g ′ H . Given f , G , S , find a generating set of H .

We refer below to SCDH g , ϕ , x 2 , which is the general SCDH problem restricted to the task of doubling in the argument of s g , ϕ ( x ) ; i.e., one solves SCDH g , ϕ , x 2 if given g , ϕ , and s g , ϕ ( x ) , one computes s g , ϕ ( x + x ) = s g , ϕ ( 2 x ) . Note that this is weaker than a general SCDH oracle, which returns s g , ϕ ( a + b ) given s g , ϕ ( a ) and s g , ϕ ( b ) for any a , b ∈ Z ⁄ n Z .

Theorem 6

There is a quantum polynomial-time reduction from SDLP g , ϕ , x to SCDH g , ϕ , x 2 .

Proof

Let x ∈ Z ⁄ n Z , ( g , ϕ ) ∈ G ⋊ Aut ( G ) , and suppose we are given s g , ϕ ( x ) . We assume that given ( g , ϕ ) , s g , ϕ ( x ) , and s g , ϕ ( y ) , we are able to compute s g , ϕ ( x + y ) in the case x = y . In particular, we can then compute s g , ϕ ( a x ) for any a in (classical) polynomial time by computing s g , ϕ ( 2 x ) = s g , ϕ ( x + x ) , writing a in base 2, and then repeatedly doubling and adding in the argument of s g , ϕ ( ⋅ ) appropriately.

We then define a map f : Z ⁄ n Z × Z ⁄ n Z → X g , ϕ , ( a , b ) ↦ ϕ b ( s g , ϕ ( a x ) ) s g , ϕ ( b ) . This can be rewritten f ( a , b ) = s g , ϕ ( a x + b ) . Observe that if f ( a , b ) = f ( a ′ , b ′ ) , then we must have a x + b = a ′ x + b ′ mod n , since the group action of Z ⁄ n Z on G ⋊ Aut ( G ) is regular. We then find that f ( a , b ) = f ( a ′ , b ′ ) if and only if ( a , b ) = ( a ′ , b ′ ) + λ ( 1 , − x ) . This is an HSP instance, which can be solved in quantum polynomial time via Shor.□

We note that our result assumes a perfect SCDH g , ϕ , x 2 oracle; we leave for future work the adaptation of the results of Montgomery and Zhandry [25], which hold for algorithms solving CDH with non-negligible advantage.

8 Relation of SDLP to HSP

In this final section we explain why, we could not solve the SDLP problem via a reduction to an HSP instance in an analogous manner to the abelian DLP.

DLP is reduced to HSP via the map f ( a , b ) = s a g b , where g x = s , with a , b ∈ Z ⁄ n Z . Then, f ( a , b ) = g a x + b , and f ( a , b ) = f ( a ′ , b ′ ) if and only if ( a , b ) = ( a ′ , b ′ ) + λ ( 1 , − x ) .

In that spirit, one might try setting f ( a , b , c ) = ( s g , ϕ ( x ) , ϕ a ) c ( g , ϕ ) b . Then, if a = x , we have f ( a , b , c ) = ( g , ϕ ) c x + b , and we would have defined a map from an abelian group into the cyclic group ⟨ ( g , ϕ ) ⟩ , as is done for DLP. The condition a = x seems problematic, however. Note f ( a , b , c ) = f ( a ′ , b ′ , c ′ ) if ( a , b , c ) = ( x , b ′ , c ′ ) + λ ( 0 , − x , 1 ) , as (some) solutions have the form ( x , 0 , 0 ) + ⟨ ( 0 , − x , 1 ) ⟩ , which is an affine line in ( Z ⁄ n Z ) 3 . This, however, is not a “period” in the sense of Shor that Shor’s algorithm for the HSP requires. Thus, an obstacle for defining the required map is the “hiding” of ϕ x , which prevents an adversary for defining a map into ⟨ ( g , ϕ ) ⟩ .

One might observe that we are not given a group element, but merely an element of the orbit X g , ϕ of ( g , ϕ ) under the action of Z ⁄ n Z . This might prompt one to attempt to define a map f : Z ⁄ n Z × Z ⁄ n Z → X g , ϕ in the spirit of the aforementioned map. This would seek to define a map f ( a , b ) = s g , ϕ ( a x + b ) . Then, since the group action is regular, f ( a , b ) = f ( a ′ , b ′ ) if and only if ( a , b ) = ( a ′ , b ′ ) + λ ( 1 , − x ) , and we could use Shor’s period finding algorithm. Since we can add b in the argument, to define such a map, one would first have to define a map f ′ ( a ) = s g , ϕ ( a x ) . Referring to the previous section, one can see that this is in fact how Theorem 6 was proved, since the possibility of defining such a map follows from assuming SCDH. However, it seems that without the SCDH assumption, one cannot compute s g , ϕ ( a x ) given the available information. This thus can be seen as an obstacle to a complete quantum solution to SDLP.

Funding information: This work was supported in part by the Engineering and Physical Sciences Research Council (EPSRC), Grant Numbers EP/X037010/1 and EP/Y037243/1.
Author contributions: All authors have accepted responsibility for the entire content of this manuscript and approved its submission.
Conflict of interest: The authors state no conflict of interest.

References

[1] Diffie W, Hellman M. New directions in cryptography. IEEE Trans Inform Theory. 1976;22(6):644–54. 10.1109/TIT.1976.1055638Search in Google Scholar

[2] Shor PW. Algorithms for quantum computation: discrete logarithms and factoring. In: Proceedings 35th Annual Symposium on Foundations of Computer Science; 1994. p. 124–34. 10.1109/SFCS.1994.365700Search in Google Scholar

[3] Battarbee C, Kahrobaei D, Perret L, Shahandashti SF. A subexponential quantum algorithm for the semidirect discrete logarithm problem; 2022. Presented at NIST’s Fourth PQC Standardization Conference. Cryptology ePrint Archive, Paper 2022/1165. https://eprint.iacr.org/2022/1165. Search in Google Scholar

[4] Battarbee C, Kahrobaei D, Perret L, Shahandashti SF. SPDH-sign: towards efficient, post-quantum group-based signatures. In: Johansson T, Smith-Tone D, editors. Post-quantum cryptography. Switzerland: Springer Nature; 2023. p. 113–38. 10.1007/978-3-031-40003-2_5Search in Google Scholar

[5] Alamati N, De Feo L, Montgomery H, Patranabis S. Cryptographic group actions and applications. In: Moriai S, Wang H, editors. ASIACRYPT 2020. Cham: Springer International Publishing; 2020. p. 411–39. 10.1007/978-3-030-64834-3_14Search in Google Scholar

[6] Alamati N, Malavolta G, Rahimi A. Candidate trapdoor claw-free functions from group actions with applications to quantum protocols. In: Kiltz E, Vaikuntanathan V, editors. TCC 2022. vol. 13747 of LNCS. Switzerland: Springer Nature; 2022. p. 266–93. 10.1007/978-3-031-22318-1_10Search in Google Scholar

[7] Alamati N, Patranabis S. Cryptographic primitives with hinting property. In: Agrawal S, Lin D, editors. ASIACRYPT 2022. vol. 13791 of LNCS. Switzerland: Springer Nature; 2022. p. 33–62. 10.1007/978-3-031-22963-3_2Search in Google Scholar

[8] Rahman N, Shpilrain V. MAKE: A matrix action key exchange. J Math Cryptol. 2022;16(1):64–72. 10.1515/jmc-2020-0053Search in Google Scholar

[9] Habeeb M, Kahrobaei D, Koupparis C, Shpilrain V. Public key exchange using semidirect product of (semi)groups. In: Jacobson M, Locasto M, Mohassel P, Safavi-Naini R, editorsApplied u. Berlin Heidelberg: Springer; 2013. p. 475–86. 10.1007/978-3-642-38980-1_30Search in Google Scholar

[10] Kahrobaei D, Shpilrain V. Using semidirect product of (semi)groups in public key cryptography. In: Beckmann A, Bienvenu L, Jonoska N, editors. Pursuit of the Universal. Cham: Springer International Publishing; 2016. p. 132–41. 10.1007/978-3-319-40189-8_14Search in Google Scholar

[11] Battarbee C, Kahrobaei D, Shahandashti SF. Semidirect product key exchange: the state of play; 2023. Cryptology ePrint Archive, Paper 2023/594. https://eprint.iacr.org/2023/594. 10.1142/S0219498825500665Search in Google Scholar

[12] Roman’kov V. Linear decomposition attack on public key exchange protocols using semidirect products of (semi)groups. CoRR. 2015; http://arxiv.org/abs/1501.01152. Search in Google Scholar

[13] Battarbee C, Kahrobaei D, Shahandashti SF. Cryptanalysis of semidirect product key exchange using matrices over non-commutative rings. Math Cryptol. 2022 March;1(2):2–9. https://journals.flvc.org/mathcryptology/article/view/130528. Search in Google Scholar

[14] Brown DRL, Koblitz N, LeGrow JT. Cryptanalysis of MAKE. J Math Cryptol. 2022;16(1):98–102. 10.1515/jmc-2021-0016Search in Google Scholar

[15] Couveignes JM. Hard Homogeneous Spaces; 2006. Cryptology ePrint Archive, Paper 2006/291. https://eprint.iacr.org/2006/291. Search in Google Scholar

[16] Gnilke OW, Zumbrägel J. Cryptographic group and semigroup actions. J Algebra Appl. 2024;23(07):2530001. 10.1142/S0219498825300016Search in Google Scholar

[17] Castryck W, Vander Meeren N. Two remarks on the vectorization problem. In: Isobe T, Sarkar S, editors. INDOCRYPT 2022. vol. 13774 of LNCS. Cham: Springer International Publishing; 2022. p. 658–78. 10.1007/978-3-031-22912-1_29Search in Google Scholar

[18] D’Alconzo G, Di Scala AJ. Representations of group actions and their applications in cryptography. Finite Fields Appl. 2024;99:102476. 10.1016/j.ffa.2024.102476Search in Google Scholar

[19] Imran M, Ivanyos G. Efficient quantum algorithms for some instances of the semidirect discrete logarithm problem. Designs Codes Cryptography. 2024 May;92:2825–43. 10.1007/s10623-024-01416-8Search in Google Scholar

[20] Conrad K. Groups of order p3; https://kconrad.math.uconn.edu/blurbs/grouptheory/groupsp3.pdf. Search in Google Scholar

[21] Monico C. Remarks on MOBS and cryptosystems using semidirect products; 2021. Cryptology ePrint Archive, Paper 2021/1114. https://eprint.iacr.org/2021/1114. Search in Google Scholar

[22] Rahman N, Shpilrain V. MOBS: matrices over bit strings public key exchange. La Matematica. 2024 June;3:1198–206.10.1007/s44007-024-00114-0Search in Google Scholar

[23] Battarbee C, Kahrobaei D, Tailor D, Shahandashti SF. On the efficiency of a general attack against the MOBS cryptosystem. J Math Cryptol. 2022;16(1):289–97. 10.1515/jmc-2021-0050Search in Google Scholar

[24] Galbraith S, Panny L, Smith B, Vercauteren F. Quantum equivalence of the DLP and CDHP for group actions. Math Cryptol. 2021 June;1(1):40–4. https://journals.flvc.org/mathcryptology/article/view/122741. Search in Google Scholar

[25] Montgomery H, Zhandry M. Full quantum equivalence of group action DLog and CDH, and more. In: Agrawal S, Lin D, editors. ASIACRYPT 2022. vol. 13791 of LNCS. Switzerland: Springer Nature; 2022. p. 3–32. 10.1007/978-3-031-22963-3_1Search in Google Scholar

Received: 2024-06-10

Revised: 2024-11-20

Accepted: 2025-01-13

Published Online: 2025-03-04

This work is licensed under the Creative Commons Attribution 4.0 International License.

Articles in the same Issue

https://doi.org/10.1515/jmc-2024-0025

Keywords for this article

semidirect product; discrete logarithm; signatures; group actions; cryptanalysis

Creative Commons

BY 4.0