On the AAGL Protocol

TL;DR

This paper analyzes the security of the AAGL protocol for RFID tags by presenting algorithms and attacks that challenge its presumed security, showing it may not be more secure than similar protocols based on the conjugacy problem.

Contribution

The paper provides the first algorithms and attacks targeting the MSCSPv problem underlying the AAGL protocol, revealing potential vulnerabilities.

Findings

Deterministic attack has exponential worst-case complexity.

Probabilistic attack reduces complexity to polynomial in some parameters.

AAGL protocol's security is comparable to other conjugacy-based protocols.

Abstract

Recently the AAGL (Anshel-Anshel-Goldfeld-Lemieux) has been proposed which can be used for RFID tags. We give algorithms for the problem (we call the MSCSPv) on which the security of the AAGL protocol is based upon. Hence we give various attacks for general parameters on the recent AAGL protocol proposed. One of our attacks is a deterministic algorithm which has space complexity and time complexity both atleast exponentialin the worst case. In a better case using a probabilistic algorithm the time complexity canbe O(|XSS(ui')^L5*(n^(1+e)) and the space complexity can be O(|XSS(ui')|^L6), where the element ui' is part of a public key, n is the index of braid group, XSS is a summit type set and e is a constant in a limit. The above shows the AAGL protocol is potentially not significantly more secure as using key agreement protocols based on the conjugacy problem such as the AAG (Anshel-Anshel-Goldfeld) protocol because both protocols can be broken with complexity which do not significantly differ. We think our attacks can be improved.