Cayley–Purser algorithm

<h2 id="history">History</h2>
During a work-experience placement with Baltimore Technologies, Flannery was shown an unpublished paper by Michael Purser which outlined a new <a href="/facts/Public-key/gowoFTxS">public-key</a> cryptographic scheme using <a href="/facts/Non-commutative/WaYxJLxd">non-commutative</a> multiplication. She was asked to write an implementation of this scheme in <a href="/facts/Mathematica/dRwoGFG2">Mathematica</a>.
Before this placement, Flannery had attended the 1998 <a href="/facts/Young_Scientist_and_Technology_Exhibition/oVdCrl4w">ESAT Young Scientist and Technology Exhibition</a> with a project describing already existing cryptographic techniques from the <a href="/facts/Caesar_cipher/Pjy93nA5">Caesar cipher</a> to <a href="/facts/RSA_(algorithm)/XTzyfHuq">RSA</a>. This had won her the Intel Student Award which included the opportunity to compete in the 1998 <a href="/facts/Intel_International_Science_and_Engineering_Fair/uY907Fj8">Intel International Science and Engineering Fair</a> in the United States. Feeling that she needed some original work to add to her exhibition project, Flannery asked Michael Purser for permission to include work based on his cryptographic scheme.
On advice from her mathematician father, Flannery decided to use <a href="/facts/Matrix_(mathematics)/qa8FI4ko">matrices</a> to implement Purser's scheme as <a href="/facts/Matrix_multiplication/lYDB6Ro2">matrix multiplication</a> has the necessary property of being non-commutative. As the resulting algorithm would depend on multiplication it would be a great deal faster than the RSA algorithm which uses an <a href="/facts/Exponent/pac6QY2g">exponential</a> step. For her Intel Science Fair project Flannery prepared a demonstration where the same plaintext was enciphered using both RSA and her new Cayley–Purser algorithm and it did indeed show a significant time improvement.
Returning to the ESAT Young Scientist and Technology Exhibition in 1999, Flannery formalised Cayley-Purser's runtime and analyzed a variety of known attacks, none of which were determined to be effective.
Flannery did not make any claims that the Cayley–Purser algorithm would replace RSA, knowing that any new cryptographic system would need to stand the test of time before it could be acknowledged as a secure system. The media were not so circumspect however and when she received first prize at the ESAT exhibition, newspapers around the world reported the story that a young girl genius had revolutionised cryptography.
In fact an attack on the algorithm was discovered shortly afterwards but she analyzed it and included it as an appendix in later competitions, including a Europe-wide competition in which she won a major award.

<h2 id="overview">Overview</h2>
Notation used in this discussion is as in Flannery's original paper.

<h3>Key generation</h3>
Like RSA, Cayley-Purser begins by generating two large primes p and q and their product n, a <a href="/facts/Semiprime/J5cNFs7T">semiprime</a>. Next, consider <a href="/facts/General_linear_group/B54gNILS">GL</a>(2,n), the <a href="/facts/General_linear_group/B54gNILS">general linear group</a> of 2×2 matrices with integer elements and <a href="/facts/Modular_arithmetic/0wtRa5dU">modular arithmetic</a> mod n. For example, if n=5, we could write:

[
            
              
                
                  0
                
                
                  1
                
              
              
                
                  2
                
                
                  3
                
              
            
            ]
          
        
        +
        
          
            [
            
              
                
                  1
                
                
                  2
                
              
              
                
                  3
                
                
                  4
                
              
            
            ]
          
        
        =
        
          
            [
            
              
                
                  1
                
                
                  3
                
              
              
                
                  5
                
                
                  7
                
              
            
            ]
          
        
        ≡
        
          
            [
            
              
                
                  1
                
                
                  3
                
              
              
                
                  0
                
                
                  2
                
              
            
            ]
          
        
      
    
    {\displaystyle {\begin{bmatrix}0&1\\2&3\end{bmatrix}}+{\begin{bmatrix}1&2\\3&4\end{bmatrix}}={\begin{bmatrix}1&3\\5&7\end{bmatrix}}\equiv {\begin{bmatrix}1&3\\0&2\end{bmatrix}}}

[
            
              
                
                  0
                
                
                  1
                
              
              
                
                  2
                
                
                  3
                
              
            
            ]
          
        
        
          
            [
            
              
                
                  1
                
                
                  2
                
              
              
                
                  3
                
                
                  4
                
              
            
            ]
          
        
        =
        
          
            [
            
              
                
                  3
                
                
                  4
                
              
              
                
                  11
                
                
                  16
                
              
            
            ]
          
        
        ≡
        
          
            [
            
              
                
                  3
                
                
                  4
                
              
              
                
                  1
                
                
                  1
                
              
            
            ]
          
        
      
    
    {\displaystyle {\begin{bmatrix}0&1\\2&3\end{bmatrix}}{\begin{bmatrix}1&2\\3&4\end{bmatrix}}={\begin{bmatrix}3&4\\11&16\end{bmatrix}}\equiv {\begin{bmatrix}3&4\\1&1\end{bmatrix}}}

This group is chosen because it has large order (for large semiprime n), equal to (p2−1)(p2−p)(q2−1)(q2−q).
Let 
 
 
 
 χ
 
 
 {\displaystyle \chi }
 
 and 
 
 
 
 α
 
 
 {\displaystyle \alpha }
 
 be two such matrices from GL(2,n) chosen such that 
 
 
 
 χ
 α
 ≠
 α
 χ
 
 
 {\displaystyle \chi \alpha \not =\alpha \chi }
 
. Choose some natural number r and compute:

β
        =
        
          χ
          
            −
            1
          
        
        
          α
          
            −
            1
          
        
        χ
        ,
      
    
    {\displaystyle \beta =\chi ^{-1}\alpha ^{-1}\chi ,}

γ
        =
        
          χ
          
            r
          
        
        .
      
    
    {\displaystyle \gamma =\chi ^{r}.}

The public key is 
 
 
 
 n
 
 
 {\displaystyle n}
 
, 
 
 
 
 α
 
 
 {\displaystyle \alpha }
 
, 
 
 
 
 β
 
 
 {\displaystyle \beta }
 
, and 
 
 
 
 γ
 
 
 {\displaystyle \gamma }
 
. The private key is 
 
 
 
 χ
 
 
 {\displaystyle \chi }
 
.

<h3>Encryption</h3>
The sender begins by generating a random natural number s and computing:

δ
        =
        
          γ
          
            s
          
        
      
    
    {\displaystyle \delta =\gamma ^{s}}

ϵ
        =
        
          δ
          
            −
            1
          
        
        α
        δ
      
    
    {\displaystyle \epsilon =\delta ^{-1}\alpha \delta }

κ
        =
        
          δ
          
            −
            1
          
        
        β
        δ
      
    
    {\displaystyle \kappa =\delta ^{-1}\beta \delta }

Then, to encrypt a message, each message block is encoded as a number (as in RSA) and they are placed four at a time as elements of a plaintext matrix 
 
 
 
 μ
 
 
 {\displaystyle \mu }
 
. Each 
 
 
 
 μ
 
 
 {\displaystyle \mu }
 
 is encrypted using:

μ
          ′
        
        =
        κ
        μ
        κ
        .
      
    
    {\displaystyle \mu '=\kappa \mu \kappa .}

Then 
 
 
 
 
 μ
 ′
 
 
 
 {\displaystyle \mu '}
 
 and 
 
 
 
 ϵ
 
 
 {\displaystyle \epsilon }
 
 are sent to the receiver.

<h3>Decryption</h3>
The receiver recovers the original plaintext matrix 
 
 
 
 μ
 
 
 {\displaystyle \mu }
 
 via:

λ
        =
        
          χ
          
            −
            1
          
        
        ϵ
        χ
        ,
      
    
    {\displaystyle \lambda =\chi ^{-1}\epsilon \chi ,}

μ
        =
        λ
        
          μ
          ′
        
        λ
        .
      
    
    {\displaystyle \mu =\lambda \mu '\lambda .}

<h2 id="security">Security</h2>
Recovering the private key 
 
 
 
 χ
 
 
 {\displaystyle \chi }
 
 from 
 
 
 
 γ
 
 
 {\displaystyle \gamma }
 
 is computationally infeasible, at least as hard as finding square roots mod n (see <a href="/facts/Quadratic_residue/rHD2uQdQ">quadratic residue</a>). It could be recovered from 
 
 
 
 α
 
 
 {\displaystyle \alpha }
 
 and 
 
 
 
 β
 
 
 {\displaystyle \beta }
 
 if the system 
 
 
 
 χ
 β
 =
 
 α
 
 −
 1
 
 
 χ
 
 
 {\displaystyle \chi \beta =\alpha ^{-1}\chi }
 
 could be solved, but the number of solutions to this system is large as long as elements in the group have a large order, which can be guaranteed for almost every element.
However, the system can be broken by finding a multiple 
 
 
 
 
 χ
 ′
 
 
 
 {\displaystyle \chi '}
 
 of 
 
 
 
 χ
 
 
 {\displaystyle \chi }
 
 by solving for 
 
 
 
 d
 
 
 {\displaystyle d}
 
 in the following congruence:

d
        
          (
          
            β
            −
            
              α
              
                −
                1
              
            
          
          )
        
        ≡
        
          (
          
            
              α
              
                −
                1
              
            
            γ
            −
            γ
            β
          
          )
        
        
          
          (
          mod
          
          n
          )
        
      
    
    {\displaystyle d\left(\beta -\alpha ^{-1}\right)\equiv \left(\alpha ^{-1}\gamma -\gamma \beta \right){\pmod {n}}}

Observe that a solution exists if for some 
 
 
 
 i
 ,
 j
 ∈
 
 |
 γ
 |
 
 
 
 {\displaystyle i,j\in \left|\gamma \right|}
 
 and 
 
 
 
 x
 ,
 y
 ∈
 
 
 Z
 
 
 n
 
 
 
 
 {\displaystyle x,y\in \mathbb {Z} _{n}}

x
        
          (
          
            
              β
              
                i
                j
              
              
                −
                1
              
            
            −
            
              α
              
                i
                j
              
            
          
          )
        
        ≡
        y
        
          
          (
          mod
          
          n
          )
        
        .
      
    
    {\displaystyle x\left(\beta _{ij}^{-1}-\alpha _{ij}\right)\equiv y{\pmod {n}}.}

If 
 
 
 
 d
 
 
 {\displaystyle d}
 
 is known, 
 
 
 
 d
 
 I
 
 +
 γ
 =
 
 χ
 ′
 
 
 
 {\displaystyle d\mathrm {I} +\gamma =\chi '}
 
 — a multiple of 
 
 
 
 χ
 
 
 {\displaystyle \chi }
 
. Any multiple of 
 
 
 
 χ
 
 
 {\displaystyle \chi }
 
 yields 
 
 
 
 λ
 =
 
 κ
 
 −
 1
 
 
 =
 
 v
 
 −
 1
 
 
 
 χ
 
 −
 1
 
 
 ϵ
 v
 χ
 
 
 {\displaystyle \lambda =\kappa ^{-1}=v^{-1}\chi ^{-1}\epsilon v\chi }
 
. This presents a fatal weakness for the system, which has not yet been reconciled.
This flaw does not preclude the algorithm's use as a mixed private-key/public-key algorithm, if the sender transmits 
 
 
 
 ϵ
 
 
 {\displaystyle \epsilon }
 
 secretly, but this approach presents no advantage over the common approach of transmitting a <a href="/facts/Symmetric_encryption/5zfe0b76">symmetric encryption</a> key using a public-key encryption scheme and then switching to symmetric encryption, which is faster than Cayley-Purser.

<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/Non-commutative_cryptography/T11zAMBm">Non-commutative cryptography</a></li></ul>

<ul><li>Sarah Flannery and David Flannery. In Code: A Mathematical Journey. <a href="/facts/ISBN_(identifier)/15AdSPa9">ISBN</a> 0-7611-2384-9</li></ul>

Cayley–Purser algorithm open-in-new

Cayley–Purser algorithm