2.1. Related Work on Cayley Hash Functions
This section gives a background on hash functions, in particular, Cayley hash functions.
Hash functions are easy-to-compute compression functions, as described before. Such functions are used in several contexts. For instance, they are helpful in password management systems. Servers that authenticate user passwords save a one-way hash associated with a unique password so that if an attacker steals the database, it may be unfeasible for the attacker to recover the original password as plaintext [
1,
8].
A hash family is a four-tuple , where
is a set of possible messages, which could be finite or infinite.
is a finite set of possible message digests or authentication tags.
is the set of keys.
For each
, there is a hash function
. If
and
denote the cardinals of
and
, and
, then
is said to be a compression function. If
, and the hash function
h is the identity, then
h is said to be an unkeyed hash function [
1,
2].
A hash function is said to be secure if the following three problems are difficult to solve:
Preimage
Instance: A hash function and an element .
Find: such that .
Second Preimage
Instance: A hash function and an element .
Find: such that and .
Collision
Instance: A hash function and an element .
Find: such that and .
Hash functions are used to construct a short fingerprint or digest the message of some data. If an attacker alters the data, then the fingerprint will no longer be valid. One of the most used methods to construct iterated hash functions is the Merkle–Damgård scheme, which builds hash functions from a compression function. Rivest introduced, in 1990, the first scheme of this type named MD4. Soon afterwads, Rivest himself proposed an improved version of MD4 called MD5.
Collisions in the compression function of MD4 and MD5 were discovered in the 1990s.
The family of secured hash algorithms (SHAs) was proposed as a standard by NIST in 1993. SHA-0 was adopted as FIPS 180. Each of these hash algorithms was an improvement of the earlier versions to prevent previously found attacks.
It was shown in 1998 that SHA-0 allows collisions in approximately steps, whereas the first collision for SHA-1 was found in 2017. SHA-2 includes the four hash functions known as SHA-224, SHA-256, SHA-384, and SHA-512, according to the sizes of the corresponding fingerprints. It is worth pointing out that currently SHA-256, which outputs 256 bits fingerprints, is the most used hash function. It is the basis of many password authentication systems.
According to the National Academy of Sciences, Engineering, and Medicine [
8] (NAE), although, nowadays it is believed to be essentially impossible to break a hash function such as SHA-256, password hashing is at higher risk due to the size of all 10-character passwords being only about
passwords, and thus prone to an attack based on a quantum computer.
Possible attacks on the currently used hash functions have encouraged the use of provably secure hash functions, whose security is based on the difficulty of solving a known hard problem.
Cayley hash functions based on the Cayley graph of certain (semi)groups are examples of these types of schemes, whose security follows from the hardness of the expander graph problem associated with a (semi)group.
In 1991, Zémor [
9] introduced hash function schemes based on matrix products in the special linear group
, where
p is a fixed prime number. Zémor himself and Tillich [
10] broke such schemes. Furthermore, they introduced the group
to increase the security of the original hash functions [
11]. In this setting,
is a field.
Due to the popularity of the hash functions introduced by Zémor and Tillich, several proposals in the same line were proposed by Petit and Lubotzki et al., who introduced Cayley hash functions based on Ramanujan graphs, in particular LPS hash functions [
12,
13,
14,
15].
The Tillich–Zémor hash function hashes each bit of a given message individually. In this case, the matrices have the form and , where , is the two-element field, is the ideal generated by an irreducible polynomial of degree n, and is a root of . For instance, the message is hashed to the matrix .
It is worth noting that the Tillich–Zémor hash function was successfully attacked by Grass et al. [
16], who obtained collisions using the Euclidean algorithm for polynomials. Afterwards, Petit and Quisquater [
17] introduced an extended form of Grass et al.’s algorithm to provide a second preimage algorithm. Grassl et al. also ran Grover’s algorithm on a quantum computer to study the strength of the cryptographic system AES [
18].
Mullan and Tsaban [
19] introduced a general attack for the Tillich–Zémor scheme. It runs with polynomial time
to find collisions for an arbitrary
q. It does not work for bit strings of length
.
Other pairs of matrices such as in the Tillich–Zémor scheme have been proposed by Bromber et al. and Sosnovki, who introduced a semigroup platform corresponding to the hash functions and modulo a prime (the corresponding associated matrices have the form and ). In this case, the input string hash function can have an arbitrary length, and the output has the size .
In this paper, we applied Sosnovski hash functions to Brauer messages to investigate their collision-resistant property.
2.1.1. Background and Related Work on Brauer Configuration Algebras
Brauer configuration algebras (BCAs) were introduced by Green and Schroll [
4] to generalize research on tame algebras. Soon afterwards, Cañadas et al. used these algebras and their associated messages to obtain applications in cryptography, cibersecurity, and the graph energy theory [
3,
5,
6,
20,
21].
It is worth pointing out that Espinosa [
3] introduced in his doctoral dissertation the notion of the message of a Brauer configuration as the element of a word algebra. He used Brauer messages to give formulas for the number of perfect matchings of a snake graph and the number of homological ideals associated with a Nakayama algebra. On the other hand, Cañadas et al. introduced mutations of Brauer configurations to give an algebraic description of the cryptosystem AES [
6].
In this paper, we associate Brauer configuration algebras with points in the plane, establishing which points have associated Brauer configuration algebras with the same dimension.
2.1.2. Path Algebras
In this section, we give a brief discussion on quivers, path algebras, and their ideals based on the work of Assem et al. [
22].
A quiver or directed graph is a quadruple consisting of two sets: (whose elements are called points or vertices) and (whose elements are called arrows) and two maps which associate to each arrow , its source , and its target , respectively. If is an algebraically closed field, then we let denote the path algebra associated with the quiver Q, whose underlying -vector space has as its basis the set of all paths of length in Q, such that the product of two basis vectors is given by the usual concatenation of paths.
The following
Figure 2 shows a quiver
Q with four vertices
,
, and
and three arrows
,
, and
. Note that,
is the set of paths of length 1, whereas
is the set of paths of length 2 in
Q.
The basis
of the algebra
associated with the quiver
Q shown in
Figure 2 is
, where
is the set of primitive idempotents, with
and
if
.
Let Q be a finite and connected quiver. The two-sided ideal of the path algebra generated (as an ideal) by the arrows of Q is called the arrow ideal of . A two-sided ideal I of is said to be admissible if there exists such that .
If I is an admissible ideal of , the pair is said to be a bound quiver. The quotient algebra is said to be the algebra of the bound quiver or, simply, a bound quiver algebra.
Let Q be a quiver. A relation in Q with coefficients in is an -linear combination of paths of length, with at least two having the same source and target.
If
is a set of relations for a quiver
Q such that the ideal they generate
is admissible, we say that the quiver
Q is bound by the relation
or by the relations
[
22].
Henceforth, we let denote the radical of a path algebra , which is the intersection of all maximal ideals. Actually, if I is an admissible ideal of , it holds that .
If ≺ is an admissible well-ordering on the set of paths, i.e., ≺ is a well-ordering such that
If , where and are both nonzero or .
If , then .
Then, the
tip of an element
is the maximal path
w with respect to ≺ such that
w has a nonzero coefficient in
x when it is written as a linear combination of the elements of a fixed basis of
.
is the set of tips of elements in
X [
7].
Let I be an ideal in a path algebra and let . If , then is a Gröbner basis for I with respect to ≺.
2.1.3. Brauer Configuration Algebras
In this section, we briefly discuss the main results regarding Brauer configuration algebras [
4].
A Brauer configuration algebra (or simply if no confusion arises) is induced by a Brauer configuration , consisting of a pair of finite sets and , a function ( denote the set of positive integers), and an orientation .
Elements of () are called vertices (polygons). Polygons are labeled multisets consisting of vertices.
If , then (i.e., each polygon contains more than one vertex).
is a choice for each vertex
of a cyclic ordering of the polygons in which
occurs as a vertex including repetitions (see [
4] for more details). For instance, if a vertex
occurs in polygons
for suitable indices, then the cyclic order is obtained by linearly ordering the list, say
where,
means that vertex
occurs
times in polygon
, denoted
. The cyclic order is completed by adding the relation
. Note that if
is the chosen ordering at vertex
, then the same ordering can be represented by any cyclic permutation.
The sequence (
1) is said to be the successor sequence at vertex
, denoted
, which is unique up to permutations. Note that Green and Schroll [
4] mentioned that different orientation choices are typically associated to nonisomorphic Brauer configuration algebras.
Henceforth, in this paper, if a vertex belongs to some polygons ordered according to the already defined cyclic ordering associated with the vertex , then we assume that up to permutations the cyclic ordering associated with the vertex is built, taking into account that polygons inherit the order given by the successor sequence .
If denotes the underlying set defined by a polygon V (repetitions are not allowed in ), then .
If
, then the valency
of
is given by the identity
If is such that , then is said to be truncated (it occurs once in just one polygon). Otherwise, is a nontruncated vertex. A Brauer configuration without truncated vertices is said to be reduced.
Algorithm 1 is a short version of an algorithm defined by Cañadas et al. in [
5] to build a Brauer configuration algebra.
The following results describe the structure of Brauer configuration algebras [
4,
23].
Algorithm 1: Construction of a Brauer configuration algebra |
Input A reduced Brauer configuration . Output The Brauer configuration algebra . Construct the quiver as follows:
. For each covering in a successor sequence , define an arrow . For each path defined by a successor sequence , construct a special cycle defined by the union , where, and .
Define the path algebra . The admissible ideal is generated by relations of the following types: - (a)
Identify special cycles associated with nontruncated vertices in the same polygon (i.e., if with , then ). - (b)
If is a special cycle associated with a nontruncated vertex , then a product of the form if a is the first arrow of . - (c)
Products of the form with a induced by a covering in a special cycle and b induced by another special cycle (with ) belong to .
is a Brauer configuration algebra with a basis consisting of classes of special cycles and classes of prefixes of special cycles.
|
Theorem 1 ([
4], Theorem B, Proposition 2.7, Theorem 3.10, Corollary 3.12).
Let be a Brauer configuration algebra with Brauer configuration .There is a bijection between the set of indecomposable projective -modules and the polygons of . Moreover, if is an indecomposable -module induced by a polygon V with r nontruncated vertices, then , where for each i, is a uniserial -module. is uniserial for all .
I is admissible, and is multiserial and symmetric.
The number of summands in the of an indecomposable projective -module with equals the number of nontruncated vertices of the polygon V counting repetitions.
If , , is a truncated vertex, , , with , then and are isomorphic.
Proposition 1 and Theorem 2 give formulas for the dimensions
and
of a Brauer configuration algebra
and its center
[
4,
23].
Proposition 1 ([
4], Proposition 3.13).
Let be a Brauer configuration algebra associated with the Brauer configuration and let be a full set of equivalence class representatives of special cycles. Assume that for , is a special -cycle where is a nontruncated vertex in . Then,,
where denotes the number of vertices of Q, denotes the number of arrows in the -cycle , and .
Theorem 2 (Theorem 4.9, [
23]).
Let be the Brauer configuration algebra associated with the connected and reduced Brauer configuration . Then,where .
Proposition 2 ([
4], Proposition 3.6).
Let be the Brauer configuration algebra associated with a connected Brauer configuration . The algebra has a length grading induced from the path algebra if and only if there is an such that for each nontruncated vertex . 2.2. The Message of a Brauer Configuration
The notion of the message of a Brauer configuration and labeled Brauer configurations were introduced by Espinosa et al. [
3] to define suitable specializations of some Brauer configuration algebras. According to them, since polygons in a Brauer configuration
are multisets, it is possible to assume that any polygon
is given by a word
of the form
where for each
i,
,
.
The message is in fact an algebra of words element
associated with a fixed Brauer configuration, such that for a given field
the word algebra
consists of formal sums of words with the form
,
is the empty word, and
for any
. The product in this case is given by the usual word concatenation. The formal product (or word product)
is said to be the
message of the Brauer configuration .
If
is a ring, then a
specialization of a reduced Brauer configuration
is a Brauer configuration
endowed with a suitable map
, such that
The orientation
is defined by the orientation
, in such a way that if
is a successor sequence associated with a vertex
(see (
1)), then, for some
,
, it holds that
is contained in the successor sequence
associated with
.
(∝ is a suitable operation associated with the specialization ring) is the specialized message of the Brauer configuration provided that, in such a case, each word can be interpreted by a product of the specialization ring elements.
A Brauer configuration is said to be S-labeled (or simply labeled, if no confusion arises) by an integer sequence if each polygon is labeled by an integer number , . In such a case, we often write ,
For each vertex
, a corresponding cyclic ordering of labeled polygons where
occurs is defined. One advantage of labeling Brauer configurations is that the set
S can be used to systematically define the orientation associated with each vertex or obtain the polygons recursively [
3].
It is worth noticing that any finite set can be used to label Brauer configurations. In this paper, we use finite well-ordered sets of lattice paths to label Brauer configurations.