Charles, Goren, and Lauter [J. Cryptology 22(1), 2009] explained how one can construct hash functions using expander graphs in which it is hard to find paths between specified vertices. The set of solutions to the classical Markoff equation $X^2+Y^2+Z^2=XYZ$ in a finite field $\mathbb{F}_q$ has a natural structure as a tri-partite graph using three non-commuting polynomial automorphisms to connect the points. These graphs conjecturally form an expander family, and Fuchs, Lauter, Litman, and Tran [Mathematical Cryptology 1(1), 2022] suggest using this family of Markoff graphs in the CGL construction. In this note we show that in both a theoretical and a practical sense, assuming two randomness hypotheses, the path problem in a Markoff graph over $\mathbb{F}_q$ can be solved in subexponential time, and is more-or-less equivalent in difficulty to factoring $q-1$ and solving three discrete logarithm problem in $\mathbb{F}_q^*$.

翻译：Charles, Goren, 和 Lauter [J. Cocryptology 22(1), 2009] 解释了如何使用扩张式图表构建散列函数, 在其中很难找到指定脊椎之间的路径。 经典马克夫方程式的一套解决方案 $X2+Y2 ⁇ 2=XYZ$, 在有限的字段中 $\mathbb{F ⁇ q$ 中, 将自然结构作为三部分图, 使用三种非对称的多元自制式图形连接点。 这些图形可以预测地形成一个扩张型家族, Fuchs, Lauter, Litman, 和 Tran [数学密码学 1(1), 2022] 提议在 CGL 构造中使用马克夫方程式的这一组。 在本说明中, 我们从理论上和实用的角度显示, 假设两个随机性假称, $\math{F ⁇ qqqqq$, 上的马克式图形路径问题可以在子解解时间中解决。 这些图的路径问题可以比 $- f_Q_Q_Q_Q_Q_ 解问题更不相等。