arXiv subjects

Vladimir Shpilrain

Publications and source records attributed to Vladimir Shpilrain.

At least 55 records · Page 3Linked to original sources

arXiv2010

Search and witness problems in group theory

Decision problems are problems of the following nature: given a property P and an object O, find out whether or not the object O has the property P. On the other hand, witness problems are: given a property P and an object O with the property P, find a proof of the fact that O indeed has the property P. On the third hand(?!), search problems are of the following nature: given a property P and an object O with the property P, find something "material" establishing the property P; for example, given two conjugate elements of a group, find a conjugator. In this survey our focus is on various search problems in group theory, including the word search problem, the subgroup membership search problem, the conjugacy search problem, and others.

math.GR↗

arXiv2008

An authentication scheme based on the twisted conjugacy problem

The conjugacy search problem in a group $G$ is the problem of recovering an $x \in G$ from given $g \in G$ and $h=x^{-1}gx$. The alleged computational hardness of this problem in some groups was used in several recently suggested public key exchange protocols, including the one due to Anshel, Anshel, and Goldfeld, and the one due to Ko, Lee et al. Sibert, Dehornoy, and Girault used this problem in their authentication scheme, which was inspired by the Fiat-Shamir scheme involving repeating several times a three-pass challenge-response step. In this paper, we offer an authentication scheme whose security is based on the apparent hardness of the twisted conjugacy search problem, which is: given a pair of endomorphisms (i.e., homomorphisms into itself) phi, ψof a group G and a pair of elements w, t \in G, find an element s \in G such that t = ψ(s^{-1}) w ϕ(s) provided at least one such s exists. This problem appears to be very non-trivial even for free groups. We offer here another platform, namely, the semigroup of all 2x2 matrices over truncated one-variable polynomials over F_2, the field of two elements, with transposition used instead of inversion in the equality above.

math.GR↗

arXiv2008

Zero-knowledge authentication schemes from actions on graphs, groups, or rings

We propose a general way of constructing zero-knowledge authentication schemes from actions of a semigroup on a set, without exploiting any specific algebraic properties of the set acted upon. Then we give several concrete realizations of this general idea, and in particular, we describe several zero-knowledge authentication schemes where forgery (a.k.a. impersonation) is NP-hard. Computationally hard problems that can be employed in these realizations include (Sub)graph Isomorphism, Graph Colorability, Diophantine Problem, and many others.

cs.CR↗

arXiv2007

Using decision problems in public key cryptography

There are several public key establishment protocols as well as complete public key cryptosystems based on allegedly hard problems from combinatorial (semi)group theory known by now. Most of these problems are search problems, i.e., they are of the following nature: given a property P and the information that there are objects with the property P, find at least one particular object with the property P. So far, no cryptographic protocol based on a search problem in a non-commutative (semi)group has been recognized as secure enough to be a viable alternative to established protocols (such as RSA) based on commutative (semi)groups, although most of these protocols are more efficient than RSA is. In this paper, we suggest to use decision problems from combinatorial group theory as the core of a public key establishment protocol or a public key cryptosystem. By using a popular decision problem, the word problem, we design a cryptosystem with the following features: (1) Bob transmits to Alice an encrypted binary sequence which Alice decrypts correctly with probability "very close" to 1; (2) the adversary, Eve, who is granted arbitrarily high (but fixed) computational speed, cannot positively identify (at least, in theory), by using a "brute force attack", the "1" or "0" bits in Bob's binary sequence. In other words: no matter what computational speed we grant Eve at the outset, there is no guarantee that her "brute force attack" program will give a conclusive answer (or an answer which is correct with overwhelming probability) about any bit in Bob's sequence.

math.GR↗

arXiv2005

A new key exchange protocol based on the decomposition problem

In this paper we present a new key establishment protocol based on the decomposition problem in non-commutative groups which is: given two elements $w, w_1$ of the platform group $G$ and two subgroups $A, B \subseteq G$ (not necessarily distinct), find elements $a \in A, b \in B$ such that $w_1 = a w b$. Here we introduce two new ideas that improve the security of key establishment protocols based on the decomposition problem. In particular, we conceal (i.e., do not publish explicitly) one of the subgroups $A, B$, thus introducing an additional computationally hard problem for the adversary, namely, finding the centralizer of a given finitely generated subgroup.

math.GR↗

arXiv2005

Densities in free groups and $\mathbb{Z}^k$, Visible Points and Test Elements

In this article we relate two different densities. Let $F_k$ be the free group of finite rank $k \ge 2$ and let $α$ be the abelianization map from $F_k$ onto $ \mathbb{Z}^k$. We prove that if $S \subseteq \mathbb{Z}^k$ is invariant under the natural action of $SL(k, \mathbb{Z})$ then the asymptotic density of $S$ in $\mathbb Z^k$ and the annular density of its full preimage $α^{-1}(S)$ in $F_k$ are equal. This implies, in particular, that for every integer $t\ge 1$, the annular density of the set of elements in $F_k$ that map to $t$-th powers of primitive elements in $\mathbb{Z}^k$ is equal to to $\frac{1}{t^kζ(k)}$, where $ζ$ is the Riemann zeta-function. An element $g$ of a group $G$ is called a \emph{test element} if every endomorphism of $G$ which fixes $g$ is an automorphism of $G$. As an application of the result above we prove that the annular density of the set of all test elements in the free group $F(a,b)$ of rank two is $1-\frac{6}{π^2}$. Equivalently, this shows that the union of all proper retracts in $F(a,b)$ has annular density $\frac{6}{π^2}$. Thus being a test element in $F(a,b)$ is an ``intermediate property'' in the sense that the probability of being a test element is strictly between 0 and 1.

math.GR↗

arXiv2005

Some metric properties of automorphisms of groups

Study of the dynamics of automorphisms of a group is usually focused on their growth and/or finite orbits, including fixed points. In this paper, we introduce properties of a different kind; using somewhat informal language, we call them metric properties. Two principal characteristics of this kind are called here the "curl" and the "flux"; there seems to be very little correlation between these and the growth of an automorphism, which means they are likely to be an essentially new tool for studying automorphisms. We also observe that our definitions of the curl and flux are sufficiently general to be applied to mappings of arbitrary metric spaces.

math.GR↗

arXiv2005

Thompson's group and public key cryptography

Recently, several public key exchange protocols based on symbolic computation in non-commutative (semi)groups were proposed as a more efficient alternative to well established protocols based on numeric computation. Notably, the protocols due to Anshel-Anshel-Goldfeld and Ko-Lee et al. exploited the conjugacy search problem in groups, which is a ramification of the discrete logarithm problem. However, it is a prevalent opinion now that the conjugacy search problem alone is unlikely to provide sufficient level of security no matter what particular group is chosen as a platform. In this paper we employ another problem (we call it the decomposition problem), which is more general than the conjugacy search problem, and we suggest to use R. Thompson's group as a platform. This group is well known in many areas of mathematics, including algebra, geometry, and analysis. It also has several properties that make it fit for cryptographic purposes. In particular, we show here that the word problem in Thompson's group is solvable in almost linear time.

math.GR↗

arXiv2005

Translation equivalence in free groups

Motivated by the work of Leininger on hyperbolic equivalence of homotopy classes of closed curves on surfaces, we investigate a similar phenomenon for free groups. Namely, we study the situation when two elements $g,h$ in a free group $F$ have the property that for every free isometric action of $F$ on an $\mathbb{R}$-tree $X$ the translation lengths of $g$ and $h$ on $X$ are equal. We give a combinatorial characterization of this phenomenon, called translation equivalence, in terms of Whitehead graphs and exhibit two difference sources of it. The first source of translation equivalence comes from representation theory and $SL_2$ trace identities. The second source comes from geometric properties of groups acting on real trees and a certain power redistribution trick. We also analyze to what extent these are applicable to the tree actions of surface groups that occur in the Thurston compactification of the Teichmuller space.

math.GR↗

arXiv2004

The conjugacy search problem in public key cryptography: unnecessary and insufficient

The conjugacy search problem in a group G is the problem of recovering an x in G from given g in G and h=x^{-1}gx. This problem is in the core of several recently suggested public key exchange protocols, most notably the one due to Anshel, Anshel, and Goldfeld, and the one due to Ko, Lee at al. In this note, we make two observations that seem to have eluded most people's attention. The first observation is that solving the conjugacy search problem is not necessary for an adversary to get the common secret key in the Ko-Lee protocol. It is sufficient to solve an apparently easier problem of finding x, y in G such that h=ygx for given g, h in G. Another observation is that solving the conjugacy search problem is not sufficient for an adversary to get the common secret key in the Anshel-Anshel-Goldfeld protocol.

math.GR↗

arXiv2004

Combinatorial group theory and public key cryptography

After some excitement generated by recently suggested public key exchange protocols due to Anshel-Anshel-Goldfeld and Ko-Lee et al., it is a prevalent opinion now that the conjugacy search problem is unlikely to provide sufficient level of security if a braid group is used as the platform. In this paper we address the following questions: (1) whether choosing a different group, or a class of groups, can remedy the situation; (2) whether some other "hard" problem from combinatorial group theory can be used, instead of the conjugacy search problem, in a public key exchange protocol. Another question that we address here, although somewhat vague, is likely to become a focus of the future research in public key cryptography based on symbolic computation: (3) whether one can efficiently disguise an element of a given group (or a semigroup) by using defining relations.

math.GR↗

arXiv2004

Generic properties of Whitehead's Algorithm and isomorphism rigidity of random one-relator groups

We prove that Whitehead's algorithm for solving the automorphism problem in a fixed free group $F_k$ has strongly linear time generic-case complexity. This is done by showing that the ``hard'' part of the algorithm terminates in linear time on an exponentially generic set of input pairs. We then apply these results to one-relator groups. We obtain a Mostow-type isomorphism rigidity result for random one-relator groups: If two such groups are isomorphic then their Cayley graphs on the \emph{given generating sets} are isometric. Although no nontrivial examples were previously known, we prove that one-relator groups are generically \emph{complete} groups, that is, they have trivial center and trivial outer automorphism group. We also prove that the stabilizers of generic elements of $F_k$ in $Aut(F_k)$ are cyclic groups generated by inner automorphisms and that $Aut(F_k)$-orbits are uniformly small in the sense of their growth entropy. We further prove that the number $I_k(n)$ of \emph{isomorphism types} of $k$-generator one-relator groups with defining relators of length $n$ satisfies \[ \frac{c_1}{n} (2k-1)^n \le I_k(n)\le \frac{c_2}{n} (2k-1)^n, \] where $c_1=c_1(k)>0, c_2=c_2(k)>0$ are some constants independent of $n$. Thus $I_k(n)$ grows in essentially the same manner as the number of cyclic words of length $n$.

math.GR↗

arXiv2004

Test polynomials, retracts, and the Jacobian conjecture

Let K[x,y] be the algebra of two-variable polynomials over a field K. A polynomial p=p(x, y) is called a test polynomial (for automorphisms) if, whenever ϕ(p)=p for a mapping ϕof K[x,y], this ϕmust be an automorphism. Here we show that p \in C[x,y] is a test polynomial if and only if p does not belong to any proper retract of C[x,y]. This has the following corollary that may have application to the Jacobian conjecture: if a mapping ϕof C[x,y] with invertible Jacobian matrix is ``invertible on one particular polynomial", then it is an automorphism. More formally: if there is a non-constant polynomial p and an injective mapping ψof C[x,y] such that ψ(ϕ(p)) =p, then ϕis an automorphism.

math.AG↗

arXiv2003

On the palindromic and primitive widths of a free group

Let G be a group and S a subset of G that generates G. For each x in G define the length l_S(x) of x relative to S to be the minimal k such that x is a product of k elements of S. The supremum of the values l_S(x), x \in G, is called the width of G with respect to S. Here we focus on a free group F. The width of F relative to the set of all primitive (respectively palindromic) elements is called the primitive (respectively palindromic) width of F. We prove that for a free group F_n of finite rank n, both widths are infinite. A result of independent interest is that every primitive element of F_2 is a product of at most two palindromes.

math.GR↗

arXiv2003

Assessing security of some group based cryptosystems

One of the possible generalizations of the discrete logarithm problem to arbitrary groups is the so-called conjugacy search problem (sometimes erroneously called just the conjugacy problem): given two elements a, b of a group G and the information that a^x=b for some x \in G, find at least one particular element x like that. Here a^x stands for xax^{-1}. The computational difficulty of this problem in some particular groups has been used in several group based cryptosystems. Recently, a few preprints have been in circulation that suggested various "neighbourhood search" type heuristic attacks on the conjugacy search problem. The goal of the present survey is to stress a (probably well known) fact that these heuristic attacks alone are not a threat to the security of a cryptosystem, and, more importantly, to suggest a more credible approach to assessing security of group based cryptosystems. Such an approach should be necessarily based on the concept of the average case complexity (or expected running time) of an algorithm. These arguments support the following conclusion: although it is generally feasible to base the security of a cryptosystem on the difficulty of the conjugacy search problem, the group G itself (the "platform") has to be chosen very carefully. In particular, experimental as well as theoretical evidence collected so far makes it appear likely that braid groups are not a good choice for the platform. We also reflect on possible replacements.

math.GR↗

arXiv2003

The Stable Equivalence and Cancellation Problems

Let $K$ be an arbitrary field of characteristic 0, and $\Aff^n$ the $n$-dimensional affine space over $K$. A well-known cancellation problem asks, given two algebraic varieties $V_1, V_2 \subseteq \Aff^n$ with isomorphic cylinders $V_1 \times \Aff^1$ and $V_2 \times \Aff^1$, whether $V_1$ and $V_2$ themselves are isomorphic. In this paper, we focus on a related problem: given two varieties with equivalent (under an automorphism of $\Aff^{n+1}$) cylinders $V_1 \times \Aff^1$ and $V_2 \times \Aff^1$, are $V_1$ and $V_2$ equivalent under an automorphism of $\Aff^n$? We call this stable equivalence problem. We show that the answer is positive for any two curves $V_1, V_2 \subseteq \Aff^2$. For an arbitrary $n \ge 2$, we consider a special, arguably the most important, case of both problems, where one of the varieties is a hyperplane. We show that a positive solution of the stable equivalence problem in this case implies a positive solution of the cancellation problem.

math.AG↗

arXiv2003

Birational morphisms of the plane

Let A^2 be the affine plane over a field K of characteristic 0. Birational morphisms of A^2 are mappings A^2 \to A^2 given by polynomial mappings ϕof the polynomial algebra K[x,y] such that for the quotient fields, one has K(ϕ(x), ϕ(y)) = K(x,y). Polynomial automorphisms are obvious examples of such mappings. Another obvious example is the mapping τ_x given by x \to x, y \to xy. For a while, it was an open question whether every birational morphism is a product of polynomial automorphisms and copies of τ_x. This question was answered in the negative by P. Russell (in an informal communication). In this paper, we give a simple combinatorial solution of the same problem. More importantly, our method yields an algorithm for deciding whether a given birational morphism can be factored that way.

math.AG↗

arXiv2003

On the Andrews-Curtis equivalence

The Andrews-Curtis conjecture claims that every balanced presentation of the trivial group can be reduced to the standard one by a sequence of ``elementary transformations" which are Nielsen transformations augmented by arbitrary conjugations. It is a prevalent opinion that this conjecture is false; however, not many potential counterexamples are known. In this paper, we show that some of the previously proposed examples are actually not counterexamples. We hope that the tricks we used in constructing relevant chains of elementary transformations will be useful to those who attempt to establish the Andrews-Curtis equivalence in other situations. On the other hand, we give two rather general and simple methods for constructing balanced presentations of the trivial group; some of these presentations can be considered potential counterexamples to the Andrews-Curtis conjecture. One of the methods is based on a simple combinatorial idea of composition of group presentations, whereas the other one uses "exotic" knot diagrams of the unknot. We also consider the Andrews-Curtis equivalence in metabelian groups and reveal some interesting connections of relevant problems to well-known problems in K-theory.

math.GR↗