Cryptanalysis of Anshel-Anshel-Goldfeld-Lemieux key agreement protocol

TL;DR

This paper critically analyzes the security of the AAGL key agreement protocol, revealing that its core algebraic primitive is vulnerable and that the protocol cannot be securely instantiated with proposed parameters.

Contribution

It provides a heuristic analysis demonstrating the insecurities of the AAGL protocol's algebraic primitive and exposes vulnerabilities in its parameter choices.

Findings

Heuristically shows the protocol's primitive is insecure for proposed parameters.

In 100% of tested instances, the secret conjugator could be recovered.

The protocol cannot be securely instantiated with current parameter settings.

Abstract

The Anshel-Anshel-Goldfeld-Lemieux (abbreviated AAGL) key agreement protocol is proposed to be used on low-cost platforms which constraint the use of computational resources. The core of the protocol is the concept of an Algebraic Eraser (abbreviated AE) which is claimed to be a suitable primitive for use within lightweight cryptography. The AE primitive is based on a new and ingenious idea of using an action of a semidirect product on a (semi)group to obscure involved algebraic structures. The underlying motivation for AAGL protocol is the need to secure networks which deploy Radio Frequency Identification (RFID) tags used for identification, authentication, tracing and point-of-sale applications. In this paper we revisit the computational problem on which AE relies and heuristically analyze its hardness. We show that for proposed parameter values it is impossible to instantiate the secure protocol. To be more precise, in 100% of randomly generated instances of the protocol we were able to find a secret conjugator z generated by TTP algorithm (part of AAGL protocol).