Cryptanalysis of Cryptosystems Based on Non-commutative Skew Polynomials

  • Vivien Dubois
  • Jean-Gabriel Kammerer
Part of the Lecture Notes in Computer Science book series (LNCS, volume 6571)


Ten years ago, Ko et al. described a Diffie-Hellman like protocol based on decomposition with respect to a non-commutative semigroup law. Instantiation with braid groups had first been considered, however intense research on braid groups revealed vulnerabilities of the group structure and of the braid based DH problem itself.

Recently, Boucher et al. proposed a similar scheme based on a particular non-commutative multiplication of polynomials over a finite field. These so called skew polynomials have a well-studied theory and have many applications in mathematics and coding theory, however they are quite unknown in a cryptographic application.

In this paper, we show that the Diffie-Hellman problem based on skew polynomials is susceptible to a very efficient attack. This attack is in fact general in nature, it uses the availability of a one-sided notion of gcd and exact division. Given such tools, one can shift the Diffie-Hellman problem to a linear algebra type problem.


Diffie-Hellman key exchange skew polynomials 


  1. 1.
    Boucher, D., Gaborit, P., Geiselmann, W., Ruatta, O., Ulmer, F.: Key exchange and encryption schemes based on non-commutative skew polynomials. In: Sendrier, N. (ed.) PQCrypto 2010. LNCS, vol. 6061, pp. 126–141. Springer, Heidelberg (2010)CrossRefGoogle Scholar
  2. 2.
    Bouillaguet, C., Faugère, J.-C., Fouque, P.-A., Perret, L.: Differential-algebraic algorithms for the isomorphism of polynomials problem. Cryptology ePrint Archive, Report 2009/583 (2009),
  3. 3.
    Cheon, J.H., Jun, B.: A polynomial time algorithm for the braid Diffie-Hellman conjugacy problem. In: Boneh, D. (ed.) CRYPTO 2003. LNCS, vol. 2729, pp. 212–225. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  4. 4.
    Coulter, R.S., Havas, G., Henderson, M.: Giesbrecht’s algorithm, the HFE cryptosystem, and Ore’s ps-polynomials. In: Shirayanagi, K., Yokoyama, K. (eds.) Computer Mathematics: Proceedings of the Fifth Asian Symposium (ASCM 2001). Lecture Notes Series on Computing, vol. 9, pp. 36–45. World Scientific, Singapore (2001)CrossRefGoogle Scholar
  5. 5.
    Diffie, W., Hellman, M.E.: New Directions in Cryptography. IEEE Transactions on Information Theory IT–22(6), 644–654 (1976)MathSciNetCrossRefGoogle Scholar
  6. 6.
    Ko, K.H., Lee, S.-J., Cheon, J.H., Han, J.W., Kang, J.-s., Park, C.-s.: New public-key cryptosystem using braid groups. In: Bellare, M. (ed.) CRYPTO 2000. LNCS, vol. 1880, pp. 166–183. Springer, Heidelberg (2000)CrossRefGoogle Scholar
  7. 7.
    Mahlburg, K.: An overview of braid group cryptography (2004)Google Scholar
  8. 8.
    Ore, O.: Theory of non-commutative polynomials. Annals of Mathematics 34, 480–508 (1933)MathSciNetCrossRefGoogle Scholar
  9. 9.
    Patarin, J.: Hidden fields equations (HFE) and isomorphisms of polynomials (IP): Two new families of asymmetric algorithms. In: Maurer, U.M. (ed.) EUROCRYPT 1996. LNCS, vol. 1070, pp. 33–48. Springer, Heidelberg (1996)Google Scholar
  10. 10.
    Perret, L.: A fast cryptanalysis of the isomorphism of polynomials with one secret problem. In: Cramer, R. (ed.) EUROCRYPT 2005. LNCS, vol. 3494, pp. 354–370. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  11. 11.
    Shoup, V.: NTL: A library for doing number theory,
  12. 12.
    Shpilrain, V., Ushakov, A.: The conjugacy search problem in public key cryptography: unnecessary and insufficient. Cryptology ePrint Archive, Report 2004/321 (2004),

Copyright information

© International Association for Cryptologic Research 2011

Authors and Affiliations

  • Vivien Dubois
    • 1
  • Jean-Gabriel Kammerer
    • 1
    • 2
  1. 1.DGA/MIRennesFrance
  2. 2.IRMAR, Université de Rennes 1France

Personalised recommendations