Commutative operads have been proposed as a platform for public-key cryptography, with protocols for key agreement, key exchange, encryption and authentication, together with a masking technique and families of algebras with secret parameters intended to strengthen them. We show that breaking key agreement, key exchange and encryption reduces to two problems over the centralizer of the public operations: an interpolation problem for key agreement and a division problem for the other two. Neither problem requires recovering a secret, and the set from which secrets are drawn plays no role in these attacks. For the operad platforms in the two original papers (fields, the integers, residue rings, the tropical semiring with finite entries, convexors and the masked tropical algebras), the relevant problems can be solved in polynomial time in the input models specified here, and masking does not affect these attacks. The authentication protocol fails for a more elementary reason: as originally stated it does not bind the prover to any public key, and even with a registered public key the response expected by the verifier can be computed from public data. In the masked variant, verification requires the secret mask; on the concrete string platforms, one observed session with an invertible challenge entry suffices for forgery. We also observe that one of the auxiliary constructions satisfies the algebra axioms only in a degenerate case, although the corresponding protocol remains correct. The attacks are implemented and verified on random instances of representative platforms.

翻译：暂无翻译