The existing exponentiation-based three-pass cryptographic protocols are not secure against attacks using hypothetic quantum computers. This paper will review the research conducted on the cryptographic security of the three-pass protocol on permutations. An informational message is a permutation of a given length . The operations of cryptographic transformation for the proposed protocol are the operations of multiplying permutations, exponentiation of their disjoint cycles, and the operation of finding a conjugate permutation. The steps for implementing the protocol are described in detail. The protocol uses a permutation , Alice's secret key , and Bob's secret keys and . All disjoint cycles in the permutation decomposition have different lengths. The length of all disjoint cycles is pairwise coprime with the length of disjoint cycles. The protocol correctness and single solution are proved. An example of the protocol implementation for = 7 is presented. The Alice's key space size equals the product of disjoint cycles length. Bob's key space size equals the product of disjoint cycle length and the number of possible permutations with a suitable structure. The protocol resistance to some statistical ciphertext-only attacks has been investigated. It is shown that even if the cryptanalyst is informed about the structure of and cycles, he will not be able to determine permutation , neither does this knowledge disclose the keys , , values; the cryptanalyst cannot reduce the size of the potential permutation set to a value less than the size of Alice's key space; even knowing the key structure and having checked all possible vector values, the cryptanalyst will not be able to determine the key ; cryptanalyst will not be able to determine the structure of cycles by going through all possible values. The transformation security is based on the complexity of permutation factorization, as well as on the complexity of implementing transformations that are inverse to nonlinear operations based on the identical cycle structure of conjugate permutations. The protocol keys must be changed after being used. Channel error protection must be provided when implementing the protocol.
transmitted securely between two parties without transferring or disclosing either public or private encryption keys [1–5].
that each party has a private encryption key and a private decryption key. Both parties use their keys independently, to encrypt the message first, and decrypt the message afterward.
The protocol uses the encryption function and the decryption function . The encryption function and the decryption function may or may not coincide. The encryption function uses an encryption key to change a plaintext message into a ciphertext ( , ). Each encryption key has a corresponding decryption key , which allows to recovery of the original text using the decryption function ( , ( , )).
decryption function to be suitable for the three-pass protocol, the condition
key and receives the original message ( , ( , )) = .
It should be noted that all the operations involving Alice’s private keys and are performed by Alice, and all of the operations involving Bob’s private keys and are performed by Bob. Thus, neither party needs to know the other party’s keys.
Shamir No-Key Protocol [7], which was developed in the 1980s, uses exponentiation modulo a large prime number as both encryption and decryption functions, that is, ( , ) = and ( , ) = , where is ( , ( , ( , ))) = ( , ) should be a large prime [8]. For any encryption, the fulfilled for any message , any encryption key exponent is found within the range [1, … , − with corresponding decryption key , and 1] with ( , − 1) = 1. The corresponding any independent encryption key . In other decryption exponent is selected such that words, the first encryption must be decrypted ( − 1) = 1. It follows from Fermat’s with the key , even if the message is encrypted Little Theorem that ( , ( , )) = with the second key . This property is = . The Shamir protocol has the characteristic of the commutative encryption commutativity property because where ( , ( , )) = ( , ( , ))for any of ( , ( , )) = = = the keys and , and for every message . ( , ( , )).
Commutative encryptions satisfy the equation There are many implementations of the ( , ( , ( , ))) = ( , ( , ( , ))) = Shamir protocol with various encryption ( , ). methods.
Suppose Alice wants to send a message to In particular, this protocol can be used for Bob. In this case, the three-pass protocol works exchanging images securely. Surveys such as as follows [6]. that conducted in [9] offer a secure no-key1. Alice selects a private encryption key exchange image-sharing scheme. This scheme and a corresponding decryption key . uses a Multiple-Parameter Fractional Fourier Alice encrypts the original message Transform as a cryptographic algorithm for the with the key and sends the ciphertext three-pass protocol.
( , )to Bob. Another implementation of the Shamir 2. Bob selects a private encryption key and protocol in quantum cryptography is the a corresponding decryption key , quantum three-stage protocol [10], which uses encrypts the first message ( , ) with the property of quantum superposition. An the key , and sends the doubly encrypted improvement to this protocol has been message ( , ( , ))back to Alice. proposed in [11]. 3. Alice decrypts the second message with The Massey-Omura Cryptosystem [8, 12] the key . Due to the commutativity was originally proposed by James Massey and property described here Jim K. Omura in 1982 as a possible upgrade over the Shamir protocol. There are two ( , ( , ( , ))) = ( , ), which options for implementing the Massey-Omura means that the message is encrypted only protocol: the classical one and the elliptical one. with Bob’s private key. Alice sends this The first option is built on the complexity of the ciphertext to Bob. discrete logarithm problem, the second option is based on the properties of an elliptic curve.
exponentiation in the Galois field uses (2 ) as
, where = 2 . Similar to the Shamir protocol, the exponent is found within the range [1, … , − 1] with corresponding
decryption calculated to ensure ( , − 1) = 1. The exponent
is ( − 1) = 1. Since the multiplicative group of the Galois field (2 ) has order 2 − 1, the
Lagrange’s theorem = implies
that = for all in ( , ( , )) = (2 ).
cryptosystem provides for the representation of the message to be transmitted by the point of the elliptic curve above the finite field.
order of the elliptic curve) is calculated and unclassified. Each user of the system chooses a random integer : 1 < < , ( , ) = 1.
Using the Euclid’s algorithm, the inverse value : any point = 1 is found. By using and , and
on the elliptic curve, it is now possible to calculate ( , ) = whereas ( , ( , )) = Calculating point
by solving the discrete logarithm problem for an is equivalent to = . elliptic curve.
Recently, new studies have emerged that are aimed at developing the three-pass protocol modified with the ElGamal algorithm for AES key exchange in an ad hoc 802.11 network.
effectiveness of the Pohlig-Hellman algorithm [24] for implementing a three-pass protocol.
The authors in [25] prove, that the RSA algorithm can be used as an encryption algorithm in the Shamir three-pass protocol since it has the commutative property required by the three-pass protocol.
propose a new method for deniable encryption based on commutative transformations. This method includes the following cryptographic primitives as its three basic components: the
the Pohlig-Hellman commutative encryption algorithm, and Shamir’s no-key encryption protocol. To perform commutative encryption,
Nonetheless, it has been proved in [27] that the used exponentiation cipher is as secure as the discrete logarithm problem is hard.
the exponentiation-based cryptographic protocols are not secure against attacks using hypothetic quantum computers.
The authors in [27] propose post-quantum implementation of the three-pass no-key encryption protocol. The proposed protocol is based
on exponentiation and factorization operations. It involves a larger volume of data transmitted by a communication channel as compared with the Shamir algorithm (10 messages versus 3), as well as a larger number of operations performed by each of the parties.
Further, in the study [28], the authors have developed a post-quantum no-key protocol based on the commutative cipher introduced earlier that ‘seems more attractive for practical applications’ [29, 30]. This cipher performs transformations of such algebraic structures as vectors and their global right-sided and twosided units. At the same time, exponentiation remains the encryption operation.
This paper will give an account of a fundamentally new approach to building a three-pass cryptographic protocol. It is based on presenting an informational message as a permutation of numbers of a given length . , the method uses an exponentiation cipher. A permutation on a set of elements is a nonlinear operations on permutations, bijective function of a finite set of size to itself. The elements of the finite set will be denoted by non-negative integers from 0 to − 1. permutation will be denoted as a sequence of elements of the set , wherein each of the numbers {0,1, … ,
− 1} is only used once (without gaps or repetitions). The set of all permutations on the set will be denoted by . A similar representation of the information message as a permutation of numbers is used in factorial data coding [31–39], as well as in the cryptographic key exchange method [40].
Section 2 details an outline of the basic concepts for the three-pass protocol on permutations, proves the protocol's correctness and presents a case study for its implementation. Section 3 studies the threepass
protocol cryptographic
An approach to constructing a three-pass protocol based on permutations was first presented in [41]. An essential feature of the proposed approach is the use of linear and including those on the conjugate permutations.
The three-pass protocol includes the following procedures: • Permutation ∈ and its decomposition into a product of disjoint cycles = Alice generates a key permutation = vector and permutations and −1 and its −1 inverse: −1 = • Bob randomly generates his private key as a ( )-dimensional vector = = ( 1, 2, … , ( )), ( )− 1. permutation = ∏ inverse: −1 = ∏ vector and permutations , −1 and Remark 1. All disjoint cycles in the permutation decomposition = ∏ have different length: ( ) ≠ ( )for ∀ ≠ .
Remark 2. The length of all disjoint cycles in the permutation decomposition = ∏ is pairwise coprime with the length of disjoint • To securely transmit permutation ∈ , Alice generates a ciphertext 1 = ⋅ Alice. • Bob encrypts the received message 1: 2 = ⋅ 1 ⋅ . He then sends 2 to • Alice forms a permutation −1 inverse to 2 × −1. She transmits 3 to Bob.
and “removes” her key : 3 = −1 ⋅ • Bob “removes” his key : 4 = −1 ⋅ 3.
Next, Bob represents 4 as a product of disjoint cycles: 4 = permutations from the expression 4 = ( ) =1 =1 = ∏ ( ( 1 ), ( 2 ), … , ( ( ) )) based on the known 4 and . By going 1 ⋅ −1 = ( )possible permutations . pairwise three-pass protocol.
Alice calculates 1 = ⋅ . Bob calculates 2 = ⋅ 1 ⋅ calculates 3 = −1 ⋅ = ⋅ ⋅ ⋅ .
⋅ ⋅ ⋅ ⋅ −1.
Here, we demonstrate that permutations and commute with each other. The product
of and is ⋅ = ∏ Since the cycles { }, where 1 ≤ ≤ ( ), are
perform the above steps, they will implement a = ∏ =1 3 = −1 ⋅ ⋅ ⋅ ⋅ ⋅ −1
= −1 ⋅ ⋅ × × ⋅ ⋅ −1 = ⋅ ⋅ ⋅ −1.
Bob calculates 4 = −1 ⋅ ⋅ ⋅ ⋅ −1 = × ⋅ −1.
It follows from the and expression that the permutations 4, are conjugate. Therefore, the permutations 4
are of the same cycle structure: their decompositions into a product of disjoint cycles for any containing the same number of cycles of length . Since ( ) ≠ ( )for ∀ ≠ , the number of cycles of length for any equals to unity. Additionally, 4 = ⋅ ⋅ −1 = ⋅ ∏ =1 ⋅ −1. If the cycles are latter ∈
Therefore, the number of possible solutions for the equation 4 = ⋅ ⋅ −1 with known 4 and is determined by element positions 1 , 2 , … , ( ) in cycles
values satisfies the condition 1 ⋅ −1 = , = ( 1, … , ( )). In this = −1 ⋅ = Here, we assume that = ∏ =1
= −1 ⋅ = ⋅ ⋅ −1, permutations ̄ and are conjugate and are of identical cycle structure. The conditions of Remark 2 are sufficient for the equation = −1 ⋅ = ⋅ ⋅ −1 to be possible only in the case when = = −1 ⋅ , where is the identical permutation, that is, −1 = . and the Theorem 2. Only one of ∏ ( ) ( ) =1 values satisfies the condition 1 ⋅ possible −1 = ∏
We keep in mind that 4 = ( ). With 4 and known, any permutation value that satisfies the equality 4 = ⋅ − will become a solution to the
equation 4 = ( ). The number of such permutations is equal to the size of the set of possible vectors = ( 1, … , ( )), which is ∏
Let ∃ 0: 4 = ⋅ − 0.
Here, we consider all possible permutations 0− = 4 ⋅ = ⋅ − 0 and 0− = 1 ⋅ −01− = ⋅ ⋅ 0− ⋅ −1 for all possible vectors .
Due to Theorem 1, there can only be one
implementing the
three-pass protocol on
permutations for length
= (
Alice forms the ciphertext 1 = ⋅ and −1 and sends 3 to Bob: 1 = {2,5,3,0,4,6,1}{3,2,1,6,0,4,5} = {0,3,5,1,2,4,6} Bob encrypts the received message 1: 2 = × 1 ⋅ and sends it to Alice: 2 = {2,6,3,0,4,1,5}{0,3,5,1,2,4,6}{6,5,4,2,1,3,0} = = {2,6,3,0,4,1,5}{6,4,2,5,3,1,0} = {5,4,3,1,0,6,2}. Alice “removes” her encryption key −1 using reverse permutation −1: 3 = −1 ⋅ 2 ⋅ 3 = {3,6,0,2,4,1,5}{5,4,3,1,0,6,2}{4,2,1,0,5,6,3} = = {3,6,0,2,4,1,5}{0,3,4,5,6,2,1} = {3,2,4,1,5,0,6}. Bob “removes” his key −1: 4 = −1 ⋅ 3: 4 = {3,5,0,2,4,6,1}{3,2,4,1,5,0,6} = {2,0,4,5,6,3,1} Next, Bob represents 4 as a product of disjoint cycles:
4 = {2,0,4,5,6,3,1} = (
Bob
has
to
form
∏
( ) ( ) = 2 ⋅ 5 = 10 of possible values
=1
and perform a check for each of them. Some of
the possible values are given below.
(
Therefore, ( ) = 3, while permutation
can be presented as
= (
) = 1. following form:
= (
Let Bob generate his secret key as follows:
1.
(0) = 3;
(
(
cycle for only one value of = {3,2,1,6,0,4,5}. This is how Bob determines that the
message having been delivered is = {3,2,1,6,0,4,5}.
Here, we consider an example where the lengths of permutation cycles are not coprime with the lengths of permutation cycles. Let
= {3,6,5,2,4,0,1} = (
= {5,2,4,0,1,6,3} = (
following form: = (
Let Alice transmit the permutation = = {2,6,4,3,1,5,0}. Its reverse permutation is −1 = {6,4,0,3,2,5,1}. Then the messages 1 − 4 are as follows: 1 = {3,1,4,0,6,2,5}; 2 = {0,4,1,5,6,3,2}; 3 = {5,1,3,0,6,2,4}; = = = of cycle.
4 = {3,6,5,2,1,0,4} = (
(0) = 0; ⇔= {3,1,4,0,6,2,5}{0,4,6,5,2,3,1}
= (
Thus, the given example shows that if the
lengths of permutation
cycles
are
not
coprime with the lengths of permutation
cycles, a situation may arise when Bob will not
be able to determine the permutation value.
(
(
(
(
The analysis of the proposed three-pass protocol security embraced the following areas: 1. Keyspace size. 2. Distributions of 1, 2, 3, 4 values depending on values. 3. Distributions of 1, 2, 3 values depending on , , and values. 4. Number of possible permutations satisfying the equation 1 = ⋅ 1 value and cycle structure are known. when 5. Number of key pairs ,
equation 3 = ⋅ ⋅ ⋅ −1. 6. Distribution of 3 = ⋅ ⋅ ⋅ −1 satisfying cycle structures in case of checking all possible values.
∏ the number of possible keys = ( 1, 2, … , ( )) and and equals to ∏
=1 ( )⋅ ( ), where ( ) is the number of
possible = permutations, ( ) ≠ ( ) for
pass protocol is equal to ∏ =(1) 2( )⋅ ( ).
of , , ,
The current study experimentally
found
absolute frequencies of permutations 1, 2, 3,
4 values occurrence for
(
The statistical analysis has determined that 1 and 2 are distributed uniformly over the set of all possible values of permutation of length with an
absolute frequency of any of ! permutation occurrence equal to unity. numbers of possible permutations in the form of frequencies of 3 and 4 values occurrence. The
Lehmer code [42] are plotted along the x-axis. checking all : a) 3 for = 7; b) 4 for = 7; c) 3 for = 9; d) 4 for = 9
The diagrams above demonstrate that 3 and 4 values are distributed uniformly; however, they are distributed on the subsets of all possible permutation values with length , rather than on the set. The absolute frequencies of permutations occurrence from these subsets are equal to 10 for = 7 and to 20 for
= 9, and the sizes of the specified subsets are equal to 7!⁄10 and 9!/20.
Theorem 3. Non-zero absolute frequencies of permutations 3 and 4 occurrence are equal to Proof. = ∏
Here, we consider 4 = ⋅ ⋅ −1 = ( ). By decomposing into a product of disjoint cycles, we shall receive 4 = ( ) = (∏ =1
However, the circular shift of the elements in the cycle does not alter the permutation itself. This implies that the products of all circular shifts for cycles ( )produce the same permutation 4. The number of such cases is equal to the product of permutation cycle lengths:
Since 3 = ⋅ 4, such a transformation is a bijection of one set of permutations into another. The distribution of absolute permutation frequencies remains unaltered with precision to their frequencies for multiple of the permutation number for each structure with nonzero frequency.
Priorly, we have demonstrated that the 4 cycle structure corresponds to the structure. Now, we consider the cycle structure of permutation 3 subsets with non-zero absolute Let 1, 2, … ,
be all possible different lengths of cycles , where 1 ≤ ≤ ( ), and 1, 2, … , be the corresponding numbers of such cycles. Herewith, is the number of cycles of different lengths. To present cycles we use denotation = ( 1 , 2 , … , ( ) ). The cycle structure of permutation 3 subsets with non-zero absolute frequencies for Definition 1. Multiplicity of permutation is the number ( ) = 1! ⋅ 2! ⋅ … ⋅ ! ⋅ 11 ⋅ 22 ⋅ … ⋅ the value ( ).
Proof.
Theorem 4. Number ( 3) of permutations 3 with a defined cycle structure is a multiple of Let 3 be one permutation out of those being represented as 3 = ⋅ ( ) = ⋅ ⋅ ⋅ −1, where , are fixed permutations of the given structure. set { } of all possible forwarded messages. Then the permutation
Permutation specifies the forwarded message. Note that permutation ⋅ belongs to the 3′ = ⋅ ( ⋅ )⋅ ⋅ ( ⋅ )−1 = = ⋅ ⋅ ⋅ ⋅ 1 ⋅ −1 = ⋅ 3 ⋅ −1 is conjugate to 3 and has an identical to 3 cycle structure. which implies that this number is also a multiple of the product 11 ⋅ 22 ⋅ … ⋅ .
Therefore, the number ( 3)of all possible permutations of 3 is a multiple of the number , Here, we will demonstrate the divisibility ( 3)by the product of factorials 1! ⋅ 2! ⋅ … ⋅ !. We shall start with 1 = 2 = and determine the permutation = ( 1112 21 22 … … 2 1 12 11 22 21 … … 2 2)
With a given message , permutation ⋅ is among the set of { } possible messages. In this case the permutation 3′′ = ⋅ ( ⋅ )⋅ ⋅ ( ⋅ )−1 = = ⋅ ⋅ ⋅ ⋅ 1 ⋅ −1 = ⋅ 3 ⋅ −1 is conjugate to 3 and has an identical to 3 cycle structure. consider the permutation
Similarly, if the number of permutations of length among cycles is equal to , we shall = ( 1 1 … 1 1 2 … 2 … 1 11 … 1 12 … 2 … 1 … ) … where { 1, 2, … } is permutation of numbers of the selected cycles .
With a given message , permutation ⋅ is among the set of { } possible messages. In this case the permutation 3′′′ = ⋅ ( ⋅ )⋅ ⋅ ( ⋅ )−1 = is conjugate to 3, from whence ( 3) is a multiple of ! which is the number of possible index permutations { 1, 2, … }. Consequently, ( 3)is divided into ( ) = 1! × … ⋅ ! ⋅ 11 ⋅ … ⋅ . number of ( 3)permutations with a certain cycle structure is a multiple of ( ) = ! ⋅ .
Consequence. If the lengths of all cycles are equal to , and their number is equal to , then the Table 1, as well as the distribution of
transformation
The experimental studies have shown that 3 cycle structures given in absolute frequencies of
permutations according to these structures are invariant relative to , , , selection provided their cycle structure is preserved. The subsets of permutations 3 with non-zero
absolute frequencies do not coincide, although they do intersect.
Thus, even if the cryptanalyst is informed about the structure of the will cycle
structure not enable him of to determine permutation , neither does this knowledge disclose the keys , , values. 3.3. Distributions of , , Values
2, 3 values.
the vector value has on the distribution of 1, The vector only impacts the 1, 2 values.
Since 1 = ⋅ , for a constant value of , the
vector transformation value determines 1.
The ↔ 1 is bijective. The size of the 1 values set is determined by Alice’s key space size as distributed over the entire set of its values.
The transformation 1 ↔ 2 is bijective and depends on the and values. Therefore, with constant and , the size of the 2 values set is determined by
Alice’s key space size. 2 is uniformly distributed over the entire set of its values. values.
vector value has on the distribution of 1, 2, 3 The vector only impacts the 2, 3 values.
Since 2 = ⋅ 1 ⋅ , for constant , and the vector value determines 2. The ↔ 2 is bijective. The size of its values. the 2 values set is determined by the size of the vector values set as ∏ ( )
=1 ( ). 2 is uniformly distributed over the entire set of its values.
The transformation 2 ↔ 3 is bijective and depends on the and values. Therefore, with constant and , the size of the 3 values set is determined by the size of the vector values set. 3 is uniformly distributed over the entire set of values.
Next, we shall consider the effect that the value has on the distribution of 1, 2, 3 values.
The value only impacts the 2 and 3 Since 2 = ⋅ 1 ⋅ , for constant , , and , the vector transformation
value determines 2. The ↔ 2 is bijective. The size of the 2 values set is determined by the size of the permutation values set as ∏ ( ) =1 ( ). 2 is uniformly distributed over the entire set of its values. entire set of its values.
The transformation 2 ↔ 3 is bijective and depends on the and values. Therefore, with constant and , the size of the 3 values set is determined by the size of the permutation values set. 3 is uniformly distributed over the
Note that Bob’s key space is defined by a pair of values,
and . Its size is equal to the product of the sizes of the and values, ∏ =1 ( )⋅ ∏ =1
( ) ( ).
Satisfying the Equation = ⋅
when
known cycle structure.
cryptanalyst to increase his knowledge about the permutation based on the known 1 and Defining
= 1 ⋅ −1 by going through possible values of permutation followed by analyzing and selecting those values for which = ∏ corresponds to Alice’s key space size and equal to ∏
Thus, the cryptanalyst can shrink the size of the potential permutations set from ! to permutations, but he cannot reduce the size of the potential permutations set to a value less than the size of Alice’s key space. Nevertheless, the specified property should be taken into when choosing the
conversion and to determine these In for ∀ . Thus, to achieve the maximum size of Alice’s key space, the permutation must be formed as a product of disjoint cycles of length three. Under these conditions, the size of the possible permutation values equals ( ) = account parameters.
Satisfying Equation = ⋅ ⋅
cryptanalyst to find Bob’s key by the known value of and known value of 3 assuming that the cycle structure of the key is known to the Since
permutations ( ) = ⋅ ⋅ −1 and are conjugate, the cryptanalyst can perform a search for all permutations = and all permutations ( ) with the cycle structure,
and that satisfy identify equation pairs 3 = = ⋅ ( ). The latter is equivalent to the check structure.
for • Search for all values and calculate ( ) = ( )−1 ⋅ 3 with its subsequent compliance with the • Search for all ( ) values and calculate = 3 ⋅ ( ( )) check for compliance with the = −1 with its subsequent = {5,2,4,3,6,1,0}.
Experimental studies indicate that there may instance, be several pairs of { ; ( )}. For for
= 7, = {5,4,2,1,3,6,0} =
(
However, the equation 3 = ⋅ ( ) is satisfied by pairs { = {6,4,2,1,3,0,5}; and ( ) = {6,2,1,4,0,3,5} { = {0,4,2,1,3,5,6}; ( ) = {5,2,1,4,6,3,0}.
This indicates that even knowing the key structure and having checked all possible vector cryptanalyst will not be able to determine the key .
of = ⋅ ⋅ ⋅ −
cryptanalyst to determine the key structure.
Here, we shall consider the cycle structure of the product −1 ⋅ 3 result with non-zero absolute frequencies for = 7, = 9, and
= 12 with the fixed , , , values given
above, and all possible values. For
= 12, we
= {5,4,8,1,3,6,0,2,7,11,9,10} =
accept
(
source not found. summarizes the results.
Reference source not found. shows that after checking all possible values, there are several −1 ⋅ 3 structures that can be used as structure. According to the requirements specified in Remark 1 and Remark 2, for = 7 these structures contain cycles of length 2 and 5; 1 and 6; for
= 9 these structures will be 2 and 7; 4 and 5; 1 and 8; for = 12 the structures will be 1, 2, 4, and 5; 2 and 10; 4 and 8; 5 and 7; 1 and 11. 1, 1, 2, 3 2, 5 3, 4 1, 6 −1 with known and 3.
Thus, the cryptanalyst will not be able to determine the structure of cycles by going through all possible values and determining −1 ⋅ 3 from the equation 3 = ⋅ ⋅ ⋅
Y1,Y3
Y2
Block for cryptographic transformation Factorial codec
m 7 8 9 r,B Key generator
Bob P3ercmyculteastitorunc tu−r1e⋅ N u−m1 b⋅er3 ooff ptheer mspuetcaitfiioends P3ercmyculteastitorunc tu−r1e⋅ N u−m1 b⋅er3 ooff ptheer mspuetcaitfiioends cycle structure = Cycle structure of permutation −1 ⋅ 3 subsets with non-zero absolute frequencies for = 7, Data exchange between Alice and Bob is carried out by transceivers 4 and 6 through an open unprotected duplex (or
half-duplex) communication channel 5. Permutation
is known to Alice and Bob. Alice and Bob have and
7, cryptographic transformation blocks 2 and 8, and private key generators 3 and 9 at their disposal. Let Alice create an open message . Then codecs 1 and 7, respectively, transform message
to permutation and
inverse to it. These transformations depend on the shared key.
Factorial codec 1 forms a codeword that enters the block of
cryptographic transformation 2. On the receiving side, the cryptographic transformation block 8 issues a codeword to codec 7, which converts it into the message . them secret.
Private key
generators 3 and 9 are independent generators based on random or pseudorandom processes. Private key generator
structure of this vector are described above. In cryptographic transformation block
forms the permutations and −1 and keeps
Private key generator 9 generates signals them secret.
and sends them to cryptographic transformation block 8. Requirements for and structures are described above.
In cryptographic transformation block 8, Bob forms permutations and −1 and keeps To securely transmit permutation , cryptographic transformation block 2 forms a and transmits it to the signal 1 = ⋅ transceiver 4.
Bob’s cryptographic transformation block 8, having received a signal 1 from transceiver 6, forms signal 2 = ⋅ 1 ⋅ and sends it to to Bob via transceiver 4.
2, having received a signal 2 from transceiver 4, forms signal 3 = −1 ⋅ 2 ⋅ −1 and sends it Having received the signal 3, Bob’s value 4 permutation and calculates value.
the
transmitted that, the permutation is outputted to factorial codec 7 for decoding and issuing the message to Bob.
generated by Alice’s or Bob’s key generator.
This investigation was undertaken to evaluate the cryptographic strength of the three-pass protocol on permutations against various types of attacks. The results of this investigation show that the considered attacks do not allow a cryptanalyst to reduce the volume of the possible key search variants below Alice and Bob’s key spaces.
At the same time, it is worth considering the following limitations while implementing the three-pass protocol on permutations. cryptographic transformation block 8 forms message.
Remark 1 and Remark 2: • All disjoint cycles in the permutation
decomposition into a product of disjoint cycles has different lengths. • The lengths of all disjoint cycles in the decomposition. permutation decomposition are pairwise coprime with all lengths of disjoint cycles in the permutation
and
Bob perform different operations and use different numbers of cryptographic keys.
Accordingly, the time required to perform these operations by Alice and Bob may differ. 3. The keys must be changed after being used, at least the key . Hence, Bob, having decrypted permutation , can easily calculate Alice’s private encryption key . To achieve this, Bob has to calculate the permutation −1 and then perform the procedure = 1 ⋅ −1.
operate correctly, it is necessary to ensure that errors are absent in the permutation after receiving it from the communication channel.
received from the channel will be impossible or, if an error in the communication channel transforms the transmitted permutation into another permutation, such an error will not be detected, leading to distortions in the received
The developed protocol can be used both in information factorial transmission systems using coding with data recovery by permutation, and in traditional systems that do not use factorial codes. In the latter case, it is necessary to additionally include the bijection function of the information block and permutation in the data transfer protocol, as shown in the example of the implemented data transfer system.