[Paper Review] The Diffie-Hellman Key Exchange Protocol and non-abelian nilpotent groups

Ayan Mahalanobis|ArXiv.org|Feb 13, 2006

DNA and Biological Computing23 references4 citations

TL;DR

This paper proposes a non-abelian generalization of the Diffie-Hellman key exchange using automorphisms of non-abelian $p$-groups of class 2, specifically constructing a family $G_n(m,p)$ that generalizes Hall-Senior group 92. The key contribution is proving that the central automorphism group of $G_n(m,p)$ is abelian, enabling a Diffie-Hellman-style protocol, though the scheme is shown to be insecure due to a reduction to solving linear equations modulo $p^{m-1}$, exposing a vulnerability when $\gcd(\beta_2, p) = 1$. The work highlights the challenge of achieving secure key exchange in non-abelian groups and raises open questions on group selection and security proofs.

ABSTRACT

In this paper we study a key exchange protocol similar to Diffie-Hellman key exchange protocol using abelian subgroups of the automorphism group of a non-abelian nilpotent group. We also generalize group no.92 of Hall-Senior table \cite{halltable}, for arbitrary prime $p$ and show that for those groups, the group of central automorphisms commute. We use these for the key exchange we are studying.

Motivation & Objective

• To generalize the Diffie-Hellman key exchange protocol from cyclic groups to non-abelian nilpotent $p$-groups of class 2.
• To investigate whether the discrete logarithm problem can be meaningfully extended to non-abelian groups via automorphisms, defining a 'general discrete logarithm problem' (GDLP).
• To construct a family of groups $G_n(m,p)$ that generalize Hall-Senior group 92 and have abelian central automorphism groups, enabling the proposed key exchange.
• To assess the security of the proposed protocol, particularly in relation to the generalized Diffie-Hellman problem (GDHP) and the underlying GDLP.
• To identify open problems in constructing secure non-abelian key exchange protocols based on group-theoretic properties.

Proposed method

• The protocol uses automorphisms from the abelian group of central automorphisms of a non-abelian $p$-group $G_n(m,p)$ of class 2 and exponent $p^m$.
• Alice and Bob each select a private automorphism from the abelian central automorphism group, apply it to a public generator $g$, and exchange the images.
• The shared secret is derived from composing the automorphisms on $g$, relying on the commutativity of the central automorphism group.
• The security relies on the difficulty of inverting the automorphism action, modeled as solving for the exponent in $\phi(g) = g^k$ for $k \in \mathbb{Z}_{p^m}$.
• The protocol is implemented using modular arithmetic over $\mathbb{Z}_{p^m}$, where elements are represented as products of generators with exponents mod $p^m$, avoiding explicit group representation.
• An attack is mounted by reducing the problem to solving linear congruences modulo $p^{m-1}$, exploiting the structure of the automorphism images.

Experimental results

Research questions

• RQ1 Can the Diffie-Hellman key exchange be securely generalized to non-abelian groups using automorphisms of $p$-groups of class 2?
• RQ2 Does the existence of an abelian central automorphism group in a non-abelian $p$-group enable a secure key exchange protocol?
• RQ3 Is the generalized discrete logarithm problem (GDLP) harder than the generalized Diffie-Hellman problem (GDHP) in such groups?
• RQ4 Can the proposed protocol be made secure by selecting different groups with abelian central automorphism groups?
• RQ5 What are the necessary and sufficient group-theoretic conditions for a $p$-group to support a secure non-abelian key exchange based on GDLP?

Key findings

• The group $G_n(m,p)$, a generalization of Hall-Senior group 92, has an abelian group of central automorphisms, enabling the construction of a Diffie-Hellman-like key exchange.
• The key exchange protocol is insecure when $\gcd(\beta_2, p) = 1$, as the attacker can solve for the secret exponent $l$ using linear congruences modulo $p^{m-1}$.
• An analogous attack breaks the system when $\beta_2 = kp^i$ for $1 \leq i < m$, showing the vulnerability is not limited to coprime cases.
• The generalized Diffie-Hellman problem (GDHP) is strictly easier than the generalized discrete logarithm problem (GDLP) in $G_n(m,p)$, as GDHP reduces to solving linear equations.
• The protocol can be efficiently implemented using only modular arithmetic over $\mathbb{Z}_{p^m}$, with operations limited to addition and multiplication modulo $p^m$, enabling fast computation.
• The paper conjectures that every Miller $p$-group for odd $p$ is special, suggesting a deeper structural link between automorphism group properties and group type.