Public key protocols from twisted-skew group rings

Citation: de la Cruz, J.; Martínez-Moro, E.; Muñoz-Ruiz, S.; Villanueva-Polanco, R. Public Key Protocols from Twisted-Skew Group Rings. Cryptography 2024,8, 29. https://doi.org/10.3390/ cryptography8030029 Academic Editor: Josef Pieprzyk Received: 3 April 2024 Revised: 10 June 2024 Accepted: 13 June 2024 Published: 5 July 2024 Copyright: © 2024 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https:// creativecommons.org/licenses/by/ 4.0/). cryptography Article Public Key Protocols from Twisted-Skew Group Rings Javier de la Cruz 1,* , Edgar Martínez-Moro 2, Steven Muñoz-Ruiz 3and Ricardo Villanueva-Polanco 4 1Department of Mathematics and Statistics, Universidad del Norte, Barranquilla 081007, Colombia 2Institute of Mathematics, Universidad de Valladolid, 47011 Valladolid, Spain; edgar[email protected] 3Department of Mathematics, University of Miami, Coral Gables, FL 33146, USA; [email protected] 4Cryptography Research Center, Technology Innovation Institute, Abu Dhabi P.O. Box 9639, United Arab Emirates; [email protected] *Correspondence: jdelacr[email protected] Abstract: This article studies some algebraic structures known as twisted-skew group rings in the context of public key cryptography. We first present some background related to these structures to then specifically introduce particular twisted-skew group rings and show how to utilize them as the underlying algebraic structure to build cryptographic protocols. We closely follow an incrementallike methodology to construct these protocols by putting parts together. As as result, we first introduce a key-agreement protocol and then generalize it to a group key-agreement protocol. We then proceed to construct a probabilistic public key encryption from our two-party key agreement and, finally, introduce a key-encapsulation mechanism from a well-known generic construction applied to probabilistic public encryption. Furthermore, we provide an in-depth security analysis for each cryptographic construction under new related algebraic assumptions and supply a proof-of-concept implementation for various candidate chosen groups. Keywords: twisted-skew group ring; key agreements protocol; key-encapsulation mechanism; public key scheme 1. Introduction While the increasingly close possibility of bringing about quantum technology for massive use in the coming years approaches, which will render current public key schemes insecure, the cryptographic community has devoted efforts to design, implement, and deploy quantum-safe public key primitives that replace current public key algorithms. Thus far, many candidates have been proposed via standardization calls for proposals and independent and individual efforts [ 1 – 3 ]. Those candidates may roughly be classified into several categories or groups, namely lattice-based schemes, code-based schemes, isogeny schemes, MPC-in-the-Head schemes, multivariate schemes, and symmetric-based schemes [1–3]. Nevertheless, recent papers [ 4 – 7 ] propose different, promising cryptographic schemes based on group ring generalizations, which seem to be quantum-secure [ 8 ]. The research articles [5–7] introduce cryptographic protocols whose security hinges on algebraic problems defined on the structure of a twisted dihedral group algebra, while [ 4 ] presents constructions that are supported on a skew dihedral group ring structure. Specifically, Ref. [ 7 ] proposes a two-cocycle αλ to form the twisted algebra Fαλ qD2n for a non-square λ in the field Fq , where D2n=⟨x , y:xn=y2= 1, yxy−1=x−1⟩ is the dihedral group of order 2 n . More precisely, the two-cocycle αλ:D2n×D2n−→ F∗ q is defined by αλ(g , h) = λ for g=xiy , h=xjy with i , j∈ { 0, . . . , n− 1 } and αλ(g , h) = 1 otherwise. Furthermore, following an incremental-like methodology as employed by us in this paper, the authors of [ 7 ] introduce a key exchange protocol, a probabilistic public key scheme, and a key-encapsulation mechanism over the twisted algebra Fαλ qD2n . Furthermore, their constructions and their proof-of-concept implementation are enhanced by exploiting the properties of the twisted Cryptography 2024,8, 29. https://doi.org/10.3390/cryptography8030029 https://www.mdpi.com/journal/cryptography Cryptography 2024,8, 29 2 of 23 algebra. On the other hand, Ref. [ 4 ] proposes cryptographic protocols supported on an algebraic structure that is called the skew dihedral group ring. This algebraic platform, denoted by Fθσ q2D2n , is formed of the dihedral group D2n and the group homomorphism described by θσ(g) = σ , where σ(a) = aq for all a∈Fq2 , for g=xiy , i∈ { 0, . . . , n− 1 } , and θσ(g) = 1 otherwise. Furthermore, using an incremental-like methodology, the authors of [4] similarly propose a key-exchange protocol, a probabilistic public key scheme, and a key-encapsulation mechanism over the skew dihedral group ring Fθσ q2D2n. Concerning other related works, the research articles [ 9 , 10 ] investigate ideals as codes in twisted-skew group rings. In particular, they characterize all linear codes that are twisted-skew group codes in terms of their automorphism group. Our main contribution is generalizing previous approaches [ 4 – 7 ] in the sense that we present a novel algebraic structure, which is a twisted-skew group ring and generalizes those in [ 4 – 7 ], and exhibit various cryptographic protocols supported on this structure. This structure features a two-cocycle αλ and a group homomorphism θσ . We particularly consider G to be a finite group of even order and N≤G such that |N|=|G|/ 2 =n , i.e., [G:N] = 2, and hence, G=N∪Ny with y∈G\N . For λ∈F∗ q , the map αλ:G×G→F∗ q as α(g , h) = λ if g/∈N and h/∈N and αλ(g , h) = 1 otherwise is a two-cocycle of the group G over Fq . Also, the map θσ:G→Gal(Fq2 , Fq) defined by θσ(g) = σ if g/∈N and θσ(g) = 1 otherwise is a group homomorphism. We then define the twisted-skew group ring Fθσ,αλ q2G , over which we build cryptographic constructions. By closely following an incremental-like methodology as previously used in [ 4 , 7 ], we construct a key-agreement protocol and then generalize it to a group key-agreement protocol. We then proceed to build a probabilistic public key encryption from our two-party key agreement and, finally, introduce a key-encapsulation mechanism from a well-known generic construction applied to the probabilistic public encryption. Furthermore, we provide an in-depth security analysis for each cryptographic construction under new related algebraic assumptions and supply a proof-of-concept implementation for various candidate chosen groups. The outline of the paper is as follows. In Section 2, we will present background material and formally introduce the twisted-skew group ring over which we will build our cryptographic protocols. Section 3will formally introduce our intractability assumptions. In particular, we will formally define attack games for the algebraic problems on which the security of our cryptographic constructions rely. Section 4first gives a detailed account of our two-party key-agreement protocol together with its corresponding security analysis and then focuses on its generalization along with the corresponding security analysis. Section 5 will delineate a probabilistic public key-encryption scheme derived from our two-party key-agreement protocol and the corresponding security analysis. Section 6will portray our key-encapsulation mechanism derived from the probabilistic public key-encryption scheme from Section 5. In Section 7, we will describe the pseudo-code of our proof-of-concept Python implementation for our cryptographic constructions and conclude this section by hinting at potential applications of our protocols. Finally, Section 8will conclude our work and outline future research directions. 2. A Twisted-Skew Group Ring Let G be a finite group and Fq be the finite field of order q=pm and characteristic p . We denote the automorphism group of Fq by Aut(Fq) , and Gal(Fqk , Fq)≤Aut(Fq) always denotes the group of all automorphisms of Fqk that fix Fq , which is called the Galois group of Fqk over Fq . A well-known result is that the Galois group Gal(Fqk , Fq) is a cyclic group of order k and that the Frobenius automorphism σ of Fqk over Fq is a generator , which is defined as σ(a) = aq for all a∈Fqk . Moreover, by Hom(G , Aut(Fqk)) and Hom(G , Gal(Fqk , Fq)) , we denote the set of group homomorphisms from G to Aut(Fqk) Cryptography 2024,8, 29 3 of 23 and Gal(Fqk , Fq) , respectively. Additionally, the map α:G×G→Fq\ { 0 } is called a two-cocycle of Gif α(1, 1) = 1 and α(g,hk)α(h,k) = α(gh,k)α(g,h) for all g,h,k∈G. Let Z2(G,Fq)denote the set of all two-cocycles of G. We say that the cocycle αis stabilized by the group θ(G)≤Aut(Fq), if θ(g)α(x,y) = α(x,y)(1) for all g,x,y∈G. For α , β∈ Z 2( G, F∗ q) , we define αβ ∈ Z 2( G, F∗ q) as αβ(g , h) = α(g , h)β(g , h) for all g , h∈G . With this operation, Z 2( G, F∗ q) becomes a multiplicative Abelian group. If β:G−→ F∗ q is a map such that β( 1 ) = 1, the coboundary ∂β defined by ∂β(g , h) = β(g)−1β(h)−1β(gh) for all g , h∈G is in Z 2( G, F∗ q) . We denote the set of all coboundaries of G by B2(G , F∗ q) , which forms a subgroup of the group Z 2( G, F∗ q) . Given a twococycle α∈ Z 2( G, F∗ q) , its coset is denoted by [α]:=αB2(G , F∗ q) . Additionally, we call the quotient group H2(G, F∗ q) = Z2(G, F∗ q)/B2(G, F∗ q) the second cohomology group of Gwith values in F∗ q. Definition 1 (See [ 10 ]).Let G be a finite multiplicative group; let α∈Z2(G , Fq) be a twococycle of G ; let θ∈Hom(G , Aut(Fq)) be a group homomorphism. The twisted-skew group ring Fθ,α qG is the set of all formal sums ∑g∈Gagg , where ag∈Fq , with the following twisted-skew multiplication: agg·bhh=ag(θ(g)(bh))α(g,h)gh. In [ 10 ], it is proven that, if the cocycle α is stabilized by θ(G) , then Fθ,α qG is an associative ring with identity 1. Note that F1,1 qG is nothing else than the group algebra FqG , while F1,α qG is the twisted group algebra Fα qG , and Fθ,1 qG is the skew group ring Fθ qG (see [ 4 , 9 , 10 ]). Moreover, by [ 10 ], Lemma 1.5, for θ∈Hom(G , Aut(Fq)) , we have that Fθ,α qG and Fθ,1 qG=Fθ qG are isomorphic, if α is a coboundary. In particular, Fα qG=F1,α qG∼ =F1,1 qG=FqG as Fq -algebras, if α is a coboundary. Definition 2 (See [10]).For an element a =∑g∈Gagg∈Fθ,α qG, we define its adjunct as b a:=φ(a) = ∑ g∈G θ(g−1)(ag)α(g,g−1)g−1. In the sequel, we will always consider that G is a finite group of even order and N≤G such that |N|=|G|/ 2 =n , i.e., [G:N] = 2, and hence, G=N∪Ny with y∈G\N . Also, we assume the elements of G are ordered according to some fixed order. In particular, N={n0 , n1 , . . . , nn−1} and G={niyj|i∈ { 0, 1, . . . , n− 1 } , j∈ { 0, 1 }} . Some possible groups Gsatisfying the previous conditions are as follows: 1. Dihedral group: A presentation of the dihedral group Dof order 2nis given by D=⟨x,y:xn=y2=1, yxy−1=x−1⟩, where N=⟨xi⟩and |N|=n. Cryptography 2024,8, 29 4 of 23 2. Quasidihedral group: A presentation of the quasidihedral group G of order 2 n is given by G=⟨x,y:x2n−1=y2=1, yxy =x2n−2−1⟩, where N=⟨xi⟩and |N|=n=2n−1. 3. Modular maximal-cyclic group: A presentation of the modular maximal-cyclic group Mof order 2nis given by M=⟨x,y:x2n−1=y2=1, yxy =x2n−2+1⟩, where N=⟨xi⟩and |N|=n=2n−1. 4. Generalized quaternion group: A presentation of the generalized quaternion group Q of order 2nis given by Q=⟨x,y:x2n−1=y4=1, x2n−2=y2,yxy−1=x−1⟩, where N=⟨xi⟩and |N|=n=2n−1. Lemma 1. Let y ∈G\N. Then, we have the following: 1. Fθ,α qG is a free Fθ,α qN -module with basis { 1, y} . Therefore, Fθ,α qG=Fθ,α qN⊕Fθ,α qNy as the direct sum of Fq-vector spaces. 2. Fθ,α qN∼ =Fθ,α qNy as Fθ,α qN-modules. 3. For a ∈Fθ,α qNy, ab ∈Fθ,α qN if b ∈Fθ,α qNy or ab ∈Fθ,α qNy if b ∈Fθ,α qN. 4. If a ∈Fθ,α qN, then b a∈Fθ,α qN. 5. If a ∈Fθ,α qNy, then b a∈Fθ,α qNy. Proof. Let y∈G\N: 1. Since {1, y}is a transversal of N, the assertion follows. 2. Consider the map σ:Fθ,α qN→Fθ,α qNy given by σ(g) = gy for all g∈N , then σ is an Fθ,α qN-module isomorphism. 3. Since [G:N] = 2, then gh ∈N if and only if g , h∈N or g , h∈Ny . Therefore, the assertion follows. 4. If g∈N, then g−1∈Nsince Nis a subgroup. Hence, the assertion follows. 5. If g∈Ny, then g−1∈Ny since [G:N] = 2. Hence, the assertion follows. Definition 3. We define the (θ , α) -reversible subspace of Fθ,α qNy as the vector subspace Γθ,α= {a=∑n−1 i=0ainiy∈Fθ,α qNy :ai=a[−i]nfor all i =1, 2, . . . , n−1}. The following lemma introduces the two-cocycle αλ on the group G , for a given element λin F∗ q. Lemma 2. Let λ∈F∗ q . Then, the map αλ:G×G→F∗ q defined by α(g , h) = λ if g/∈N and h/∈N and αλ(g,h) = 1otherwise is a two-cocycle of the group G over Fq. Proof. By definition, αλ(g , h)( 1, 1 ) = 1. Therefore, αλ is a two-cocycle if αλ(g , h)αλ(gh , k) = αλ(g , hk)αλ(h , k) for all g , h , k∈G . Let us first assume g∈N and h , k∈G , then a straightforward calculation shows that αλ(g , h)αλ(gh , k) = αλ(g , hk)αλ(h , k) holds. On the other hand, if g∈Ny , then a straightforward calculation also shows that αλ(g , h)αλ(gh , k) = αλ(g,hk)αλ(h,k)holds. Lemma 3. Let αλbe the two-cocycle defined in Lemma 2: 1. If λis a square in F∗ q, then αλis a coboundary. Cryptography 2024,8, 29 5 of 23 2. If λ is a non-square in F∗ q and there exists g∈Ny such that g2= 1, then αλ cannot be a coboundary. 3. If λ1,λ2are non-squares in F∗ q, then αλ1and αλ2are congruent. Proof. 1. Suppose λ is a square in F∗ q , then there exists t∈Fq such that t2=λ . Let us define β(g) = 1 if g∈N , or else β(g) = t−1 . We have αλ(g , h) = β(g)−1β(h)−1β(gh) for all g,h∈G, since gh ∈Nif and only if g,h∈Nor g,h∈Ny. 2. Suppose there exists a function β such that β( 1 ) = 1 and αλ(g , h) = β(g)−1β(h)−1β(gh) . Therefore, αλ(g,g) = λ=β(g)−1β(g)−1β(g2) = [β(g)−1]2, a contradiction. 3. Let ξ be a primitive element of F∗ q . Since λ1 , λ2 are non-squares in F∗ q , then λ1=ξk 1 and λ2=ξk 2 with k1 and k2 being odd. Therefore, λ1=ξk 1=λ2ξk3 , where k3 is even, i.e., ξk3 is a square in Fq . Let us define β(g) = 1 if g∈N and β(g) = ξk3/2 otherwise. We, therefore, have αλ1(g , h) = αλ2(g , h)β(g)β(h)β(gh)−1 for all g , h∈G , since gh ∈Nif and only if g,h∈Nor g,h∈Ny. Remark 1. Note that, since (λ2m−1)2=λ , for all λ∈F2m and m∈N , then F2mG and Fθ,αλ qG are isomorphic. By this, we will assume that char Fq=2. Let Fq2 be a quadratic extension of Fq . From now on, we only will take into consideration a quadratic extension of Fq since the ambient space over which we define our cryptographic constructions is the twisted-skew group ring Fθσ,αλ q2G , where θσ∈ Hom(G, Aut(Fq2)) is a group homomorphism. We next introduce θσ. Lemma 4. Let σ∈Gal(Fq2 , Fq)) be the Frobenius automorphism of Fq2 over Fq . Then, the map θσ:G→Gal(Fq2 , Fq) defined by θσ(g) = σ if g/∈N and θσ(g) = 1otherwise is a group homomorphism. Proof. Let g,h∈Gand γ∈Fq2. There are four cases to check: 1. g,h∈Nis easy to check. 2. g∈Nyh/∈N,θ(gh)(γ) = σ(γ) = Id(σ(γ)) = θ(g)θ(h)(γ). 3. h∈Nyg/∈N,θ(gh)(γ) = σ(γ) = σ(Id(γ)) = θ(g)θ(h)(γ). 4. g,h/∈N,θ(gh)(γ) = γ=σ(σ(γ)) = θ(g)θ(h)(γ). Remark 2. θσ relies on the Frobenius automorphism σ . Moreover, since Gal(Fq2 , Fq)≤Aut(Fq2) , then θσ∈Hom(G , Gal(Fq2 , Fq)) .Furthermore, if λ∈Fq⊂Fq2 , then λq+1 2)(q−1)=λq2−1 2= 1, i.e., it is a square, and also, αλ is stabilized by the group θσ(G) ; therefore, the twisted-skew group ring Fθσ,αλ q2G is isomorphic to the skew group ring Fθσ q2G introduced in [ 4 ]. However, if λ∈Fq2\Fq , then the cocycle αλ is not stabilized by the group θσ(G) , and so, the twisted-skew multiplication is not necessarily associative. In fact, for none of the possible four groups G we consider the twisted-skew multiplication is associative. Lemma 5. Let αλ be the two-cocycle defined in Lemma 2and θσ∈Hom(G , Gal(Fq2 , Fq)) the group homomorphism defined in Lemma 4. Then, we have the following: 1. ab =ba for a,b∈Fθσ,αλ q2N. 2. aˆ b=bˆ a for a,b∈Γθσ,αλ. 3. ˆ ab =ˆ ba for a,b∈Γθσ,αλ. 4. ((ah)γ) = (a(hγ)) for a ∈Fθσ,αλ q2N,h∈Fθσ,αλ q2G,γ∈Γθσ,αλ. Cryptography 2024,8, 29 6 of 23 Proof. 1. Let a=∑n−1 i=0aini∈Fθσ,αλ qNand b=∑n−1 i=0bini∈Fθσ,αλ qN. ab = n−1 ∑ i=0 aini n−1 ∑ j=0 bjnj=∑ k∈N  ∑ ninj=k aibj k(2) ba = n−1 ∑ i=0 bini n−1 ∑ j=0 ajnj=∑ k∈N  ∑ ninj=k biaj k(3) Note that the second sum of Equations (2) and (3) follows from the definitions of θσ and αλ. Therefore, ab =ba. 2. Let a=∑n−1 i=0ainiy∈Γθσ,αλ and b=∑n−1 i=0biniy∈Γθσ,αλ . Then, aˆ b can be expressed as n−1 ∑ i=0 ainiy n−1 ∑ j=0 θ((njy)−1)(bj)αλ(njy,(njy)−1)(njy)−1 =∑ k∈N  ∑ (niy)(njy)=k aibjλq+1 k(4) and bˆ aas n−1 ∑ i=0 biniy n−1 ∑ j=0 θ((njy)−1)(aj)αλ(njy,(njy)−1)(njy)−1 =∑ k∈N  ∑ (niy)(njy)=k biajλq+1 k(5) The first sum of Equations (4) and (5) follows from the definitions and that, for all ω∈Ny , α(ω , ω−1) = λ . The second sum of Equations (4) and (5) follows from θσ being a homomorphism, and thus, θσ(g)(θσ(h)(a)) = θσ(gh)(a) = a for a∈Fq2 and θσ(g)(λ) = σ(λ) = λq. Since a , b∈Γθσ,αλ , then ai=a[−i]n and bj=b[−j]n for i , j∈ { 0, 1, . . . , n− 1 } . Therefore, the (i , j) -th term aibjλq+1 of ∑(niy)(njy)=kaibjλq+1 in (4) coincides with the ([−j]n , [−i]n) -th term b[−j]na[−i]nλq+1 of ∑(niy)(njy)=kbiajλq+1 in (5), which implies the equality. 3. Let a=∑n−1 i=0ainiy∈Γθσ,αλand b=∑n−1 i=0biniy∈Γθσ,αλ. Then, we can write ˆ ab as n−1 ∑ i=0 θ((niy)−1)(ai)αλ(niy,(niy)−1)(niy)−1 n−1 ∑ j=0 bjnjy = n−1 ∑ i=0 aq iλ(niy)−1 n−1 ∑ j=0 bjnjy =∑ k∈N  ∑ (niy)−1(njy)=k aq ibq jλ2 k(6) Cryptography 2024,8, 29 7 of 23 and ˆ ba is n−1 ∑ i=0 θ((niy)−1)(bi)αλ(niy,(niy)−1)(niy)−1 n−1 ∑ j=0 ajnjy = n−1 ∑ i=0 bq iλ(niy)−1 n−1 ∑ j=0 ajnjy =∑ k∈N  ∑ (niy)−1(njy)=k bq iaq jλ2 k(7) The last sum of Equations (6) and (7) follows from the definitions, α(ω , ω−1) = λ and θσ(ω)(a) = aqfor ω∈Ny,a∈F2 q. Since a , b∈Γθσ,αλ , then ai=a[−i]n and bj=b[−j]n for i , j∈ { 0, 1, . . . , n− 1 } . Therefore, the (i , j) -th term aq ibq jλ2 of ∑(niy)(njy)=kaq ibq jλ2 in (4) coincides with the ([−j]n , [−i]n) - th term bq [−j]naq [−i]nλ2of ∑(niy)(njy)=kbq iaq jλ2in (5), which implies the equality. 3. Intractability Assumptions This section will describe some attack games concerning the algebraic problems on which the security of our cryptographic constructions lies [ 4 , 7 , 11 , 12 ]. Before giving a detailed account of them, we will introduce some notation that we will use for the remaining part of this paper: 1. Let Gbe a finite group of even order and N≤Gsuch that |N|=|G|/2 =n. 2. Let p be a prime number and q=pm for some m∈N . Let Fq2 be the quadratic extension of Fq. 3. The two-cocycle αλ is instantiated by selecting λ such that it is a non-square in Fq2 . Additionally, θσis chosen as specified by Lemma 4. 4. We set h=h1+h2 as a public element, where h1∈Fθσ,αλ q2N and h2∈Fθσ,αλ q2Ny are random non-zero elements. 5. We denote the secret key space by SK =Fθσ,αλ q2N×Γθσ,αλ . Given a secret key sk = (a , γ)∈ SK , we denote (a , b γ) by c sk . Besides, we define ψ:SK × Fθσ,αλ q2G−→ Fθσ,αλ q2G as ψ(sk,h) = ahγ. Game 1 (Twisted-Skew Product Decomposition).Let A be an efficient adversary. We define the Twisted-Skew Product Decomposition (TSPD) Attack Game as shown by Algorithm 1. Algorithm 1 defines the Twisted-Skew Product Decomposition (TSPD) Attack Game The challenger Cexecutes 1: (a,γ)R ←− SK; 2: pk ←ψ((a,γ),h); 3: (ea,e γ)← A(pk); 4: return [[eahe γ=ahγ]]; In the TSPD attack game, [[eahe γ=ahγ]] denotes a Boolean value, which is 1 when eahe γ=ahγ , or 0 otherwise. We define E1 as the event that the TSPD attack game outputs 1 after A plays it for Fθσ,αλ q2G . Furthermore, we define A ’s advantage in solving the TSPD problem for Fθσ,αλ q2Gas the probability of E1and denote it by TSPDadv[A,Fθσ,αλ q2G]. Cryptography 2024,8, 29 8 of 23 Definition 4 (Twisted-Skew Product Decomposition Assumption).We say that the TSPD assumption holds for Fθσ,αλ q2G if, for all efficient adversaries A , the quantity TSPDadv[A , Fθσ,αλ q2G] is negligible. Game 2 (Computational Twisted-Skew Product).Let A be an efficient adversary. We define the Computational Twisted-Skew Product (CTSP) Attack Game as shown by Algorithm 2. Algorithm 2 defines the Computational Twisted-Skew Product Attack Game The challenger Cexecutes 1: (a1,γ1)R ←− SK; 2: (a2,γ2)R ←− SK; 3: pk1←ψ((a1,γ1),h); 4: pk2←ψ((a2,γ2),h); 5: k←ψ((a2,c γ2),pk1); 6: e k← A(pk1,pk2); 7: return [[e k=k]]; We define E2 as the event that the CTSP attack game outputs 1 after A plays it for Fθσ,αλ q2G . Moreover, we define A ’s advantage in solving the CTSP problem for Fθσ,αλ q2G as the probability of E2and denote it by CTSPadv[A,Fθσ,αλ q2G]. Definition 5 (Computational Twisted-Skew Product Assumption).We say that the CTSP assumption holds for Fθσ,αλ q2G if, for all efficient adversaries A , the quantity CTSPadv[A , Fθσ,αλ q2G] is negligible. Lemma 6. If the TSPD assumption does not hold for Fθσ,αλ q2G , then the CTSP assumption does not hold for Fθσ,αλ q2G. Proof. Since the TSPD assumption does not hold for Fθσ,αλ q2G , then there exists an efficient adversary B that can win the TSPD attack game with non-negligible probability ρ , i.e., B can output (ea,e γ)∈ SK such that eahe γ=ahγ=pk with non-negligible probability ρ. We now construct an efficient adversary A that plays and wins the CTSP attack game with non-negligible probability ρ . A simply uses B as the subroutine. Upon receiving pk1 and pk2 from its challenger, A calls B upon the input either pk1 or pk2 . In either case, if B succeeds in returning a (ea , e γ)∈ SK such that f pk =eahe γ=abhγb=pkb(b∈ { 1, 2 }) , then A will calculate e k=eapk¯ bb e γ , with ¯ b= 3 −b , and return e k to its challenger. Because of the choice of θσand αλand Lemma 5, then e k=eapk¯ bb e γ=eaa¯ bhγ¯ bb e γ=a¯ beahe γc γ¯ b=a¯ bf pkc γ¯ b=a¯ bpkbc γ¯ b=k In conclusion, A is an efficient adversary and may succeed in computing the correct k in the CTSP attack game with non-negligible probability ρ. Game 3 (Decisional Twisted-Skew Product).Let A be an efficient adversary. We define the Decisional Twisted-Skew Product (DTSP) Attack Game by two experiments indexed by a bit b as shown by Algorithm 3. Cryptography 2024,8, 29 9 of 23 Algorithm 3 defines the Decisional Twisted-Skew Product Attack Game For Experiment b, the challenger Cexecutes 1: (a1,γ1)R ←− SK; 2: (a2,γ2)R ←− SK; 3: (a3,γ3)R ←− SK; 4: pk1←ψ((a1,γ1),h);pk2←ψ((a2,γ2),h); 5: k0←ψ((a2,c γ2),pk1);k1←ψ((a3,γ3),h); 6: e b← A(pk1,pk2,kb) 7: return [[b=e b]]; Remark 3. Game 3 defines two experiments indexed by a random bit b chosen by the challenger. Therefore, the challenger returns either (pk1 , pk2 , k0) or (pk1 , pk2 , k1) to the adversary A , depending on the experiment the challenger is playing, i.e., the challenger gives (pk1 , pk2 , kb) to A . We denote the experiment b by DTSP(b). We define Wb as the event that A outputs the bit 1 after playing the experiment b in the DTSP attack game for Fθσ,αλ q2G . Furthermore, we define A ’s advantage in solving the DTSP problem for Fθσ,αλ q2Gas |Pr[W0]−Pr[W1]|and denote it by DTSPadv[A,Fθσ,αλ q2G]. Definition 6 (Decisional Twisted-Skew Product Assumption).We say that the DTSP assumption holds for Fθσ,αλ q2G if, for all efficient adversaries A , the quantity DTSPadv[A , Fθσ,αλ q2G] is negligible. Lemma 7. If the CTSP assumption does not hold for Fθσ,αλ q2G , then the DTSP assumption does not hold for Fθσ,αλ q2G. Proof. Since the CTSP assumption does not hold for Fθσ,αλ q2G, then there exists an efficient adversary B that outputs e k∈Fθσ,αλ q2G such that e k=k after being given public keys pk1 and pk2with non-negligible probability. We now construct an efficient adversary A that plays and wins the DTSP attack game with non-negligible probability. This adversary A uses B as the subroutine. In particular, upon receiving (pk1 , pk2 , kb) from its challenger, A calls B upon the input (pk1 , pk2) . If B solves this instance of the CTSP problem for given pk1 and pk2 and returns ˜ k to A , then A compares ˜ kand kbto see whether they are equal. If so, then Areturns 0, or 1 otherwise. In summary, A is an efficient adversary and may succeed in winning the DTSP attack game with non-negligible probability. The Hardness of the TSPD Problem The TSPD problem is similar to both the Dihedral Product Decomposition (DPD) and Skew Dihedral Product Decomposition (SDPD) problems. The former was introduced in [ 5 ], then formalized in [ 7 ] and extended in [ 6 ], while the latter was introduced in [ 4 ] as an extension of the former. The key difference between both is that the latter is defined over the Dihedral Skew Group Ring Fθσ q2D2n , which is structurally different from the algebra Fαλ qD2nover which the former is defined. We remark that the algorithmic analysis presented for the DPD problem over Fαλ qD2n in [ 7 ] can be adjusted easily to both the SDPD and TSPD problems. Furthermore, note that, if λ is non-square, then the twisted-skew multiplication defined over Fθσ,αλ q2G is not associative, which motives the claim that the TSPD problem is defined over a less-structured algebraic structure. Cryptography 2024,8, 29 16 of 23 We now demonstrate an adversary B that performs the DTSP attack game 3defined in Section 3. In particular, the adversary B will assume the role of challenger for A , and its part is as follows. B will first communicate with its own challenger from which it will receive the three-tuple (pk1 , pk2 , k) . It then forwards pk1 to A . When it obtains (m0 , m1) from A , then B chooses a bit b at random, computes c←mb+k , and transmits (pk1 , pk2 , c) to A . Once B finally procures a final response bit ˜ b by A , it returns [[b=˜ b]] in the DTSP attack game. Clearly, B is an efficient adversary, since A is also an efficient adversary. Recall that W¯ b is the event that B outputs 1 in game DTSP(¯ b) ; thus, B ’s advantage for solving the DTSP problem for Fθσ,αλ q2Gis given by DTSPadv[A,Fθσ,αλ q2G] = |Pr[W0]−Pr[W1]|. A key observation here is the following. On the one hand, whenever B ’s challenger is playing game DTSP( 0 ) , A is in turn playing Game0, since Bobtains from its challenger (pk1=a1hγ1,pk2=a2hγ2,k=a2pk1c γ2). Therefore, Pr[W0] = Pr[S0]. On the other hand, whenever B ’s challenger is playing Game DTSP( 1 ) , A is in turn playing Game1, because Bobtains from its challenger (pk1=a1hγ1,pk2=a2hγ2,k=a3hγ3). Therefore, Pr[W1] = Pr[S1]. By hypothesis, |Pr[W0]−Pr[W1]| is negligible; therefore, |Pr[S0]− 1 / 2 | is negligible, and the assertion follows. 6. A Key-Encapsulation Mechanism from Twisted-Skew Group Rings In this section, we will focus on deriving a CCA-secure key-encapsulation mechanism from our probabilistic public key encryption E . To accomplish this task, we will apply a generic transformation from [ 27 ] to E . We will next describe this generic transformation a bit more. Let PKE = (Gen , Enc , Dec) be a public key-encryption scheme with message space M , ciphertext space C , and randomness space R . Let KeyLength ∈N and G:M → R and H: { 0, 1 }∗→ { 0, 1 }KeyLength be hash functions. This transformation is a variant of the Fujisaki– Okamoto transformation with “implicit rejection” of inconsistent ciphertexts. Formally, it is defined as KEM⊥ =FO⊥(PKE , G , H):=U⊥[T[PKE,G],H]=(Gen , Encaps , Decaps) (see [ 27 ] for more details). Algorithm 10 summarizes functions (Gen , Encaps , Decaps) after applying the transformation to PKE , converting it into a CCA-secure key-encapsulation mechanism. We remark that the proof that this generic transformation converts a public key encryption scheme into a CCA-secure key-encapsulation mechanism may be found in [27]. Cryptography 2024,8, 29 17 of 23 Algorithm 10 depicts the CCA-secure key-encapsulation mechanism (Gen , Encaps , Decaps) from PKE 1: function Gen() 2: (pk,sk)←PKE.Gen; 3: sR ←− M; 4: sk′←(sk,s); 5: return (sk′,pk); 6: end function 1: function Encaps(pk) 2: mR ←− M; 3: c←PKE.Enc(pk,m,G(m)); 4: k← H(m,c); 5: return (k,c); 6: end function 1: function Decaps(sk′= (sk,s),c) 2: m′←PKE.Dec(sk,c); 3: if c=PKE.Enc(pk,m′,G(m′)) then 4: return H(m′,c); 5: else 6: return H(s,c); 7: end if 8: end function To apply this transformation to our scheme E , we proceed by establishing the following. Let K={ 0, 1 }KeyLength be the key space and BinaryRep(x) be a function that returns the binary representation of x . Furthermore, recall that the randomness space is SK = Fθσ,αλ q2N×Γθσ,αλ , the public key space is PK =Fθσ,αλ q2G , the message space is M=Fθσ,αλ q2G , and the ciphertext space is C=Fθσ,αλ q2G . Finally, we will define the hash function H1 and H2as follows: •H1:{ 0, 1 }∗−→ SK is a hash function, which, upon the input of a variable-length bit string x , returns (a , γ)∈ SK . Using the notation of [ 28 ], this function may be defined as H1(x) = SHAKE256(x , ζ) , where ζ= 2 ⌈log2(q)⌉(n+⌈n 2⌉) is the bit length of the output and |N|=|G|/ 2 =n . The bit string bitstring returned by SHAKE256 can be converted into a element in SK by carefully dividing the bit string into two parts, the first of length 2 ⌈log2(q)⌉n bits and the second of length 2 ⌈log2(q)⌉⌈n 2⌉ bits, each being employed to derive a,γ, respectively. Let m1,m2∈ M, and we define G(m1,m2):=H1BinaryRep(m1)||BinaryRep(m2). •H2:{ 0, 1 }∗−→ K is a hash function that, upon the input of a variable-length bit string x , returns k∈ K . This function may be defined as H2(x) = SHAKE256(p1||x , KeyLength) , where KeyLength is the bit length of the output and p1 is a prepended fixed bit string to make it different from H1. Let m,c∈ M. We define H(m,c):=H2BinaryRep(m)||BinaryRep(c). After applying the generic transformation to E , i.e., U⊥[T[E,G],H] , we obtain KEM = (KeyGen , Encaps , Decaps) . Algorithm 11 describes the functions KeyGen , Encaps and Decaps. Algorithm 11 depicts the CCA-secure key-encapsulation mechanism (KeyGen , Encaps , Decaps) from E 1: function KeyGen(h) 2: (pk,sk)← E.Gen(h); 3: sR ←− M; 4: return (sk,s,pk); 5: end function 1: function Encaps(pk,h) 2: mR ←− M; 3: r← G(m,pk); 4: c← E.Enc(m,pk,r,h); 5: K← H(m,c); 6: return (K,c); 7: end function 1: function Decaps((sk,s,pk),c,h) 2: m′← E.Dec(c,sk); 3: r′← G(m′,pk); 4: if c=E.Enc(m′,pk,r′,h)then 5: return H(m′,c); 6: else 7: return H(s,c); 8: end if 9: end function Cryptography 2024,8, 29 18 of 23 7. Implementation of Our Cryptographic Constructions The proof-of-concept implementation of our cryptographic constructions was coded in Python. The interested reader can see it on Google Colaboratory [29]. 7.1. Group Representation Recall that G=N∪Ny , where |N|=|G|/ 2 =n . For our protocols, we only considered G∈ {D , G , M , Q} . For any choice, N=⟨xi⟩ is a cyclic group, and thus, a group element g∈G is of the form g=xiyj , which may be represented as an integer g=j·n+i , where i∈ {0, . . . , n−1}and j∈ {0, 1}. The computation of the integer representation of either g1·g2 or g−1 1 , g1 , g2∈G , will hinge on the form of the group elements and the specific presentation of G . Note that, by exploiting each group presentation, explicit formulae can be derived to compute both g1·g2and g−1 1efficiently. The interested reader can see the implementation [29]. 7.2. Two-Cocycle αλ The function 2cocycle(k1 , k2) takes two group element representations, k1 and k2 , as the input, then the function returns λ if n≤k1< 2 n and n≤k2< 2 n . Otherwise, it returns 1. 7.3. Homomorphism θσ The function homomorphism(k1) takes a group element representation, k1 , as the input, then this function returns a pointer to the function σ if n≤k1< 2 n . Otherwise, it returns a pointer to the identity function I. Algorithm 12 shows both functions. Algorithm 12 presents functions involved in computing the homomorphism θσ 1: function σ(a∈Fq2) 2: [bs,bs−1, . . . , b0]←BinaryRep(q); 3: r←getOneFromQuadraticField(); 4: for i←s to 0do 5: r←r·r; 6: if bi=1then 7: r←r·a; 8: end if 9: end for 10: return r; 11: end function 1: function I(a∈Fq2) 2: return a 3: end function 7.4. The Twisted-Skew Group Ring Fθσ,αλ q2G To represent an element a=∑n−1 i=0aixi+∑n−1 i=0an+ixiy in the group ring Fθσ,αλ q2G , we make use of an array of 2 n field elements a= [a0 , a1 , a2 , . . . , a2n−1] , where ai is the representation of the field element ai∈Fq2 . Algorithms 13 and 14 describe the addition and product operations, respectively. Algorithm 13 computes the addition of two ring elements 1: function addition(a,b) 2: c←[0,· · · ,0]; 3: for (i←0; i<2n;i←i+1)do 4: c[i]←a[i] + b[i]; 5: end for 6: return c; 7: end function Cryptography 2024,8, 29 19 of 23 Algorithm 14 computes the product of two ring elements 1: function product(a,b) 2: c←[0,· · · ,0]; 3: for (i←0; i<2n;i←i+1)do 4: for (j←0; j<2n;j←j+1)do 5: k←G.eval(i,j); 6: outH ←homomorphism(i)(b[j]); 7: out2c ←2cocylce(i,j); 8: fe ←a[i]·outH ·out2c; 9: c[k]←c[k] + fe; 10: end for 11: end for 12: return c; 13: end function Addition and Product Costs We now quantify the cost of Algorithms 13 and 14. Let us denote •FA and FM as the costs of a field addition and a field multiplication respectively. •GE and HC as bounds on the cost of calling G . eval(i , j) and the number of field multiplications to compute homomorphism(i)(b[j]) respectively. •Cαλas the constant cost of executing 2cocylce(i,j). On the one hand, Algorithm 13 has a cost of 2 nFA when computing a ring element c . On the other hand, Algorithm 14 has a cost of 4n2(FA + (2+HC)FM +GE +Cαλ). 7.5. Auxiliary Functions As auxiliary functions, we implemented the following functions: 1. Algorithm 15 computes the adjunct of a ring element, and its cost is 2 n(GI + (HC + 1)FM +Cαλ), where GI is a bound on the cost of calling G.inverse(i). 2. Functions for computing random elements in different sets are implemented. They are described in Algorithm 16. Algorithm 15 computes the adjunct of a ring element 1: function adjunct(a) 2: c←[0,· · · ,0]; 3: for (i←0; i<2n;i←i+1)do 4: j←inverse(i); 5: f1←homomorphism(j)(a[i]); 6: f2←2cocylce(i,j); 7: c[j]←f1·f2; 8: end for 9: return c 10: end function Cryptography 2024,8, 29 20 of 23 Algorithm 16 presents functions for computing a random element in different sets 1: function getPublicElement() 2: sw1←False; 3: while not sw1do 4: a←getRandomFG(); 5: i←0; 6: sw2←False; 7: while i<nand not sw2do 8: if a[i]=0then 9: sw2←True; 10: end if 11: i←i+1; 12: end while 13: i←n; 14: sw3←False; 15: while i<2nand not sw3do 16: if a[i]=0then 17: sw3←True; 18: end if 19: i←i+1; 20: end while 21: sw1←sw2and sw3; 22: end while 23: return a; 24: end function 1: function getRandomfromT() 2: c←[0,· · · ,0]; 3: c[n]←getRandomFieldElement(); 4: n1←n/2; 5: for (i←1; i≤n1;i←i+1)do 6: c[i+n]←getRandomFieldElement() ; 7: c[n+ (n−i)mod n]←c[i+n]; 8: end for 9: return c; 10: end function 1: function getRandomFG() 2: c←[0,· · · ,0]; 3: for (i←0; i<2n;i←i+1)do 4: c[i]←getRandomFieldElement(); 5: end for 6: return c; 7: end function 1: function getRandomFH() 2: c←[0,· · · ,0]; 3: for (i←0; i<n;i←i+1)do 4: c[i]←getRandomFieldElement(); 5: end for 6: return c; 7: end function 1: function getRandomFHy() 2: c←[0,· · · ,0]; 3: for (i←n;i<2n;i←i+1)do 4: c[i]←getRandomFieldElement(); 5: end for 6: return c; 7: end function 7.6. Key Sizes We next provide estimates for the memory sizes in bits required to store both a public key and a private key. A field element requires NFE = 2 ⌈log2(q)⌉ bits. On the one hand, a public key pk ∈ PK is a ring element, which can be stored as an array of |G| field elements. Therefore, storing a public key requires |G| · NFE bits. On the other hand, a private key (a , γ)∈ SK is a pair of two ring elements. Therefore, storing a full private key requires 2 · |G| · NFE bits. This number of bits can be decreased further if the form of the private key is exploited. Note that, since (a , γ)∈Fθσ,αλ q2N×Γθσ,αλ , only n+⌈n 2⌉ field elements need storing, and hence, a compressed private key requires (n+⌈n 2⌉)·NFE bits. For completeness, Algorithms 17 and 18 describe the process of compressing and decompressing a private key, respectively. Cryptography 2024,8, 29 21 of 23 Algorithm 17 compresses a private key 1: function compressPrivateKey(sk ∈ SK) 2: l←n+⌈n/2⌉; 3: c←[00,· · · ,0l−1]; 4: for (i←0; i<n;i←i+1)do 5: c[i]←a[i]; 6: end for 7: for (i←n;i<l;i←i+1)do 8: c[i]←γ[n+i]; 9: end for 10: return c; 11: end function Algorithm 18 decompresses a private key 1: function decompressPrivateKey(sk) 2: l← ⌈n/2⌉; 3: a←[00,· · · ,02n−1]; 4: γ←[00,· · · ,02n−1]; 5: for (i←0; i<n;i←i+1)do 6: a[i]←sk[i]; 7: end for 8: γ[n]←sk[n]; 9: for (i←1; i<l;i←i+1)do 10: γ[n+i]←sk[n+i]; 11: γ[2n−i]←sk[n+i]; 12: end for 13: return (a,γ); 14: end function 7.7. Parameter Choices In reference to our key-encapsulation mechanism, we suggest using the parameters displayed by Table 1, which supplies varying and increasing security levels. Table 1 displays four sets of parameters, where KeyLength ∈ { 128, 192, 256 } denotes the output key length. The values displayed in the column labeled as “Level of Security in Bits” have been computed as proposed in [ 7 ]. The interested reader may see our implementation here [29]. Table 1. Proposed parameters. p m n Group KeyLength (bits) Level of Security in Bits 19 1 20 Dihedral {128, 192, 256}130 19 1 23 Dihedral {128, 192, 256}149 19 1 32 Any of the four candidate groups {128, 192, 256}207 19 1 64 Any of the four candidate groups {128, 192, 256}410 7.8. Potential Applications We believe that our protocols might find applications in environments like the Internet of Things (IoT) for various reasons. One first reason is that they may potentially be implemented in constrained devices and the overhead of running them in those devices might be small. This viewpoint stems from observing that the algorithms involved in computing encryptions (or shared keys) are relatively simple, as evinced in this section. Secondly, the key sizes are relatively small compared to other schemes [ 3 ], which offers an advantage for storing purposes. Furthermore, we remark that the study on the deployability of post-quantum cryptographic algorithms on constrained devices is of current interest, Cryptography 2024,8, 29 22 of 23 as evidenced in [ 30 ]. On the other hand, we also believe that it might be possible to derive password authentication key exchange (PAKE) protocols from our protocols. If so, these PAKE protocols are versatile and may be used in many scenarios, such as credential recovery, device paring, and end-to-end (E2E)-secure channels, as shown in [ 31 ]. However, our protocols per se might be adapted and used in some of those potential scenarios, particularly E2E-secure channels. 8. Conclusions This paper introduced the twisted-skew group ring Fθσ,αλ q2G , where αλ is a two-cocycle, θσ a group homomorphism, and G a finite group of even order with N≤G such that |N|=|G|/ 2 =n , i.e., [G:N] = 2, and hence, G=N∪Ny with y∈G\N . Over this algebraic platform, we built several cryptographic constructions following a incrementallike methodology. In particular, we first introduced a two-party key-agreement protocol and its generalization. Additionally, we derived a probabilistic public key encryption from the two-party key-agreement protocol and key-encapsulation mechanism from the probabilistic public key encryption. As a future research direction, it would be interesting to explore the possibility of constructing other key-exchange protocols from twisted-skew group rings, namely a password authentication key exchange protocol, which might be suitable in environments like the IoT. Author Contributions: Conceptualization, J.d.l.C., E.M.-M., S.M.-R. and R.V.-P.; methodology, J.d.l.C., E.M.-M., S.M.-R. and R.V.-P.; software, R.V.-P.; validation, J.d.l.C., E.M.-M., S.M.-R. and R.V.-P.; formal analysis, J.d.l.C., E.M.-M., S.M.-R. and R.V.-P.; investigation, J.d.l.C., E.M.-M., S.M.-R. and R.V.-P.; resources, J.d.l.C.; writing—original draft preparation, J.d.l.C., E.M.-M. and R.V.-P.; writing—review and editing, J.d.l.C., E.M.-M. and R.V.-P.; supervision, J.d.l.C. and R.V.-P.; project administration, J.d.l.C.; funding acquisition, J.d.l.C. All authors have read and agreed to the published version of the manuscript. Funding: The first author is grateful for the support of Fundación para la Promoción de la Investigación y la Tecnología del Banco de la República under project 4649, and the second author is partially supported by Grant TED2021-130358B-I00 funded by MCIN/AEI/10.13039/501100011033 and by the “European Union NextGenerationEU/PRTR”. Data Availability Statement: The original contributions presented in the study are included in the article, further inquiries can be directed to the corresponding author. Conflicts of Interest: The authors declare no conflicts of interest. References 1. National Institute of Standards and Technology, NIST Post-Quantum Cryptography. Available online: https://csrc.nist.gov/ Projects/post-quantum-cryptography/selected-algorithms-2022 (accessed on 1 June 2024). 2. National Institute of Standards and Technology, Post-Quantum Cryptography: Digital Signature Schemes. Available online: https://csrc.nist.gov/Projects/pqc-dig-sig/round-1-additional-signatures (accessed on 1 June 2024). 3. Dam, D.-T.; Tran, T.-H.; Hoang, V.-P.; Pham, C.-K.; Hoang, T.-T. A Survey of Post-Quantum Cryptography: Start of a New Race. Cryptography 2023,7, 40. [CrossRef] 4. de la Cruz, J.; Martínez-Moro, E.; Villanueva-Polanco, R. Public Key Protocols over Skew Dihedral Group Rings. Mathematics 2022,10, 3343. [CrossRef] 5. Gómez Olvera, M.D.; López Ramos, J.A.; Torrecillas Jover, B. Public Key Protocols over Twisted Dihedral Group Rings. Symmetry 2019,11, 1019. [CrossRef] 6. Gómez Olvera, M.D.; López Ramos, J.A.; Torrecillas Jover, B. Secure Group Communications Using Twisted Group Rings. Mathematics 2022,10, 2845. [CrossRef] 7. de la Cruz, J.; Villanueva-Polanco, R. Public key cryptography based on twisted dihedral group algebras. Adv. Math. Commun. 2024,18, 857–877. [CrossRef] 8. Suo, J.; Wang, L.; Yang, S.; Zheng, W.; Zhang, J. Quantum algorithms for typical hard problems: A perspective of cryptanalysis. Quantum Inf. Process. 2020,19, 178. [CrossRef] 9. de la Cruz, J.; Willems, W. Twisted group codes. IEEE Trans. Inf. Theory 2021,67, 5178–5184. [CrossRef] 10. Behajaina, A.; Borello, M.; de la Cruz, J.; Willems, W. Twisted skew G -codes. Des. Codes Cryptogr. 2024,92, 1803–1821. [CrossRef] Cryptography 2024,8, 29 23 of 23 11. Shoup, V. Sequences of Games: A Tool for Taming Complexity in Security Proofs, Cryptology ePrint Archive, Report 2004/332. 2004. Available online: http://eprint.iacr.org/2004/332 (accessed on 1 December 2023). 12. Boneh, D.; Shoup, V. A Graduate Course in Applied Cryptography, Textbook. Available online: http://toc.cryptobook.us/book. pdf (accessed on 1 June 2024). 13. Lopez-Ramos, J.A.; Rosenthal, J.; Schipani, D.; Schnyder, R. An application of group theory in confidential network communications. Math. Meth. Apply Sci. 2018,41, 2294–2298. [CrossRef] 14. Kahrobaei, D.; Koupparis, C.; Shpilrain, V. Public key exchange using matrices over group rings. Groups Complex Cryptol. 2013,5, 97–115. [CrossRef] 15. Eftekhari, M. Cryptanalysis of Some Protocols Using Matrices over Group Rings. In Progress in Cryptology—AFRICACRYPT 2017; Joye, M., Nitaj, A., Eds.; AFRICACRYPT 2017; Lecture Notes in Computer Science; Springer: Cham, Switzerland, 2017; Volume 10239. 16. Maze, G.; Monico, C.; Rosenthal, J. Public key cryptography based on semigroup actions. Adv. Math. Commun. 2007,1, 489–507. [CrossRef] 17. Roman’kov, V. A General Encryption Scheme Using Two-Sided Multiplications with Its Cryptanalysis. arXiv 2017, arXiv:1709.06282. 18. Bader, C.; Hofheinz, D.; Jager, T.; Kiltz, E.; Li, Y. Tightly-Secure Authenticated Key Exchange. In Theory of Cryptography; Dodis, Y., Nielsen, J.B., Eds.; TCC 2015; Lecture Notes in Computer Science; Springer: Berlin/Heidelberg, Germany, 2015; Volume 9014. 19. Jager, T.; Kiltz, E.; Riepel, D.; Schäge, S. Tightly-Secure Authenticated Key Exchange, Revisited, Cryptology ePrint Archive: Report 2020/1279. 2020. Available online: https://eprint.iacr.org/2020/1279 (accessed on 3 June 2024). 20. Canetti, R.; Krawczyk, H. Analysis of Key-Exchange Protocols and Their Use for Building Secure Channels. In Advances in Cryptology-EUROCRYPT 2001; Pfitzmann, B., Ed.; EUROCRYPT 2001; Lecture Notes in Computer Science; Springer: Berlin/Heidelberg, Germany, 2001; Volume 2045. 21. Steiner, M.; Tsudik, G.; Waidner, M. Diffie-Hellman key distribution extended to group communication. In Proceedings of the 3rd ACM Conference on Computer and Communications Security (CCS ’96), New Delhi, India, 14–15 March 1996; Association for Computing Machinery: New York, NY, USA, 1996; pp. 31–37. [CrossRef] 22. Boyd, C.; Mathuria, A.; Stebila, D. Protocols for Authentication and Key Establishment, Second Edition, Information Security and Cryptography; Springer: Berlin/Heidelberg, Germany, 2019. 23. Steiner, M.; Tsudik, G.; Waidner, M. Key agreement in dynamic peer groups. IEEE Trans. Parallel Distrib. Syst. 2000,11, 769–780. [CrossRef] 24. Jao, D.; De Feo, L. Towards Quantum-Resistant Cryptosystems from Supersingular Elliptic Curve Isogenies. In Post-Quantum Cryptography; Yang, B.Y., Ed.; PQCrypto 2011; Lecture Notes in Computer Science; Springer: Berlin/Heidelberg, Germany, 2011; Volume 7071. 25. ElGamal, T. A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms. In Advances in Cryptology; Blakley, G.R., Chaum, D., Eds.; CRYPTO 1984, Lecture Notes in Computer Science; Springer: Berlin/Heidelberg, Germany, 1984; Volume 196. 26. Diffie, W.; Hellman, M.E. New Directions in Cryptography. IEEE Trans. Inf. Theory 1976,22, 644–654. [CrossRef] 27. Hofheinz, D.; Hövelmanns, K.; Kiltz, E. A Modular Analysis of the Fujisaki-Okamoto Transformation; Kalai, Y., Reyzin, L., Eds.; Theory of Cryptography; TCC 2017; Lecture Notes in Computer Science; Springer: Cham, Switzerland, 2017; Volume 10677. 28. Dworkin, M.J. SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions. Federal Inf. Process. Stds. (NIST FIPS). 2015. Available online: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf (accessed on 3 June 2024). 29. de la Cruz, J.; Martínez-Moro, E.; Muñoz-Martinez, S.; Villanueva-Polanco, R. Implementation of Cryptographic Constructions Based on a Twisted-Skew Group Rings. Available online: https://colab.research.google.com/drive/1QA_hktpdTDVG9cPfkj4 Cq2IVeKMGy68Y?usp=sharing (accessed on 3 June 2024). 30. Fitzgibbon, G.; Ottaviani, C. Constrained Device Performance Benchmarking with the Implementation of Post-Quantum Cryptography. Cryptography 2024,8, 21. [CrossRef] 31. Hao, F.; van Oorschot, P.C. SoK: Password-Authenticated Key Exchange – Theory, Practice, Standardization and Real-World Lessons. In Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security (ASIA CCS ’22), Nagasaki, Japan, 30 May–3 June 2022; Association for Computing Machinery: New York, NY, USA, 2022; pp. 697–711. [CrossRef] Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.