2

I know that there is at least one operation on permutations that makes a non-abelian group: we can "multiply*" them, if we consider them as permutation matrices. And naturals are directly mapped to permutations. However, I need a non-abelian group which is not only finite, but also with a size which is a power of two due to the need of direct correspondence between them and hash digests (128bits).

Besides the non-abelian requirement, the results of the operation should be uniformly distributed along the $2^{128}$ numbers, just like the result of permutation matrix multiplication is.

P.S.: I suppose any power of two is welcome, since a pair of 64-bit numbers, e.g., can be used to represent a 128-bit number; with the disadvantage of two separate operations - probably not ideal due to the uniformity requirement cited above.

  • -> "compose"?
dawid
  • 347
  • 2
    You can identify it with the dihedral group of order $2^{127}$, which is a non-abelian group. More precisely, identify the elements of your set with the elements of $D_{2^{127}}$ by a bijection $n\mapsto f(n)$ and then define the group operation $\circ$ on your set by $a\circ b:=c$ where $c=f^{-1}(f(a)f(b))$ – Prasun Biswas Nov 07 '20 at 03:17
  • Thanks. It seems a little abstract to me. I don't how, or where, to ask it. I just need a function $f(a,b) = c$ in which $a,b,c \in S$. $S$ is finite and non-abelian over $f$. $f$ is uniformily distributed across $S$, i.e. adding up all combinations of $a$ and $b$ in a histogram, it would be uniform. I don't know what a dihedral group is neither how to convert an integer to that. The best I could do was to convert 128-bit integers to 35-tuples representing permutations and use the composition as operation. The problem is that $f$ in this case would exceed 128-bit sometimes. – dawid Nov 07 '20 at 21:48
  • Just pick a random group of size at most $2^{128}$. If you did the picking in a truly random fashion, the probability that you picked a non-abelian group of order precisely $2^{128}$ is well over 99 per cent! IIRC the same holds already with $10$ in place of $128$, and it only gets better. Of course, this piece of advice is largely useless for practical purposes :-) – Jyrki Lahtonen Nov 15 '20 at 14:30
  • 1
    Could you be more specific about the uniformity? You do know that every group table obeys the sudoku rules - no repetitions on any column/row. – Jyrki Lahtonen Nov 15 '20 at 15:53
  • Ok, I got it, all elements appear equally in a Cayley table. So the remaining problem is to minimize commutativity and seek a hash-like behavior. – dawid Nov 15 '20 at 16:33

2 Answers2

2

There are non-abelian groups with as few as 8 elements, namely the dihedral group D4 and the quaternion group H. So there are plenty of nonabelian groups with 2^128 elements!

Anonymous
  • 4,310
1

Here's one simple way with a few parameters to vary. Don't know how well they mesh with the hashes (you need to be more specific, if special constraints come from there).

Split that $128$-bit integer $x$ into six chunks. Five chunks of $24$ bits each and a single chunk with only $8$ bits. So write $$ x=x_6\cdot 2^{120}+x_5\cdot2^{96}+x_4\cdot2^{72}+x_3\cdot2^{48}+x_2\cdot 2^{24}+x_1, $$ where $x_1,x_2,x_3,x_4,x_5$ have $24$ bits each, treated as integers in the range $0\le x_i\le 2^{24}-1$, and $0\le x_6\le 255$ has $8$ bits.

Map $x$ into a $4\times 4$ matrix $M(x)$ like follows: $$ M(x)=\left(\begin{array}{cccc} 1&2^{16}x_6&x_5&x_3\\ 0&1&x_4&x_2\\ 0&0&1&x_1\\ 0&0&0&1\end{array}\right). $$ We view all the entries as integers modulo $2^{24}$. That explains the extra factor $2^{16}$ of $x_6$. Without it $x_6$ would be determined only modulo $2^8$, so we tag $16$ zeros to the LSB end.

The operation, call it $\star$, is then the usual product of $4\times4$ matrices. In other words, we define $x\star y$ to be the $128$-bit chunk determined by $$ M(x\star y)=M(x)M(y), $$ where on the right hand side we perform the usual matrix multiplication with all arithmetic on the entries done modulo $2^{24}$. It is easy to check that the product $M(x)M(y)$ is of the same form for all pairs $x,y\in[0,2^{128}-1]$.


You get "more non-commutativity" by using larger matrices. The method is to split those 128 bits into equal size chunks and fill the upper triangular part with them. One chunk will necessarily be smaller than the others, and you should put that into the $(1,2)$ position, padded with an appropriate number of zeros. Other variations with more complicated zero padding schemes are also possible.


The real question may be whether this is non-abelian enough? Using large chunks leaves a lot of linearity that an attacker may be able to exploit. For example, in the above example if $x$ and $y$ both have the highest $56$ bits all zeros, then $$ \left(\begin{array}{cccc} 1&0&0&x_3\\ 0&1&0&x_2\\ 0&0&1&x_1\\ 0&0&0&1\end{array}\right)\left(\begin{array}{cccc} 1&0&0&y_3\\ 0&1&0&y_2\\ 0&0&1&y_1\\ 0&0&0&1\end{array}\right) =\left(\begin{array}{cccc} 1&0&0&x_3+y_3\\ 0&1&0&x_2+y_2\\ 0&0&1&x_1+y_1\\ 0&0&0&1\end{array}\right). $$ In other words, we only have three additions modulo $2^{24}$. May be such problems, if at all relevant, should go into a follow up question?


I'm not sure, but the comments underneath leave nagging fears. Here's what the operation comes to $$ \left( \begin{array}{cccc} 1 & 2^{16} (x_6+y_6) & x_5+2^{16} x_6 y_4+y_5 & x_3+x_5 y_1+2^{16} x_6y_2+y_3 \\ 0 & 1 & x_4+y_4 & x_2+x_4 y_1+y_2 \\ 0 & 0 & 1 & x_1+y_1 \\ 0 & 0 & 0 & 1 \\ \end{array} \right). $$ So if $x\star y=z$, then $$ \begin{aligned} z_6&\equiv x_6+y_6\pmod{2^8},\\ z_5&\equiv x_5+y_5+2^{16}x_6y_4\pmod{2^{24}},\\ z_4&\equiv x_4+y_4\pmod{2^{24}},\\ z_3&\equiv x_3+y_3+x_5y_1+2^{16}x_6y_2\pmod{2^{24}},\\ z_2&\equiv x_2+y_2+x_4y_1\pmod{2^{24}},\\ z_1&\equiv x_1+y_1\pmod{2^{24}}. \end{aligned} $$ You see that the various parts $z_j$ are only affected by a limited number of parts of the factors $x$ and $y$.

Jyrki Lahtonen
  • 140,891
  • 1
    Do observe that under $\star$, only a modular addition is done to the parts $x_1,x_4,x_6$. These parts do provide shuffling to the other parts. Again, I don't know if this exposes your proposed system to some attack? Some linearity will always be present, if we use matrices in this way. – Jyrki Lahtonen Nov 15 '20 at 15:19
  • Thanks, this is really useful to my problem. After some study, I am wondering if there is a straight-forward way to do that. I've already filled this site with questions, so I am researching first, to be able to post a better one, and then I can link it here. – dawid Nov 15 '20 at 16:02
  • At this moment, I know a dihedral group could be used, but it has ~0.25 chance of commuting pairs. I saw a proof that I could reduce it arbitrarily by direct product of groups. So I am thinking about asking "Which commonly used groups are less commutative than dihedral groups (of the same order)?", because I don't want to stick with product of dihedral groups just because they are used in the classroom. Small commutativity and uniform distribution of the result of operations are the requirements. I suppose there is a standard group that I could use in a product until I reach the requirements – dawid Nov 15 '20 at 16:03
  • Ideally, the operation result would be as good as MD5 applied to a concatenation of the operands, in terms of collision and each bit shuffling/affecting every other in the result. I just don't use MD5 because I need the non-abelian properties. I don't use a cypher function either, because it is not associative. – dawid Nov 15 '20 at 16:15
  • 1
    @viyps I was worried about you actually wanting something like that. See the last part of my answer I just edited in. If I got it right, those are problems. You can alleviate it by using 1-bit chunks and 17x17 matrices. Those matrices have 136 upper triangular entries. You need to exercise a bit of case which 8 are set to zero (to get a group). That will increase the number of interdependencies at the cost of complexity. – Jyrki Lahtonen Nov 15 '20 at 16:45
  • Thanks, that seems easier regarding group "truncation" than my previous attempt where I tried permutations of 35 elements (133 bits). Interestingly, 34! requires exactly 128 bits, but reaches only $2^{127.7951206129691}$ elements. – dawid Nov 15 '20 at 22:38
  • Follow up: https://math.stackexchange.com/q/3945562/121164 – dawid Dec 12 '20 at 12:53