{"id":"dc85652d-4bc4-418b-8ecd-b6d5bc280674","arxiv_id":"1908.03504","paper_version":2,"verdict":"REJECT","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":1,"one_line_summary":"The paper introduces public-key and symmetric-key cryptosystems whose key is the distorted word length of iterated pseudo-Anosov maps, but the concrete instantiations are insecure because the reachable key space is minuscule.","lead":"Two new cryptographic schemes are proposed using the Thurston norm on hyperbolic 3-manifolds, where the shared key is an exponentially large word length of a pseudo-Anosov map iterated on fiber generators. The mathematical machinery is sound, but the concrete schemes have a tiny effective key space and rely on security through the obscurity of a choice from a public database.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Explicit f in Section 4.2 maps g to a class depending only on |g|, so the reachable fibered classes are as numerous as possible word lengths, giving an enumeration attack.","rationale":"The reader's weakest assumption identifies the same mechanism: the explicit map f in Section 4.2 depends only on |g|, so the reachable set of fibered cohomology classes is limited by the possible word lengths rather than by the full set of AAG secrets. This is not a mere implementation detail; it is the step connecting the public-key exchange to the supposed Thurston-norm security layer. The general protocol in Section 3 assumes an efficiently computable f with a large image, but the concrete f fails to provide one, and the statement that many other suitable candidates exist is not a construction. The attack is concrete: an eavesdropper can enumerate the small image of f, use the public transcript to identify the true phi, and then compute the key since N and Psi_phi are public or recoverable. This fully supports the reader's REJECT verdict. My stress-test confirms the central claim is not supported by the proposed instantiation, so the reader's verdict should remain unchanged.","tokens_in":950,"tokens_out":1085,"duration_ms":134805,"concrete_test":"Instantiate the scheme with a specific AAG platform, for example braid group B_n with a fixed normal form, and fix Alice/Bob parameters. Compute the maximum possible normal-form length L of the shared secret g for those parameters, then evaluate f(g) for all lengths 1..L. Since f depends only on length, the number of distinct fibered classes phi is at most ceil(L/2); compare this count with 2^lambda for the intended security level. Then simulate an eavesdropper: collect Alice's transmitted set {x_i}, recover N from word lengths, and for each distinct phi compute Psi_phi^N on the fiber generators and check whether the results appear among {x_i}. If a unique phi is found in polynomial time in L and the protocol parameters, the scheme is broken. If a claimed improved f yields at least 2^lambda distinct classes and no transcript reveals phi, the concern would be answered.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing gap is that the only explicit construction of the public map f collapses the AAG shared secret to a single integer. In Section 4.2, f(g) is defined from the normal-form length |g| alone; indeed, f(g) is determined by an integer m=|g|, giving a cohomology class with coordinates depending only on m. Therefore f(g1)=f(g2) whenever |g1|=|g2|, so the fibered class shared by Alice and Bob is chosen from a set of size at most the number of possible normal-form lengths of AAG secrets, not the number of possible secrets. In any efficient instantiation this length is polynomial in the security parameter, so the class carries only logarithmic entropy. An adversary need not break AAG: she can enumerate the reachable lengths (or the public database entries in the image of f), recover N from Alice's transmitted words by testing membership in each candidate fiber subgroup using the linear-time algorithm of Proposition 1, and then compute Psi_phi^N on the fiber generators since Psi_phi is public data. The true phi and N are thereby identified, allowing the shared key l_max to be computed directly. The general scheme in Section 3 assumes an f with a large reachable set, but no such f is constructed; the remark that many other suitable candidates exist is not a construction. This breaks the central claim of providing viable cryptographic schemes.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes two cryptographic schemes based on the Thurston norm on the first cohomology of fibered hyperbolic 3-manifolds. In the public-key scheme, Alice and Bob first run an Anshel-Anshel-Goldfeld (AAG) exchange to agree on a secret element g of a finitely generated group G. A public map f sends g to a primitive integral cohomology class φ=f(g) in the cone over a fixed fibered face F of the Thurston norm ball of a fibered hyperbolic manifold M. The public data include, for every adopted class φ, a presentation of the fiber subgroup π1(S_φ), the stable letter, and the automorphism ψ_φ. Alice chooses an integer N, applies ψ_φ^N to the generators of π1(S_φ), and transmits the resulting words in π1(M) mixed with decoys. Bob determines which transmitted words lie in π1(S_φ) using the linear-time membership test from Proposition 1, recovers N, and both parties compute the shared key ℓ_max, the maximal length of ψ_φ^N on the generators, which grows like λ_φ^N. Section 5 gives a symmetric-key variant in which φ itself is the pre-shared secret. The paper illustrates the construction with the thrice-punctured disk and the pseudo-Anosov braid σ1σ2^{-1}, using McMullen's Teichmüller polynomial to compute stretch factors.","tokens_in":10214,"tokens_out":10264,"duration_ms":103170,"significance":"The mathematical background in the paper is standard and is presented accurately: the Thurston norm, fibered faces, the linear-time membership test for fiber subgroups, and the use of the Teichmüller polynomial to obtain exponential growth rates are all correctly cited and explained. If a secure instantiation existed, the idea of deriving a large key from a small transmitted integer via exponential distortion would be a nice application of 3-manifold topology to group-based cryptography. The concrete example with the simplest pseudo-Anosov braid is clearly written. However, the cryptographic claims are not supported. The only explicit construction of f has a tiny image, so the public-key scheme reduces to hiding one of very few fibered classes; the security analysis in Section 6 is essentially an appeal to a large public database, i.e., security through obscurity. The symmetric-key variant is described only informally. The paper therefore does not establish viable cryptographic schemes, despite containing correct mathematics.","major_comments":[{"comment":"The map f defined in Section 4.2, namely f(g)=D(g)(1/2, |g|/(|g|+1)-1/2), depends on g only through the normal-form length |g|. Consequently, two AAG secrets with the same normal-form length produce exactly the same cohomology class, so the number of reachable fibered classes is at most the number of possible normal-form lengths. For any efficient instantiation of the AAG platform, this length range is polynomial in the security parameter, giving the chosen fibered class only logarithmic entropy. Since the public database contains, for each primitive integral class in the truncated cone, a presentation of the fiber subgroup and the automorphism ψ_φ, an adversary can enumerate the possible lengths (or the image of f in the database), determine which fiber subgroup contains the elements Alice transmits by the linear-time membership test of Proposition 1, and then recover N and compute ℓ_max directly. This invalidates the claims in Section 4.4 and Section 6 that the secrecy of the scheme lies entirely in the choice of fibration. The remark that 'there are many other suitable candidates for f' is not a construction of a map with a large image and cannot repair the explicit scheme.","section":"Section 4.2"},{"comment":"The security analysis does not rest on a well-defined computational hardness assumption. The paper acknowledges that an eavesdropper can scan the public database of fibered classes and test the transmitted words for membership in each candidate fiber subgroup, and it proposes only that the database be made 'very large compared to the size of the key' so that the key is obsolete before the search finishes. Because the database is public and membership testing is linear time (Proposition 1), the adversary's running time is essentially the database size times the length of the transmission; no concrete parameters are supplied. This is a form of security through obscurity, not a reduction to a hard problem. Moreover, the statement that ℓ_max is 'exponentially longer than N and therefore much more difficult to guess' confuses key size with computational hardness: once φ and N are known, ℓ_max is computed in polynomial time from the public automorphism ψ_φ.","section":"Section 6"},{"comment":"The symmetric-key scheme is not a complete cryptosystem. It assumes Alice and Bob have already agreed on a private fibered cohomology class φ, but it does not specify how φ is generated, represented, or exchanged, nor how ψ_φ is obtained for an arbitrary φ. Alice transmits N in the clear, and the shared key ℓ_max is a deterministic function of (φ,N); the security therefore reduces entirely to the secrecy of φ. No analysis is given of the entropy of φ or of the cost to an adversary of enumerating likely φ values from the public manifold data. Without a concrete distribution on φ and a lower bound on its entropy, the scheme cannot be evaluated as a cryptographic proposal.","section":"Section 5"}],"minor_comments":[{"comment":"In the paragraph beginning 'Later on', 'right-angled Artin groups as a latform' should read 'as a platform'.","section":"Section 1"},{"comment":"The phrase 'incompresible torus' should be 'incompressible torus'.","section":"Section 2.1"},{"comment":"The reported root k ≈ 1.72208 for the class (2,1) is quoted from a numerical calculation without specifying the method or the precision; a reproducible computation or additional digits would help the reader verify the example.","section":"Section 4.4"},{"comment":"The denominator cutoff 'say 10^12' for the public database is arbitrary, and the database size and the sampling distribution over it are not specified; these choices are directly relevant to the exhaustive-search attack discussed in Section 6.","section":"Section 3"},{"comment":"The paper should state the intended adversarial model and security notion (for example, indistinguishability under chosen plaintext attack) and give concrete parameter sizes, rather than relying on qualitative statements such as 'the key is exponentially longer than N'.","section":"Section 6"}],"recommendation":"reject","confidential_remarks":"The mathematics in the background sections is sound and the presentation of the Thurston norm and Teichmüller polynomial material is competent, but the cryptographic construction fails at its only explicit instantiation: the public map f collapses the AAG shared secret to its length, and the security analysis is essentially an appeal to the size of a public database. Repairing this would require constructing a new family of maps with large image and a formal security reduction, which is substantial new work beyond the scope of the current manuscript. I therefore recommend rejection, though the paper could perhaps be revised into a purely mathematical note on exponential distortion of fiber subgroups in fibered hyperbolic 3-manifolds."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear Colleague,\n\nRead the Flores–Kahrobaei–Koberda paper. The geometric group theory is solid and the central idea is genuinely new: using the Thurston norm and Teichmüller polynomial to generate infinitely many fibered cohomology classes with different exponential distortion rates from one hyperbolic 3-manifold. The background on the Thurston norm, McMullen's polynomial, and the Aaber–Dunfield example is accurate, and Proposition 1's linear-time membership test is clean. As a piece of math, it's worth taking seriously.\n\nThe cryptosystems, though, don't work as claimed. The public-key scheme's explicit map f(g) in Section 4.2 uses only the normal-form length |g|, so the image has at most as many elements as there are possible word lengths—tiny, not exponential. An adversary can enumerate those lengths, or the entries in the public database, and for each candidate fiber use Proposition 1 to test Alice's transmitted words, recover N, and compute the shared key from the public automorphism. The paper's own security discussion (Section 6) concedes that an eavesdropper could check each presentation in the database; the proposed fix is to make the database so large that the key expires first. That is security through obscurity, not a cryptographic argument. The symmetric-key scheme has the same problem: the secret fiber is chosen from a finite public database, and the security rests on the cost of scanning it.\n\nA smaller but real gap is the protocol step where Bob recovers N from Alice's message; it's sketched rather than specified, though with decoys outside the fiber this looks fixable. The bigger issue is the key-space collapse and the lack of any construction of an f with large reachable set.\n\nNet: mathematically interesting, cryptographically not viable as written. I'd send it to peer review anyway—a good referee can spell out exactly why the construction fails to scale, and the Thurston-norm-as-organizing-principle idea deserves circulation. I wouldn't cite it for crypto, but I'd mention it in a survey of group-based attempts.\n\nRecommendation: accept for review with a crypto-savvy referee and expect the cryptographic claims to be rejected or heavily revised.","headline":"Sound Thurston-norm math and a novel organizing idea, but the explicit map collapses the key space and the security argument is database obscurity, so the crypto fails.","tokens_in":10700,"tokens_out":4451,"would_cite":false,"duration_ms":45499,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["57K31","57K32","20F65","94A60"],"pacs":[],"model":"deepseek-v4-flash","headline":"The Thurston norm of a hyperbolic 3-manifold can be used to build cryptoschemes whose shared key grows exponentially with a transmitted integer.","keywords":["Thurston norm","hyperbolic 3-manifolds","fibered cohomology classes","pseudo-Anosov mapping classes","subgroup distortion","Teichmüller polynomial","public-key cryptography","post-quantum cryptography"],"falsifier":"Enumerate the image of the explicit map $f(g)=D(g)(1/2, |g|/(|g|+1)-1/2)$ over all group elements with normal-form length at most $L$; since this $f$ depends only on $|g|$, the image has at most $L+1$ distinct classes, and an eavesdropper who checks each against Alice's public message could recover the key, showing that particular instantiation is not secure.","tokens_in":9724,"feed_emoji":"🔐","tokens_out":20456,"duration_ms":175151,"temperature":0.7,"pith_summary":"The paper proposes two cryptographic schemes, one public-key and one symmetric-key, built from the Thurston norm on the first cohomology of a fibered hyperbolic 3-manifold. The design goal is that a small transmitted integer $N$ expands into a shared key $\\ell_{\\max}$ of size roughly $\\lambda_\\varphi^N$, exploiting the exponential distortion of a fiber subgroup inside the manifold's fundamental group. The security claim rests on hiding the chosen fibered cohomology class: an eavesdropper who sees the public messages cannot compute the large key, while Alice and Bob recover it using linear-time membership tests and conjugation. The schemes are carried out explicitly for the mapping torus of the simplest pseudo-Anosov braid, with stretch factor $(3+\\sqrt{5})/2$ for the canonical class. The paper also argues that the same framework could be based on any exponentially distorted subgroup, with the Thurston norm providing many such subgroups from one manifold.","feed_headline":"One transmitted integer yields an exponentially larger key","feed_subtitle":"Cryptoschemes use the Thurston norm of hyperbolic 3-manifolds to grow a long key from a short message.","key_machinery":"The load-bearing object is the Thurston norm, the norm on $H^1(M,\\mathbb{R})$ whose unit ball has fibered faces; a fibered face is a top-dimensional face whose cone consists of primitive integral classes that are fibration classes. Each such class $\\varphi$ gives a semidirect product presentation $\\pi_1(M)=\\pi_1(S_\\varphi)\\rtimes \\mathbb{Z}$ with stable letter $t_\\varphi$ acting by a pseudo-Anosov automorphism $\\psi_\\varphi$. The mechanism that makes the scheme work is exponential distortion: for each generator $s$, the word length of $\\psi_\\varphi^N(s)$ in $\\pi_1(S_\\varphi)$ grows like $\\lambda_\\varphi^N$, while the conjugated word $t_\\varphi^{-N} s t_\\varphi^N$ in $\\pi_1(M)$ has length linear in $N$; membership in $\\pi_1(S_\\varphi)$ is decidable in linear time by evaluating $\\varphi$. The Teichmüller polynomial of the fibered face supplies the stretch factors $\\lambda_\\varphi$, making the key growth rate computable in practice.","core_discovery":"The paper's central claim is that the Thurston norm on $H^1(M,\\mathbb{R})$ of a fibered hyperbolic 3-manifold organizes the manifold's fibrations into fibered faces, and that each primitive class $\\varphi$ in the cone over a fibered face determines a fiber subgroup $\\pi_1(S_\\varphi)$ that is exponentially distorted inside $\\pi_1(M)$. Acting by the associated pseudo-Anosov automorphism $\\psi_\\varphi$ for $N$ steps raises word lengths by the stretch factor $\\lambda_\\varphi$, so the quantity $\\ell_{\\max}=\\max_s |\\psi_\\varphi^N(s)|$ is on the order of $\\lambda_\\varphi^N$, while the transmitted data need only be linearly long in $N$. The paper builds a public-key scheme in which Alice and Bob first agree on the class $\\varphi$ with a group-based key exchange, and a symmetric-key scheme in which $\\varphi$ itself is the shared secret; in both cases the public channel carries only $N$ and a set of words in $\\pi_1(M)$, and Bob recovers $\\ell_{\\max}$ by checking membership in the fiber subgroup and conjugating by the stable letter. For the explicit example coming from the simplest pseudo-Anosov braid on the thrice-punctured disk, the Teichmüller polynomial gives $\\lambda_\\varphi=(3+\\sqrt{5})/2$ for the canonical class and about $1.72208$ for the class $(2,1)$, exhibiting the exponential growth in concrete numbers.","pith_inferences":["The security of the proposed public-key scheme hinges on how large the image of the public class-selection map $f$ is; testing the explicit $f$ of Section 4.2 on all normal forms up to length $L$ is a concrete way to estimate whether an eavesdropper can enumerate the possible fibered classes.","One could precompute the stretch factor $\\lambda_\\varphi$ across a fibered face and use it as a key-rate map, letting Alice and Bob pick $\\varphi$ to engineer a target key size for a given $N$.","The exponential-distortion construction generalizes to any pair of groups with a known distorted subgroup, so the same protocol template could be instantiated with groups whose distortion functions are polynomial rather than exponential, trading security for speed."],"forward_implications":["Alice and Bob can agree on a key of size roughly $\\lambda_\\varphi^N$ while sending only $O(N)$ public data, so the shared secret is exponentially larger than the transmitted message.","The same hyperbolic 3-manifold yields infinitely many distinct exponentially distorted fiber subgroups with different stretch factors, so the scheme can be re-keyed by moving through the fibered face.","In the symmetric-key version, observing $N$ and the public manifold is insufficient to recover $\\ell_{\\max}$ without knowing the private fibered cohomology class and its automorphism.","Because membership in the fiber subgroup is linear-time and conjugation is length-linear, both the sender's and receiver's computations stay efficient in $N$.","The construction transfers to any pair of a finitely generated group and an exponentially distorted subgroup, and in particular to free-by-cyclic groups with their associated stretch-factor polynomials."],"supporting_citations":[{"why":"Introduces the Thurston norm and the fibered-face structure that organizes the cohomology classes used to select the secret fibration.","marker":"[36]"},{"why":"Provides the Teichmüller polynomial, an algorithm for computing it, and the explicit simplest pseudo-Anosov braid example that anchors Section 4.","marker":"[31]"},{"why":"Supplies the background on pseudo-Anosov word growth used to prove the exponential distortion of the fiber subgroup in Proposition 1.","marker":"[17]"},{"why":"Gives the group-based key-exchange protocol used to produce the shared group element $g$ in the public-key scheme.","marker":"[3]"},{"why":"Introduces cryptosystems based on subgroup distortion, the security premise the present schemes build on.","marker":"[13]"}],"fun_headline_variants":["Thurston norm fuels exponential key growth","Hyperbolic 3-manifolds yield exponential keys","Short message, exponential key: Thurston norm","Cryptography from fibered hyperbolic manifolds","Thurston norm doubles as key expander"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the public rule for choosing a fibration can reach a large enough set of genuinely different fibered cohomology classes that an eavesdropper cannot simply search the public data and identify the private class.","fun_headline_variants_meta":{"raw":{"variants":["Thurston norm fuels exponential key growth","Hyperbolic 3-manifolds yield exponential keys","Short message, exponential key: Thurston norm","Cryptography from fibered hyperbolic manifolds","Thurston norm doubles as key expander"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000174,"raw_usage":{"total_tokens":1244,"prompt_tokens":871,"completion_tokens":373,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":487,"completion_tokens_details":{"reasoning_tokens":303}},"tokens_in":487,"tokens_out":373,"duration_ms":3758,"temperature":1.0,"reasoning_tokens":303,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T14:11:18.823085+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Enumerate the image of the explicit map $f(g)=D(g)(1/2, |g|/(|g|+1)-1/2)$ over all group elements with normal-form length at most $L$; since this $f$ depends only on $|g|$, the image has at most $L+1$ distinct classes, and an eavesdropper who checks each against Alice's public message could recover the key, showing that particular instantiation is not secure.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces the Thurston norm and the fibered-face structure that organizes the cohomology classes used to select the secret fibration."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the Teichmüller polynomial, an algorithm for computing it, and the explicit simplest pseudo-Anosov braid example that anchors Section 4."},{"cited_title":"Fathi, F","cited_arxiv_id":null,"evidence_quote":"Supplies the background on pseudo-Anosov word growth used to prove the exponential distortion of the fiber subgroup in Proposition 1."},{"cited_title":"Anshel and M","cited_arxiv_id":null,"evidence_quote":"Gives the group-based key-exchange protocol used to produce the shared group element $g$ in the public-key scheme."},{"cited_title":"Chatterji, D","cited_arxiv_id":null,"evidence_quote":"Introduces cryptosystems based on subgroup distortion, the security premise the present schemes build on."}],"review_version":1}