Using the subgroup membership search problem in public key cryptography

Abstract

There are several public key protocols around that use the computational hardness of either the conjugacy search problem or the word (search) problem for nonabelian groups. In this paper, we describe a cryptosystem whose security is based on the computational hardness of the subgroup membership (search) problem: given a group G, a subgroup H generated by h1, . . . , hk, and an element h ∈ H, find an expression of h in terms of h1, . . . , hk. It is also interesting to note that groups which we suggest to use as the platform, free metabelian groups, are infinitely presented, in contrast with groups typically used in public key cryptography. Nevertheless, these group have efficiently (and, in fact, very easily) solvable word problem.