Mikhail Anokhin

# Constructing a pseudo-free family of finite computational groups under the general integer factoring intractability assumption

De Gruyter | Published online: October 15, 2019

# Abstract

We provide a correct version of Remark 3.5 of the paper mentioned in the title. Also, we fix a typo in Remark 4.4 of that paper.

In [1, Remark 3.5], we construct (under certain additional assumptions) a collision-intractable hash function family from a pseudo-free family of finite computational groups in a nontrivial variety of groups. However, that construction is incorrect. Moreover, the following assumption made in [1, Remark 3.5] is redundant: For each d supp 𝒟 k ( k K ), ρ d is one-to-one.

Until now, to the best of our knowledge, there are no works using Remark 3.5 of [1] in the proofs. Therefore the error in that remark has not yet affected the validity of other results.

Here is a correct version of Remark 3.5 of [1]. In this version, we construct a collision-intractable hash function family in a slightly more general sense than in the original version.

# Remark 3.5.

Assume that the family of computational groups ( ( G d , ρ d , d ) | d D ) is pseudo-free in 𝔙 with respect to 𝒟 and σ. In this remark, we need the following additional assumptions:

• The variety 𝔙 is nontrivial (as in Remark 3.4).

• There exists a deterministic polynomial-time algorithm that, given integers b 1 , , b m { 0 , 1 } , computes [ a 1 b 1 a m b m ] σ (as in Remark 3.4).

• There exists a polynomial η such that dom ρ d { 0 , 1 } η ( k ) for all k K and d supp 𝒟 k .

Let π be a polynomial such that π ( k ) > η ( k ) for any k K . Suppose k K . Denote by W k the set of all pairs ( d , ( r 1 , , r π ( k ) ) ) such that d supp 𝒟 k and r 1 , , r π ( k ) dom ρ d . For every w W k , let ψ k , w be a mapping defined as in Remark 3.4. Moreover, we choose these mappings so that, given ( 1 k , w ) (where w W k ) and y { 0 , 1 } π ( k ) , ψ k , w ( y ) can be computed in deterministic polynomial time. Also, suppose 𝒲 k is the distribution of the random variable ( 𝐝 , ( 𝐫 1 , , 𝐫 π ( k ) ) ) , where 𝐝 𝒟 k and 𝐫 1 , , 𝐫 π ( k ) 𝐝 . Of course, the probability ensemble ( 𝒲 k | k K ) is polynomial-time samplable. Then Remark 3.4 implies that the family ( ψ k , w | k K , w W k ) is a collision-intractable (or collision-resistant) hash function family with respect to ( 𝒲 k | k K ) . Namely, the following conditions hold:

• For all k K and w W k , ψ k , w maps { 0 , 1 } π ( k ) into { 0 , 1 } η ( k ) , where π ( k ) > η ( k ) .

• Given ( 1 k , w ) (where k K and w W k ) and y { 0 , 1 } π ( k ) , ψ k , w ( y ) can be computed in deterministic polynomial time.

• If 𝐰 𝒲 k , then for any probabilistic polynomial-time algorithm A,

Pr ( A ( 1 k , 𝐰 )  is a collision for  ψ k , 𝐰 )

is negligible as a function of k K .

In fact, this remark (as well as [1, Remarks 3.4 and 3.6]) holds even if the family ( ( G d , ρ d , d ) | d D ) is weakly pseudo-free in 𝔙 with respect to 𝒟 and σ. The definition of weak pseudo-freeness can be obtained from the definition of pseudo-freeness by requiring the equations to be variable-free.

Also, in [1, Remark 4.4],

( F 2 κ ( e ) / H 1 κ ( e ) , e , ρ 1 κ ( e ) , e , 1 κ ( e ) | e E )

should be understood as

( ( F 2 κ ( e ) / H 1 κ ( e ) , e , ρ 1 κ ( e ) , e , 1 κ ( e ) ) | e E ) .

### References

[1] M. Anokhin, Constructing a pseudo-free family of finite computational groups under the general integer factoring intractability assumption, Groups Complex. Cryptol. 5 (2013), no. 1, 53–74. Search in Google Scholar