Braid Compression. Martin Hock. December 15, 2004

Transcription

1 Brad Compresson Martn Hock December 15, 2004 Abstract In ths paper, we descrbe the brad group, frst mentoned n [2]. We gve applcatons to cryptography mentoned n [1] and [8]. We then descrbe an apparently new method for shortenng brad descrptons whch could be useful for transmttng brads over a lmted bandwdth channel. 1 Introducton Brad groups were frst descrbed by Artn n 1947 [2]. Artn orgnally descrbed the mathematcal concept of brads n terms of ther geometrc or topologcal nature. The bradng of har or rope may gve some ntuton as to the nature of the mathematcal brad. Alternately, consder an elevator full of n people. As the elevator descends, the people move around n the elevator, along the two dmensonal floor. The path traced by these people over tme n three-dmensonal space represents a brad, wth each ndvdual path called a strand. (A strand s a curve n 3-space parameterzed by z. Some sources call t a strng, but we reserve ths word to mean a concatenaton of symbols.) Two brads are consdered equvalent f they are sotopc, whch means that the ponts of one brad can be mapped to the ponts of the other n a contnuous fashon. In other words, f the brads were physcally manfested wth the strands made out of a flexble materal lke thread, we could push the threads of one brad around to match the other brad, leavng the ends fxed. We can also consder the concatenaton of brads by frst performng the crossngs of one brad and then the crossngs of the other on the same set of strands. Ths of course requres that the two brads match at the ends, but f they have the same number of strands, we can use sotopc equvalence to move them so that they match up, and there s a unque way to do ths that does not cause strands to cross each other. In ths way, we can thnk of the brad group on n strands, denoted B n, as beng a geometrc generalzaton of the symmetrc group S n. Specfcally, when we permute the elements n the case of B n, we are nterested when strands pass n front of or behnd each other. Soon, Artn found that an algebrac representaton was superor for analyss, and f you found the above descrptons too ary for rgor yet too hary for formalzaton, you wll too. He descrbed a set of generators, now referred to as Artn generators, whch produce all possble brads up to sotopy. Frst, we wll pcture the n strands stretchng from left to rght, sequenced from top to bottom, as n the followng dagram: n. We wll consder ths the dentty element. We wll buld all possble brads out of a set of generators. There are two knds of generators, postve and negatve. 1. n

2 Defnton (Postve Generator). The postve generator σ sgnfes that strand crosses over strand + 1: Defnton (Negatve Generator). The negatve generator σ under strand + 1: sgnfes that strand crosses The generators do not follow the ndvdual strands as they work ther way around the brad; the generator σ sgnfes that the th strand from the top crosses over the + 1st strand, thus n essence mappng the th strand to the + 1st and vce versa. Remark. Ths presentaton s doubly reversed from that of other papers such as [4], where strands are numbered wth 1 startng at the bottom, and σ sgnfes that strand +1 crosses over strand. There s no dfference n the algebra of the two presentatons, of course - we could vew the brad from the back nstead of from the front, through a mrror, and get the opposte nterpretaton. We defne the group B n of n N,n > 1 strands as havng the generators σ 1,...,σ n and σ1,...,σ n. (Recall that σ nvolves strands and +1, so we do not nclude σ n.) Multplcaton n ths group conssts of concatenaton, whch s obvously assocatve. We are gven nverses by defnton, and we have an dentty: the empty strng. These generators are known as the Artn generators as they come from [2]; later, we wll consder an alternate presentaton. We wll now gve two relatons for the generators whch, when combned wth the axoms whch hold for all groups, wll complete the presentaton of B n. 1.1 Swap relaton A strng (as n symbolc concatenaton) of these generators sgnfes a sequence of crosses. Dvdng the brad along the horzontal axs nto dscrete parts, each of whch contans exactly one adjacent crossng, the jth poston n the strng of generators sgnfes what occurs at the jth part of the brad. The fact that we can n fact dvde up the brads nto such a sequence was shown n [2], but t s ntutvely obvous. If a strand crosses another strand j, t must cross the strands n between and j. If more than one crossng occurs at the same horzontal poston, smply separate the strands by pullng them apart from each other. So, for example, σ 1 σ 3 appears as the pcture on the left, but σ 3 σ 1 appears as the pcture on the rght: 2

3 It s farly obvous that these are sotopc, snce we can smply move these separated crossovers past each other. We could do ths as long as the crossovers are suffcently separated f they are only one strand apart, they wll nterfere. We call the followng the swap relaton, as t nvolves the swappng of two generators: Defnton (Swap relaton). σ σ j = σ j σ f j 2. Ths s the frst of the two relatons Generalzed swap relaton We can use the swap relaton to derve the correspondng denttes for negatve crossngs as well as mxed postve and negatve crossngs: σ σ j = σ j σ σ σ σ j = σ σ j σ σ j = σ σ j σ σ j σ j = σj σ σ j σ 1 = σj σ σ j σ σ σ σ σj σ σj = σ j σ σ j σ σ = σj σ σ j ( ) = σ j = σj σ σ σ j σj Startng from lne ( ), we can get the followng: σ σ j σ σ j σ = σj σ σ j = σ j σj σ σ j = σ σ j Flppng the sgn of σ j s smlar. Thus, we have the more generalzed form of the relaton: 3

4 Theorem (Generalzed swap relaton). σ x σ y j = σy j σx f j Shft relaton There s one other relaton we need. Examne the followng dagram: Ths s known as the thrd Redemester move from knot theory. Assumng the strands are nfntely long, f we shft the horzontal strand down n the frst pcture, we get the second pcture, so the two are sotopc. Ths corresponds to the followng brad stuaton, where nstead of sldng the frst strand down (whch would compromse equvalence because t would no longer be consdered the frst strand), we merely push the mddle part of the strand down, and push the outer parts up: In other words, σ1 σ 2σ 1 = σ 2 σ 1 σ2. In general, one would state ths as σ σ +1 σ = σ +1 σ σ However, there s a more beautful way to wrte ths equvalence: σ σ +1 σ = σ +1 σ σ+1 σ σ σ +1 σ = σ σ +1 σ σ+1 σ +1 σ = σ σ +1 σ σ+1 σ +1 σ σ +1 = σ σ +1 σ σ+1 +1 whch, due to the topologcal shftng of the strands, we refer to as the shft relaton: +1. Defnton (Shft relaton). σ +1 σ σ +1 = σ σ +1 σ. 4

5 1.2.1 Generalzed shft relaton We can also derve a couple of denttes out of ths relaton: σ +1 σ σ +1 = σ σ +1 σ σ σ +1 = σ+1 σ +1 σ σ +1 = σ σ+1 σ +1 σ 1 = σ σ+1 σ +1 σ Smlarly, σ σ +1 σ σ σ+1 = σ σ+1 σ σ +1 σ σ +1 = σ +1 σ σ +1 σ Usng the technques above, we can gve the followng general form: Theorem (Generalzed shft relaton). σ+1 σ = 1. σ x σy j σz = σz j σy σx j where j = 1, x,y,z {1, }, and (x y)(y z) = 0. Remark. In partcular, we do not allow σ j s sgn to be dfferent from both σ and σ k s sgns, as then f we follow the strands they do not have a total order: n σ σ+1 σ for example, the frst strand overlaps the second, the thrd strand overlaps the frst, but the second strand overlaps the thrd. These are the only two relatons that defne the group. We showed that they make sense physcally and that they needed only be defned on the postve generators. We dd not, however, show that they were completely suffcent to equate all sotopc brads. The proof s outsde the scope of ths paper, so we refer to [2] for the detals. We conclude wth the complete Artn presentaton of B n : Defnton (Artn presentaton). The group B n has a presentaton wth generators {σ ;n > 1} and wth defnng relatons σ σ j = σ j σ f j 2 and σ +1 σ σ +1 = σ σ +1 σ. 1.3 Observatons We now make a few observatons about varous B n groups. Wth only one strand, there s nothng nterestng to say; we have no defned generators, so there are no elements, and by defnton a group must contan at least one element, so B 1 sn t really a group. If there are exactly two strands, one thng we can see mmedately s that nether dentty comes nto play, but f the only generators we have are σ 1 and σ1, B 2 s somorphc to Z, where σ 1 s successor and σ1 s predecessor, and Z σ 1 B 2. The groups become more nterestng when they nclude at least three strands. At ths pont, the group s no longer abelan. Due to the assocatve law, σ x and σ y always commute, and due to the frst relaton, σ x and σ y j always commute f j 2, but due to the second relaton, σx and σ y j never commute f j = 1. Suppose we assume that they commute; then the followng s true: 5

6 σ σ +1 σ = σ +1 σ σ +1 σ σ σ +1 σ = σ σ +1 σ σ +1 (usng commutatve property) σ σ σ +1 σ = σ +1 σ σ σ +1 σ +1 σ = σ +1 σ +1 σ +1 σ +1σ = σ +1 σ +1σ +1 σ = σ +1 But f σ = σ +1, then we can use the frst dentty to commute σ +1 wth σ +2 (snce σ commutes wth σ +2 ), or σ wth σ (snce σ +1 commutes wth σ ). Thus, we can nductvely apply the above argument to equate all the generators asde from the outermost ones, mplyng that f any group B n has two commutng adjacent generators, then B n B 2. 2 Cryptography The concept of publc key cryptography can be conveyed by the followng scenaro. Suppose Alce (A) wshes to communcate a message M wth Bob (B) over an unsecured lne. (Don t confuse communcator B wth brad group B n!) They would lke to, based on some publc knowledge and some prvate knowledge, engage n a publc conversaton whch wll allow them to share knowledge wthout allowng eavesdroppers to easly reconstruct that knowledge. It almost sounds lke a paradox, but there are n fact two dfferent schemes whch allow ths to happen. 2.1 Encrypton The frst scheme s used for encrypton of messages. The followng steps ensue: 1. B announces hs publc key K n a manner whch hopefully wll not be tampered wth (such tamperng s known as a man-n-the-mddle attack). Ths key can also be consdered to be pror knowledge t does not change from one message to the next. 2. A uses K to encode a message, K(M) and broadcasts t to B. 3. B uses hs prvate key K to decode K(M) back nto M. Repeat steps 2 and 3 for each ndvdual message transmtted. B can respond to A f A has her own publc-prvate key par. An eavesdropper s faced wth the task of calculatng M gven K(M) and K. The encrypton scheme was presented n a paper by Rvest, Shamr, and Adleman [10], whch was the frst successful publc key cryptosystem and s the most wdely used one today. It uses the fact that determnng prmalty s easy (whch allows for key generaton) and exponentaton on the feld GF(p) s easy (whch allows for computng f), but factorng the product of two large prmes s not known to be easy (whch means that, gven the publc key, t s dffcult to fnd the prvate key). 2.2 Key exchange The second scheme s used for key exchange, whch has the followng steps: 6

7 1. B and A are made aware of a publc key K (perhaps by conventon B announces t). 2. A has a prvate key a and sends f(k,a) to B. 3. B has a prvate key b and sends f(k,b) to A. (Ths step does not depend on knowledge from step 2.) 4. A can compute f(f(k,a),b) and B can compute f(f(k,b),a). The concept of a publc key cryptosystems and key exchange n partcular was frst publcally descrbed by Dffe, Hellman, and Merkle. The frst successful mplementaton was descrbed n [5]. (I say publcally descrbed because apparently ths scheme as well as the RSA scheme were known to the Brtsh ntellgence agency GCHQ by 1974; see [6].) Here, we have the specfc need that f(f(k,a),b) = f(f(k,b),a); n other words, f must commute. Ths value wll be used as a common prvate key for the duraton of the conversaton. Another scheme wll be necessary for the transmsson of messages wth ths key. In the case of the Dffe-Hellman system [5], f s exponentaton on a large cyclc group. In ths case (as before), the exponentaton s easy, but the nverse, the dscrete log, s beleved to be dffcult. Note that wth key exchange, A and B learn a common secret, but they can t choose what that secret s, so t s not useful for transmttng a message. However, the secret can be used for the ntalzaton of another system whch can do ths, such as a symmetrc block cpher. 2.3 Anshel-Anshel-Goldfeld scheme We now exhbt two canddates for key exchange based on brad groups. The frst s known as the Anshel-Anshel-Goldfeld scheme and was descrbed n [1] among other places. 1. B and A are made aware of two publc keys: x = (x 1,...,x l ) B l n and y = (y 1,...,y m ) B m n. 2. A has a prvate key a [2l]. That s, A s prvate key s a strng of arbtrary length on an alphabet of 2l characters. A uses a to compute a product of brads based on x. The character 2, where 1 l, s replaced wth x and the character 2 1 s replaced wth x. We call ths product α (the th character beng α ) and t s kept prvate. A nstead sends B the conjugates αy 1 α,αy 2 α,...,αy m α, whch we refer to as y. 3. B has a prvate key b [2m]. B computes β B n by substtutng elements of y nto b. B then sends the conjugates βx 1 β,βx 2 β,...,βx n β, whch we refer to as x. 4. A computes α, whch s computed n the same way as α except substtutng x nto a. Thus, the th character α = βα β. A then computes α(α ). 5. B computes β by substtutng y nto b (β = αβ α ) and then computes β (β). 7

8 It turns out that α(α ) = β (β) = αβα β : α(α ) = α(βα 1 β βα 2 β... βα l β ) = α(βα 1...α l β ) (cancellaton of ββ ) = α(βαβ ) (defnton of α) = αβα β (nverse of βαβ ) = αβ 1...β m α β (defnton of β) = αβ 1 α αβ 2 α...αβ m α β (ntroducton of αα ) = β 1 β 2...β m β (defnton of β ) = β β (defnton of β ) (defnton of α along wth note of ts ndces) So, αβα β s the shared secret. The eavesdropper must somehow reconstruct αβα β from the traffc. Recall that we stated that multplcaton conssts of concatenaton. Wth the eavesdropper seeng all the x and y traffc, f the ndvdual strngs smply consst of the form αy α and βx β, pluckng out α merely conssts of lookng for a common pattern at the start of each of A s strngs, α from lookng at the end of A s strngs, and β and β can be seen from lookng at B s strngs. There may be some addtonal overlap, but there are only a lnear number of possbltes that the eavesdropper must try to shave down hs strngs to the correct alternatves, and n practce probably very few guesses would be needed. Therefore, we wll need some way of tanglng a concatenated brad nto an undentfable jumble whch stll represents the same brad. We can call ths the obfuscaton problem. Whle we re at t, f somethng s beng done wth the common key αβα β other than brad group operatons, we would want A and B to be lookng at the same representaton of the strng. But snce they go about calculatng t n dfferent ways, t s lkely to look much dfferent. We would lke a way to convert a brad nto some knd of canoncal form. We can call ths the normalzaton problem. Solvng normalzaton mght also solve the obfuscaton problem at least partally, because the orgnal concatenated representaton of the brads sent s probably not the canoncal representaton. Next, note that the brads we send mght be knd of bg. We would lke to reduce traffc as much as possble because bandwdth s a fnte resource. To do so, we would lke to fnd a small representaton of a gven brad. Frst, notce that there wll almost always be more than one mnmal representaton for a gven brad, so solvng ths won t mmedately solve the normalzaton problem. Second, t has been shown that determnng whether an arbtrary brad s mnmal s co-np complete, whch means that f you can solve t n sub-exponental tme, you wll become very famous among both mathematcans and computer scentsts. However, ths does not preclude effcently fndng a small form whch s provably wthn some factor of the optmal. Advancements n the feld of probablstcally checkable proofs have helped us show how well we can do; see [12] for more nformaton. Fnally, note that the scheme s not exactly symmetrc n that A and B operate on dfferent parts of the publc key, one on x and the other on y. However, there s no techncal lmtaton to settng x = y, and t would not seem to hurt us - n ths case, for example, A s frst part of x sent wll be αx 1 α, whle B s frst part of y sent wll be βx 1 β. But t was already publc knowledge what α and β were beng conjugated wth. The fact that they are conjugated wth the same thng does not appear to gve us any advantages. 8

9 2.4 Ko et al scheme A second key exchange procedure gven by Ko et al n [8] more closely resembles that n [5]. Agan, a s A s prvate key and b s B s prvate key. In ths case, we want to make a and b commute, so we have a,b B n and the publc key p B 2n A and B are made aware of a publc brad p B 2n A computes apa and sends t to b. 3. B produces b, whch s b shfted down: σ s mapped to σ +n+1. B computes b p(b ) and sends t to A. 4. A computes a(b p(b ) )a. 5. B computes b (apa )(b ) = a(b p(b ) )a due to the fact that a and b commute, snce the closest strands are 2 apart (σ n and σ n+2 ). (Ths s why we chose B 2n+1 nstead of B 2n.) The shared secret s thus a(b p(b ) )a. The asymmetry here s somewhat dsappontng, but snce one person dstngushes themselves by startng the conversaton, A and B can decde ther roles and act accordngly. Ths scheme, too, has the problem that a and b are broadcast n concatenated form. [11] note that an adversary need not fnd the orgnal a,b but rather smply a 1,a 2,b 1,b 2 such that a 1 pa 2 = apa and b 1 pb 2 = bpb. In a search context, ntroducng addtonal varables nflates the search space, but n an algebrac context, t can ntroduce many addtonal solutons, ultmately smplfyng the search. However, no technques are provded to take advantage of ths approach. 3 The Word Problem Suppose we have two brads b 1,b 2 B n constructed out of a strng of Artnan generators. We want some way of comparng them. There can be many ways of representng a gven brad usng generators just a sngle applcaton of the two equvalence relatons, or even addng an extra σ σ for any, wll make the brad dfferent. All we really need s an algorthm for nvertng a brad and an algorthm for seeng f a brad s the dentty. The nverse for a brad s easy: take the horzontal mrror mage and nvert the ndvdual generators. Then, we can perform elmnaton startng at the mddle and easly observe that ths wll cancel the brad. One dea for seeng f a brad s the dentty s the followng. Frst, make sure that all strands map to ther startng places by tracng them. Then, startng wth the top strand, tease apart each strand one at a tme, makng sure that t s free of the other strands. Every tme a strand crosses on top of the top strand, follow t and make sure that t eventually comes back and passes on top of the frst strand agan. Smlarly, f a strand passes beneath, make sure t comes back and passes beneath agan. If ths s true, we can remove the top strand as t s free of the other strands. Keep repeatng wth the top strand untl the procedure fals, whch means that t s not the dentty, or all strands have been deleted. Ths procedure s not too effcent, but t does take tme polynomal n the number of strands and length of the brad. A good queston to ask s whether there s a more effcent algorthm. The typcal soluton s to kll two brds wth one stone: solve the normalzaton problem. Once two brads are normalzed, seeng f they are equvalent s as smple as a bt comparson. 9

10 The procedure used for normalzaton of brads can be compared to the procedure for normalzng ratonal numbers: convertng them to lowest terms. If you have the ratonal number a b, and c = gcd(a,b), then the lowest term representaton s a/c b/c. We wll also use a form of gcd for fndng the normal form of a brad; however, nstead of makng t the smallest brad, the normal form wll typcally ncrease a brad s sze. In [7], Garsde showed that every brad b B n can be wrtten n the form b 1 b 2 where b 1,b 2 B n +,.e., contan no negatve generators. Ths can be thought of as a fractonal presentaton of B n, where B n + takes on the role of Z. To get the concept of a gcd, we wll have to generalze the dea of less than or equal, for whch we ll use the sgn. We wll say that a b f there exsts c such that ac = b (these elements all beng n B n + ). Also, we have a generalzed dea of greater than or equal: a b f there exsts c such that a = cb. Note that because the sde of c has been swtched and we are not workng wth an abelan group, here a b does not mply b a and vce versa, and ndeed s false unless the elements commute. For example, σ 1 σ 1 σ 2 because σ 2 suffces for c, but σ 1 σ 2 σ 1 because we can t concatenate a postve element to the left of σ 1 to produce σ 1 σ 2. (Recall that the only way to delete elements s to ntroduce negatve elements whch we don t allow because we are workng wth postve brads, so ntroducng two elements won t help us, and ntroducng one element to the rght of σ 1 won t help us ether.) As wth the comparson operators, the generalzed noton of gcd wll take nto account the non-abelan nature of the groups. There are both left and rght gcds. Suppose we have elements a,b; the left gcd c s such that c a, c b (whch means that c s a dvsor of a and b), and x x a and x b mples x c (whch means that c s the greatest dvsor of a and b). Notce that we used only to defne the left gcd; the rght gcd s smlar only usng only and changng the order. We can also defne a least common multple, or lcm, for both left and rght. Suppose we have a,b: the left lcm c s such that c a, c b (whch means that c s a multple of a and b), and x x a and x b mples x c (whch means that c s the least multple of a and b). Ths s actually the rght lcm, despte t appearng on the same sde as the left gcd. The relatons and along wth exstence of left and rght gcds and lcms (also known as greatest lower bounds and least upper bounds, or nfmums and supremums) defne what s known as a lattce. Garsde showed that B n + s a lattce. He also defned n, known as the fundamental brad: 1 = 1, n+1 = n σ n σ 1. n s thought of as beng fundamental because n σ and σ n for all σ B + n. We say that a brad b B + n s smple f there exsts c B+ n such that n = bc. Now consder some brad a B n. Garsde showed that a can be unquely wrtten n the followng way, whch s the normal form we have been seekng: Defnton (Greedy normal form). The greedy normal form of a brad a B n s a brad k nb = a wth k Z and b B + n f we maxmze k. Furthermore, b s wrtten as a product b 1 b r such that for each b, n = b c for some c B + n. To actually produce ths representaton, we start wth a brad a B n. We can then try representng a n the k nb form, for progressvely smaller k. k begns as 0; smaller k s only necessary f a contans negatve elements. The actual concept of left gcd comes n when we fnd a normal form for the postve part b. We can fnd the maxmal smple brad that dvdes b, whch s the left gcd of b and δ n. Suppose b = b 1 b where b 1 = gcd(b,δ n ). Then we can further factor b = b 2 b where b 2 = gcd(b,δ n ). Ths provdes the decomposton as b 1,...,b r as desred. 10

11 The normal form allows us to compare brads easly, but t tends to make the brad ncrease n sze quadratcally because of the growth rate of k n. Consder the followng depcton of σ 1σ2 σ 3σ1 n B 4 : Its normal form s σ 3 σ 2 σ 3 σ 1 σ 2 σ 3 σ 1σ 3 σ 2 σ 3 σ 2 σ 3 : Interestngly, even a brad as smple as σ 1 σ 2 can have a very large normal form. In fact, the normal form for ths brad n B n s (exactly) of sze n 2 n for n > 3; even though the optmal representaton conssts of two crossngs for any number of brads, the normal form grows quadratcally wth the number of brads, a huge loss of effcency. One technque whch has been studed for a more effcent representaton s to ncrease the number of generators. Ths was descrbed by Brman et al n [3]. We refer to the orgnal representaton as the Artn form and the new representaton as the BKL form. Instead of smply provdng generators for adjacent crossngs, we allow any two strands to cross. By conventon, the two cross over all ntervenng strands. The authors showed that ther algorthms are somewhat more computatonally effcent than those on the Artn generators, but they also ndcate that ther normal form s typcally much smaller. Ths s because the fundamental brad they use, δ (whch plays the same role as the Artnan ), rather than growng quadratcally, only grows lnearly. However, note that the bt representaton of the generators wll take up roughly twce as much space. Ths s because nstead of 2n generators, whch take up log(2n) = 1+log(n) bts apece, there are 2n(n) generators, whch take up log(2n(n 1)) = 1 + log(n) + log(n 1) > 2 log(n) bts apece. We now gve a formal defnton of the BKL presentaton: 11

12 Defnton (BKL presentaton). The group B n has a presentaton wth generators {a ts ;n t > s 1} and wth defnng relatons a ts a rq = a rq a ts f (t r)(t q)(s r)(s q) > 0 and a ts a sr = a tr a ts = a sr a tr for all t,s,r wth n t > s > r 1. 4 Compresson Here we present a dfferent approach than the BKL normal form to make a smaller but stll canoncal brad. The dea behnd the compresson technque s smple. We come up wth an evaluaton functon for Artn brads whch s used to score brads for how good they are, f : B n N. We want better brads to have a smaller score, so the dentty brad s mapped to 0 and we want to score brads whch are harder to reduce to a smaller form wth bgger scores. Then, we smply try applyng a sngle move : we try applyng the generalzed swap relaton to every adjacent par and the generalzed shft relaton to every adjacent trple. For each sngle move, we evaluate the brad and compare ts score to the orgnal. We then select the frst transformed brad whch the evaluaton functon produces the mnmal result for. If that brad s the same as the orgnal, we smply return the orgnal: we could not fnd an mprovement. Otherwse, we apply that transform, perform free reducton, and try to fnd the best sngle move agan. Defnton (Free reducton). Free reducton s the process of removng the maxmum number of generator-nverse pars whle preservng equalty, e.g. by frst elmnatng all strngs of the form (σ σ ) and then all strngs of the form (σ σ ), where x s the Kleene (star) closure of x. Note that f you have a strng of the form σ σ σ, ether the frst two or last two symbols may be elmnated, but not all three, but that n ether case, the result s the same: σ. Ths procedure wll not fnd an optmal representaton n general. If t dd, then P=NP, as shown by Paterson and Razborov n [9]. Instead, t fnds a representaton whch s locally optmal, that a sngle move won t mprove. However, we can stll use the output of the algorthm as a specal normal form, f our algorthms are determnstc and f we start wth a normal form, snce we wll get dentcal output for dentcal nput, whch wll be true n the case of equvalent brads as the normal forms wll be dentcal. We settle on a functon whch s easy enough to compute, yet analyzes the whole strng. We compute the dstance from each poston n the brad to ts closest nverse and return the sum of these dstances. (If a gven poston has no nverses, we add 0; also, f a generator s adjacent to ts nverse, we consder t to have dstance 0.) A naïve soluton mght take quadratc tme, but t can be done n lnear tme assumng constant tme array access. Refer to Algorthm 1 for pseudocode. Note that f b = σ j, Lookup(b ) returns the par (,j). There are two tuples we use to ad n computaton of BlockedEvaluaton, V = (v 1,...,v m ) wth one entry for each ndex n B, and and S = (s 1,1,s 1,,s 2,1,s 2,,...,s n,1,s n, wth one entry for each generator n B n. The key to BlockedEvaluaton s n the mantenance of two nvarants n the for loop found between lnes 5 and 12. Our nductve hypothess s that at the start of the th teraton, for all j, v j holds the ndex of the closest nverse < to b j, or (m ) f there s no such ndex. Furthermore, for all j,k, s j,k holds the maxmum ndex < such that b = σj k (.e., Lookup(b ) = (j,k)), or 0 f there s no such ndex. The algorthm begns by ntalzng each v to (m ) and each s,j to 0. Note that the ntalzaton of v s such that ts phantom closest neghbor s (m ) = m 12

13 Algorthm 1: Blocked evaluaton functon Input: A brad B B n consstng of m symbols b 1,...,b m Output: The sum of the dstances from each b to ts closest nverse whch does not appear before another ntervenng copy of b BlockedEvaluaton(B) (1) foreach b B (2) v (m ) (3) foreach σ j B n (4) s,j 0 (5) for = 1 to m (6) (j,k) Lookup(b ) (7) s j,k (8) z s j, k (9) f z 0 (10) v = z (11) f z < z v z (12) v z (13) y 0 (14) for = 1 to n (15) y y + v (16) return y postons away from t, whch s farther than any possble neghbor and normalzes all dstances to the same value. We can see that nductvely, the base case s complete: we have not seen anythng so far. Now consder teraton of the loop, whch wll set up the nvarants for + 1. In lnes 6 7, we mmedately set s j,k to, where b = σj k. Ths follows the defnton of s j,k: f b = σj k, then s the rghtmost ndex < + 1 such that b = σj k. Now we attempt to look up the ndex of the closest nverse of σj k seen so far, whch s s k j. Let z = s k j. If z = 0, by the nductve hypothess, we haven t seen σj k yet, so we leave s k j as s. Otherwse, we have seen t. Immedately, we know that the closest nverse of σj k seen so far s b z, so we assgn v = z. Now we need to see f b s the closest nverse to b z. We can calculate ths by comparng dfferences. We don t need absolute value sgns because z < and f v z > z, then > v z and s thus even farther away than v z. If b s closest, we reassgn v z to be. Wth that, we have mantaned the nvarants and thus the nductve hypothess s proved. To calculate the return value n lnes 14 15, we smply add up for each the dstance between v and, snce v s the ndex of the closest nverse of b. Or s t? Note that n the th teraton, f we have two copes of σj k, we wll only check the closest one < to see f b s closer and update t f necessary. So, after the algorthm completes, for all, v only contans the closest nverse of b = σj k whch s not separated by another copy of σk j. In fact, ths s a desrable trat, because we are only concerned wth the dstance between a symbol and ts closest accessble nverse. A symbol wll never be able to access the nverse through the other copy of tself. For ths reason, we call ths the blocked verson of the evaluaton functon. Note that t only takes loops whch perform a constant number of operatons and whch run for ether O(n) or O(m) teratons, for a total runtme of O(n + m). If we do want the soluton to do what we says t does (the unblocked verson of the evaluaton functon), we also need to keep track of a symbol s closest copy that we have seen so far, and every 13

14 tme we see an nverse, we must trace ths lst and potentally update every copy. We do ths n Algorthm 2. c here stores the ndex of the closest copy of b s symbol whch s <, or 0 f no such copy s known. However, a gven c poston may only be updated n ths manner once, and snce there are only O(m) c s, ths does not ncrease the overall tme complexty of the algorthm beyond O(m + n). The poston need only update once because an nverse whch s even farther to the rght of the frst match found wll be farther away, so we can stop tracng the c s as soon as a closer match s found (lnes 20 21). To see why ths varable tme spent does not result n an asymptotc tme ncrease, vsualze each poston holdng a sngle counter whch s only consumed f t s updated va a trace (lnes of the algorthm). Some counters may be consumed and others may not, but there are only O(m) counters total. Whle t s true that the trace wll run across one redundant element (the frst one whch s too far away to update), we can add ths constant cost as part of the total loop cost (the loop from lnes 6 21). Algorthm 2: Unblocked evaluaton functon Input: A brad B B n consstng of m symbols b 1,...,b m Output: The sum of the dstances from each b to ts closest nverse UnblockedEvaluaton(B) (1) foreach b B (2) v (m ) (3) c 0 (4) foreach σ j B n (5) s,j 0 (6) for = 1 to m (7) (j,k) Lookup(b ) (8) s j,k (9) z s j, k (10) f z 0 (11) v = z (12) f z < z v z (13) v z (14) z c z (15) whle z 0 (16) v z (17) f z < z v z (18) v z (19) z c z (20) else (21) z 0 (22) y 0 (23) for = 1 to n (24) y y + v (25) return y Rather than run the entrety of one of the evaluaton functons every tme we perform a local update, t s temptng to do only a mnmal update of the tuples they mantan. To do ths, we wll need to store more nformaton: backward as well as forward lnks. Ths nvolves mantanng 14

15 a sorted lst, whch n practce wll probably be more trouble than t s worth, so we wll not pursue ths dea further. 4.1 Performance The algorthm appears to do well. The normal form of the earler depcted example of σ 1 σ2 σ 3σ1 s reduced to ts orgnal form. The quadratc blowup example of σ 1 σ2 s reduced to 4 symbols, or the optmal 2 f the optmzaton functon s sutably tweaked (wthout compromsng the other results). Some expermentaton was done wth attemptng to make the evaluaton functon nonlnear n the dstance of the closest accessble nverse, wth negatve results. The followng are statstcs regardng the length of random elements of the form a b where a,b B 6 +. The BKL values have been doubled to represent the approxmate number of bts taken up. Intal Normal Artn Blocked Unblocked Normal BKL As expected, the blocked verson usually outperforms the unblocked verson. However, the compresson algorthm typcally does not do as well as normalzed BKL. Therefore, t seems worth mplementng our algorthm for BKL. Essentally the same evaluaton procedure can be used and the local search procedure needs only a few modfcatons. However, wth BKL s quadratcally larger number of generators, there wll be far fewer collsons. Stll, BKL s second defnng relaton allows the transformaton of one generator nto another, whch could allow more nverses to be created. I wll probably follow up on ths n the comng weeks for curosty s sake. We should menton one last pont whch partally undermnes the value of ths work. Recall that the Artn normal form of a brad wll be of the form k n b where b B+ n. Ths means that f we know n, we can encode the brad smply by encodng (k,b) where b s a strng on [1,n 1]. Ths wll only take up log(k) + b log(n) bts, whch s sgnfcantly shorter than the lengths gven above. However, for the compresson procedure to work, t wll have to destroy the regular form of k n, so we can t encode the brad as effcently. Stll, the modfed form mght stll be helpful for makng other operatons (whch can t take advantage of the form of k n) more effcent. 5 Acknowledgements Davd Koop and Sarah Knoop (no relaton) both provded nvaluable edtoral assstance. In partcular, Dave suggested brad groups as a topc of study and provded several sgnfcant nsghts nto ther workngs. I would also lke to thank Ngel Boston, who provded some ntal gudance, and wthout whose appled algebra class ths paper would not be wrtten. References [1] Irs Anshel, Mchael Anshel, Benj Fsher, Doran Goldfeld. New Key Agreement Protocols n Brad Group Cryptography. CT-RSA 2001, [2] E. Artn. Theory of Brads. The Annals of Mathematcs, 2nd Ser., Vol. 48, No. 1 (Jan., 1947),

16 [3] J. Brman, K.H. Ko, and S.J. Lee. A New Approach to the Word Problem n the Brad Groups. Advances n Math., (1998), [4] Patrck Dehornoy. Brad-based cryptography. Contemporary Mathematcs, 360 (2004) [5] Whtfeld Dffe and Martn E. Hellman. New Drectons n Cryptography. IEEE Transactons on Informaton Theory, Vol. 22, No. 6 (Nov., 1976), [6] James H. Ells. The Hstory of Non-Secret Encrypton. Manuscrpt, currently avalable at [7] G. A. Garsde. The Brad Group and Other Groups. Quart. J. Math. Oxford (1969), [8] K.H. Ko, S.J. Lee, J.H. Cheon, J.W. Han, J.S.Kang, and C. Park. New Publc-Key Cryptosystem Usng Brad Groups. Crypto 2000, Sprnger Lect. Notes n Comput. Sc., 1880 (2000), [9] M. S. Paterson and A. A. Razborov. The Set of Mnmal Brads Is Co-NP-complete. Journal of Algorthms, Vol. 12 (1991), [10] Ronald Rvest, Ad Shamr, and Leonard Adleman. A Method for Obtanng Dgtal Sgnatures and Publc-Key Cryptosystems. Communcatons of the ACM, Vol. 21, No. 2, 1978, [11] Vladmr Shplran and Alexander Ushakov. The Conjugacy Search Problem n Publc Key Cryptography: Unnecessary and Insuffcent. Preprnt, currently avalable at shpl/csp.pdf. [12] Luca Trevsan. Inapproxmablty of Combnatoral Optmzaton Problems. Preprnt, currently avalable at luca/pubs/napprox.pdf. 16