[Paper Review] Defeating the Kalka--Teicher--Tsaban linear algebra attack on the Algebraic Eraser

Dorian Goldfeld, Paul E. Gunnells|arXiv (Cornell University)|Feb 3, 2012

Cryptography and Data Security2 references3 citations

TL;DR

This paper proposes a countermeasure to the Kalka–Teicher–Tsaban linear algebra attack on the Algebraic Eraser key exchange protocol by carefully selecting the matrix used to generate the private keys in the Colored Burau Key Agreement Protocol (CBKAP). By constructing the private keys as polynomials in a specific matrix derived from the public data, the method ensures that the attack equations yield a vast solution space, rendering the recovery of the private key computationally infeasible. The key contribution is a practical, efficient defense that preserves the protocol's suitability for low-resource environments like RFID systems.

ABSTRACT

The Algebraic Eraser (AE) is a public key protocol for sharing information over an insecure channel using commutative and noncommutative groups; a concrete realization is given by Colored Burau Key Agreement Protocol (CBKAP). In this paper, we describe how to choose data in CBKAP to thwart an attack by Kalka--Teicher--Tsaban.

Motivation & Objective

• To address the vulnerability of the Algebraic Eraser protocol to the Kalka–Teicher–Tsaban (KTT) linear algebra attack, which exploits structured relations in the private key matrices.
• To preserve the efficiency and low-resource suitability of the Colored Burau Key Agreement Protocol (CBKAP) while eliminating the attack surface introduced by the KTT method.
• To provide a practical, deterministic method for key generation that thwarts the attack without altering the core protocol structure or increasing computational overhead.

Proposed method

• The trusted third party (TTP) selects a spurious element (β,1) from the generators of Bob’s monoid B and computes a matrix m = ∑cℓ·Π(β)ℓ using coefficients cℓ ∈ 𝔽.
• The TTP makes the matrix m public and defines the private key submonoids as NA = NB = 𝔽[m], the set of all polynomials in m with coefficients in the finite field 𝔽.
• Alice and Bob generate their first private keys na and nb as arbitrary polynomials in m, ensuring they commute with all elements in the attack's solution space.
• The construction ensures that any matrix of the form nb·∑wℓ·mℓ with wℓ ∈ 𝔽 satisfies the attack equations, creating a solution space too large for feasible recovery.
• The method relies on the fact that the attack equations (3) and (4) are satisfied by a family of matrices, not just the true private key, thus preventing unique identification.
• The defense is compatible with RFID applications, as it maintains low computational cost and does not require changes to the protocol’s public key exchange mechanism.

Experimental results

Research questions

• RQ1 Can the Kalka–Teicher–Tsaban linear algebra attack on the Algebraic Eraser be defeated without increasing computational cost or compromising efficiency?
• RQ2 What matrix construction in the private key space can render the attack’s system of equations unsolvable due to excessive solution space?
• RQ3 How can the trusted third party generate public data that enables secure key generation while preserving the protocol’s suitability for low-resource devices?
• RQ4 Is it possible to maintain E-commuting properties between submonoids while introducing a structure that breaks the linear algebra attack?

Key findings

• The proposed method defeats the Kalka–Teicher–Tsaban attack by ensuring that the system of equations derived from the attack has a solution space of exponential size relative to the field size, making unique recovery of the private key infeasible.
• Private keys generated as polynomials in a public matrix m constructed from the group action on the braid group generators are sufficient to satisfy all attack equations, but do not uniquely identify the true key.
• The defense is effective even when Eve can generate many spurious elements (α,e) ∈ A, as all such elements lead to equations with the same large solution set, providing no useful information about the true private key.
• The method preserves the protocol’s efficiency and is compatible with real-world applications such as RFID systems, where low computational overhead is essential.
• The attack equations (3) and (4) are satisfied by any matrix of the form nb·∑wℓ·mℓ with wℓ ∈ 𝔽, which forms a vector space of dimension equal to the degree of the minimal polynomial of m, thus overwhelming any attempt at key recovery.