Pith. sign in

REVIEW 3 major objections 5 minor 38 references

A cryptographic application of the Thurston norm

T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The Thurston norm of a hyperbolic 3-manifold can be used to build cryptoschemes whose shared key grows exponentially with a transmitted integer.

desk verdict Sound Thurston-norm math and a novel organizing idea, but the explicit map collapses the key space and the security argument is database obscurity, so the crypto fails. read the letter →

arxiv 1908.03504 v2 pith:SCRS3MCB submitted 2019-08-09 math.GT math.ATmath.GR

Ramon Flores , Delaram Kahrobaei , Thomas Koberda This is my paper · ORCID
classification math.GTmath.ATmath.GR MSC 57K3157K3220F6594A60
keywords Thurstonnormhyperbolic3-manifoldsfiberedcohomologyclassespseudo-AnosovmappingsubgroupdistortionTeichmüllerpolynomialpublic-keycryptographypost-quantum
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes two cryptographic schemes, one public-key and one symmetric-key, built from the Thurston norm on the first cohomology of a fibered hyperbolic 3-manifold. The design goal is that a small transmitted integer $N$ expands into a shared key $\ell_{\max}$ of size roughly $\lambda_\varphi^N$, exploiting the exponential distortion of a fiber subgroup inside the manifold's fundamental group. The security claim rests on hiding the chosen fibered cohomology class: an eavesdropper who sees the public messages cannot compute the large key, while Alice and Bob recover it using linear-time membership tests and conjugation. The schemes are carried out explicitly for the mapping torus of the simplest pseudo-Anosov braid, with stretch factor $(3+\sqrt{5})/2$ for the canonical class. The paper also argues that the same framework could be based on any exponentially distorted subgroup, with the Thurston norm providing many such subgroups from one manifold.

What carries the argument

The load-bearing object is the Thurston norm, the norm on $H^1(M,\mathbb{R})$ whose unit ball has fibered faces; a fibered face is a top-dimensional face whose cone consists of primitive integral classes that are fibration classes. Each such class $\varphi$ gives a semidirect product presentation $\pi_1(M)=\pi_1(S_\varphi)\rtimes \mathbb{Z}$ with stable letter $t_\varphi$ acting by a pseudo-Anosov automorphism $\psi_\varphi$. The mechanism that makes the scheme work is exponential distortion: for each generator $s$, the word length of $\psi_\varphi^N(s)$ in $\pi_1(S_\varphi)$ grows like $\lambda_\varphi^N$, while the conjugated word $t_\varphi^{-N} s t_\varphi^N$ in $\pi_1(M)$ has length linear in $N$; membership in $\pi_1(S_\varphi)$ is decidable in linear time by evaluating $\varphi$. The Teichmüller polynomial of the fibered face supplies the stretch factors $\lambda_\varphi$, making the key growth rate computable in practice.

What would settle it

Enumerate the image of the explicit map $f(g)=D(g)(1/2, |g|/(|g|+1)-1/2)$ over all group elements with normal-form length at most $L$; since this $f$ depends only on $|g|$, the image has at most $L+1$ distinct classes, and an eavesdropper who checks each against Alice's public message could recover the key, showing that particular instantiation is not secure.

Watch

Extended reading notes

Core claim

The paper's central claim is that the Thurston norm on $H^1(M,\mathbb{R})$ of a fibered hyperbolic 3-manifold organizes the manifold's fibrations into fibered faces, and that each primitive class $\varphi$ in the cone over a fibered face determines a fiber subgroup $\pi_1(S_\varphi)$ that is exponentially distorted inside $\pi_1(M)$. Acting by the associated pseudo-Anosov automorphism $\psi_\varphi$ for $N$ steps raises word lengths by the stretch factor $\lambda_\varphi$, so the quantity $\ell_{\max}=\max_s |\psi_\varphi^N(s)|$ is on the order of $\lambda_\varphi^N$, while the transmitted data need only be linearly long in $N$. The paper builds a public-key scheme in which Alice and Bob first agree on the class $\varphi$ with a group-based key exchange, and a symmetric-key scheme in which $\varphi$ itself is the shared secret; in both cases the public channel carries only $N$ and a set of words in $\pi_1(M)$, and Bob recovers $\ell_{\max}$ by checking membership in the fiber subgroup and conjugating by the stable letter. For the explicit example coming from the simplest pseudo-Anosov braid on the thrice-punctured disk, the Teichmüller polynomial gives $\lambda_\varphi=(3+\sqrt{5})/2$ for the canonical class and about $1.72208$ for the class $(2,1)$, exhibiting the exponential growth in concrete numbers.

Load-bearing premise

The load-bearing premise is that the public rule for choosing a fibration can reach a large enough set of genuinely different fibered cohomology classes that an eavesdropper cannot simply search the public data and identify the private class.

Editorial extensions

If this is right

  • Alice and Bob can agree on a key of size roughly $\lambda_\varphi^N$ while sending only $O(N)$ public data, so the shared secret is exponentially larger than the transmitted message.
  • The same hyperbolic 3-manifold yields infinitely many distinct exponentially distorted fiber subgroups with different stretch factors, so the scheme can be re-keyed by moving through the fibered face.
  • In the symmetric-key version, observing $N$ and the public manifold is insufficient to recover $\ell_{\max}$ without knowing the private fibered cohomology class and its automorphism.
  • Because membership in the fiber subgroup is linear-time and conjugation is length-linear, both the sender's and receiver's computations stay efficient in $N$.
  • The construction transfers to any pair of a finitely generated group and an exponentially distorted subgroup, and in particular to free-by-cyclic groups with their associated stretch-factor polynomials.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The security of the proposed public-key scheme hinges on how large the image of the public class-selection map $f$ is; testing the explicit $f$ of Section 4.2 on all normal forms up to length $L$ is a concrete way to estimate whether an eavesdropper can enumerate the possible fibered classes.
  • One could precompute the stretch factor $\lambda_\varphi$ across a fibered face and use it as a key-rate map, letting Alice and Bob pick $\varphi$ to engineer a target key size for a given $N$.
  • The exponential-distortion construction generalizes to any pair of groups with a known distorted subgroup, so the same protocol template could be instantiated with groups whose distortion functions are polynomial rather than exponential, trading security for speed.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes two cryptographic schemes based on the Thurston norm on the first cohomology of fibered hyperbolic 3-manifolds. In the public-key scheme, Alice and Bob first run an Anshel-Anshel-Goldfeld (AAG) exchange to agree on a secret element g of a finitely generated group G. A public map f sends g to a primitive integral cohomology class φ=f(g) in the cone over a fixed fibered face F of the Thurston norm ball of a fibered hyperbolic manifold M. The public data include, for every adopted class φ, a presentation of the fiber subgroup π1(S_φ), the stable letter, and the automorphism ψ_φ. Alice chooses an integer N, applies ψ_φ^N to the generators of π1(S_φ), and transmits the resulting words in π1(M) mixed with decoys. Bob determines which transmitted words lie in π1(S_φ) using the linear-time membership test from Proposition 1, recovers N, and both parties compute the shared key ℓ_max, the maximal length of ψ_φ^N on the generators, which grows like λ_φ^N. Section 5 gives a symmetric-key variant in which φ itself is the pre-shared secret. The paper illustrates the construction with the thrice-punctured disk and the pseudo-Anosov braid σ1σ2^{-1}, using McMullen's Teichmüller polynomial to compute stretch factors.

Significance. The mathematical background in the paper is standard and is presented accurately: the Thurston norm, fibered faces, the linear-time membership test for fiber subgroups, and the use of the Teichmüller polynomial to obtain exponential growth rates are all correctly cited and explained. If a secure instantiation existed, the idea of deriving a large key from a small transmitted integer via exponential distortion would be a nice application of 3-manifold topology to group-based cryptography. The concrete example with the simplest pseudo-Anosov braid is clearly written. However, the cryptographic claims are not supported. The only explicit construction of f has a tiny image, so the public-key scheme reduces to hiding one of very few fibered classes; the security analysis in Section 6 is essentially an appeal to a large public database, i.e., security through obscurity. The symmetric-key variant is described only informally. The paper therefore does not establish viable cryptographic schemes, despite containing correct mathematics.

major comments (3)
  1. [Section 4.2] The map f defined in Section 4.2, namely f(g)=D(g)(1/2, |g|/(|g|+1)-1/2), depends on g only through the normal-form length |g|. Consequently, two AAG secrets with the same normal-form length produce exactly the same cohomology class, so the number of reachable fibered classes is at most the number of possible normal-form lengths. For any efficient instantiation of the AAG platform, this length range is polynomial in the security parameter, giving the chosen fibered class only logarithmic entropy. Since the public database contains, for each primitive integral class in the truncated cone, a presentation of the fiber subgroup and the automorphism ψ_φ, an adversary can enumerate the possible lengths (or the image of f in the database), determine which fiber subgroup contains the elements Alice transmits by the linear-time membership test of Proposition 1, and then recover N and compute ℓ_max directly. This invalidates the claims in Section 4.4 and Section 6 that the secrecy of the scheme lies entirely in the choice of fibration. The remark that 'there are many other suitable candidates for f' is not a construction of a map with a large image and cannot repair the explicit scheme.
  2. [Section 6] The security analysis does not rest on a well-defined computational hardness assumption. The paper acknowledges that an eavesdropper can scan the public database of fibered classes and test the transmitted words for membership in each candidate fiber subgroup, and it proposes only that the database be made 'very large compared to the size of the key' so that the key is obsolete before the search finishes. Because the database is public and membership testing is linear time (Proposition 1), the adversary's running time is essentially the database size times the length of the transmission; no concrete parameters are supplied. This is a form of security through obscurity, not a reduction to a hard problem. Moreover, the statement that ℓ_max is 'exponentially longer than N and therefore much more difficult to guess' confuses key size with computational hardness: once φ and N are known, ℓ_max is computed in polynomial time from the public automorphism ψ_φ.
  3. [Section 5] The symmetric-key scheme is not a complete cryptosystem. It assumes Alice and Bob have already agreed on a private fibered cohomology class φ, but it does not specify how φ is generated, represented, or exchanged, nor how ψ_φ is obtained for an arbitrary φ. Alice transmits N in the clear, and the shared key ℓ_max is a deterministic function of (φ,N); the security therefore reduces entirely to the secrecy of φ. No analysis is given of the entropy of φ or of the cost to an adversary of enumerating likely φ values from the public manifold data. Without a concrete distribution on φ and a lower bound on its entropy, the scheme cannot be evaluated as a cryptographic proposal.
minor comments (5)
  1. [Section 1] In the paragraph beginning 'Later on', 'right-angled Artin groups as a latform' should read 'as a platform'.
  2. [Section 2.1] The phrase 'incompresible torus' should be 'incompressible torus'.
  3. [Section 4.4] The reported root k ≈ 1.72208 for the class (2,1) is quoted from a numerical calculation without specifying the method or the precision; a reproducible computation or additional digits would help the reader verify the example.
  4. [Section 3] The denominator cutoff 'say 10^12' for the public database is arbitrary, and the database size and the sampling distribution over it are not specified; these choices are directly relevant to the exhaustive-search attack discussed in Section 6.
  5. [Section 6] The paper should state the intended adversarial model and security notion (for example, indistinguishability under chosen plaintext attack) and give concrete parameter sizes, rather than relying on qualitative statements such as 'the key is exponentially longer than N'.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the Thurston-norm cryptoscheme rests on external Teichmüller-polynomial and 3-manifold topology results, with self-citations appearing only as context or as a non-load-bearing generalization remark.

full rationale

The paper's load-bearing mathematical content is (i) Proposition 1, which proves linear-time membership and exponential distortion for fiber subgroups using standard pseudo-Anosov growth and a direct computation of φ on generators, and (ii) the estimates ℓmax ∼ λφ^N, which are derived from McMullen's Teichmüller polynomial and from Aaber–Dunfield's computations, both cited externally. No parameter is fitted to data and then relabeled as a prediction; the stretch factors λφ are computed from an externally supplied polynomial. The self-citations [13,18,19,26] occur in the introductory survey of group-based cryptography and in the closing 'in principle' remark that other exponentially distorted subgroups could be used; they are not used to justify the correctness or security of the central construction. The explicit map f in Section 4.2 is a proposed construction rather than a derived prediction, and its dependence on only |g| is a real security weakness (the reachable fibered classes form a small set), but that is a cryptanalytic limitation, not a circular reduction. No equation in the paper is defined in terms of the quantity it is supposed to predict.

Assumptions & free parameters 1 free parameters · 6 assumptions · 0 invented entities

The mathematical results are external and standard; the only invented element is the specific choice of the function f, which is acknowledged as one possible example. The security argument implicitly assumes a large reachable set of fibered classes, but the concrete f fails this assumption.

free parameters (1)
  • Database denominator cutoff = 10^12
    Arbitrary cutoff proposed in Section 3 for truncating the infinite set of primitive cohomology classes to a finite public database. It directly caps the security level at log2 of the database size.
assumptions (6)
  • standard math A fibered 3-manifold with pseudo-Anosov monodromy is hyperbolic and atoroidal (Thurston's hyperbolization theorem).
    Used in Section 2.1 to set up the class of manifolds M.
  • standard math The Thurston norm ball and fibered faces have the stated properties (Theorem 1, from Thurston [36]).
    Foundation of the scheme; fibered classes lie in cones over fibered faces.
  • standard math pi_1(M) is hyperbolic, so the word problem is solvable in linear time.
    Used in Proposition 1 and in Bob's recovery of N in Section 4.4.
  • domain assumption The Teichmuller polynomial of McMullen [31] computes the stretch factor lambda_phi for a fibered class, and word lengths of iterates grow like lambda_phi^N.
    Used in Section 4.4 to justify the exponential growth of the key.
  • domain assumption The Anshel-Anshel-Goldfeld public-key exchange is secure for the chosen platform group.
    First layer of security in the public-key scheme (Section 6).
  • ad hoc to paper The image of the public map f is a large set of distinct fibered cohomology classes.
    Implicitly assumed for security but false for the explicit f in Section 4.2, which depends only on |g|.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A cryptographic application of the Thurston norm." pith.science (2026). https://pith.science/paper/SCRS3MCB

@misc{pith2026190803504,
  author       = {Pith},
  title        = {Pith review of: A cryptographic application of the Thurston norm},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SCRS3MCB}},
  note         = {Machine review of arXiv:1908.03504}
}
read the original abstract

We discuss some applications of 3-manifold topology to cryptography. In particular, we propose a public-key and a symmetric-key cryptographic scheme based on the Thurston norm on the first cohomology of hyperbolic manifolds.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

38 extracted references · 38 canonical work pages

  1. [1]

    J. W. Aaber and N. Dunfield, Closed surface bundles of least volume , Algebr. Geom. Topol. 10 (2010), no. 4, 2315–2342

    work page 2010

  2. [2]

    Algom-Kfir, Yael, E

    T. Algom-Kfir, Yael, E. Hironaka, K. Rafi, Digraphs and cycle polynomials for free- by-cyclic groups , Geom. Topol. 19 (2015), no. 2, 1111–1154

    work page 2015

  3. [3]

    Anshel and M

    I. Anshel and M. Anshel and D. Goldfeld, An algebraic method for public-key cryp- tography, Math. Res. Let.6, 1999, 287–291

    work page 1999

  4. [4]

    Anshel, D

    I. Anshel, D. Atkins, D. Goldfeld, P. Gunnells, WalnutDSATM: A Quantum Resistant Group Theoretic Digital Signature Algo rithm, https://www.nist.gov/sites/default/files/documents/2016/10/19/atkins-paper-lwc2016.pdf , 2016

    work page 2016

  5. [5]

    Anshel, M

    I. Anshel, M. Anshel, D. Goldfeld, and S. Lemieux, Key agreement, the Algebraic Eraser, and lightweight cryptography , Algebraic methods in cryptography, Contemp. Math. Amer. Math. Soc. 418 (2006), 1–34

    work page 2006

  6. [6]

    Baudisch, Subgroups of semifree groups , Acta Math

    A. Baudisch, Subgroups of semifree groups , Acta Math. Acad. Sci. Hungar. 38 (1981), no. 1-4, 19–28

    work page 1981

  7. [7]

    Baumslag, B

    G. Baumslag, B. Fine, and X. Xu, Cryptosystems using linear groups , Appl. Algebra Eng. Comm. Comput., 17:205–2017, 2006

    work page 2017

  8. [8]

    J. C. Birget, S S. Magliveras , M. Sramka, On public-key cryptosystems based on combinatorial group theory , Tatra Mt. Math. Publ., 33 (2006), 137–148

    work page 2006

Show all 38 references
  1. [9]

    Bridson, On the subgroups of right-angled Artin groups and mapping cl ass groups, Math

    M. Bridson, On the subgroups of right-angled Artin groups and mapping cl ass groups, Math. Res. Lett., 20 (2013), 203–212

    2013

  2. [10]

    Brown, Trees, valuations, and the Bieri-Neumann-Strebel invaria nt, Inv

    K. Brown, Trees, valuations, and the Bieri-Neumann-Strebel invaria nt, Inv. Math. 90 (1987), 479–504

    1987

  3. [11]

    Cavallo, D

    B. Cavallo, D. Kahrobaei, Secret sharing using the Shortlex order and non- commutative groups, Contemporary Mathematics 633, AMS, 1–8, (2015)

    2015

  4. [12]

    Charney, An introduction to right-angled Artin groups , Geom

    R. Charney, An introduction to right-angled Artin groups , Geom. Dedicata, 125 (2007), 141–158

    2007

  5. [13]

    Chatterji, D

    I. Chatterji, D. Kahrobaei, N. Y. Lu, Cryptosystems Using Subgroup Distortion , Theoretical and Applied Informatics 29, 14–24 (2017)

    2017

  6. [14]

    Diffie and M

    W. Diffie and M. E. Hellman, New Directions in Cryptography , IEEE Transactions on Information Theory IT-22 (1976), 644–654

    1976

  7. [15]

    Dowdall, I

    S. Dowdall, I. Kapovich, and C. Leininger, McMullen polynomials and Lipschitz flows for free-by-cyclic groups , J. Eur. Math. Soc. 19 (2017), no. 11, 3253–3353

    2017

  8. [16]

    Eick and D

    B. Eick and D. Kahrobaei, Polycyclic groups: a new platform for cryptography , math.gr/0411077 Technical report (60 citations), 2004

    2004

  9. [17]

    Fathi, F

    A. Fathi, F. Laudenbach, V. Po´ enaru, Travaux de Thurston sur les surfaces , S´ eminaire Orsay. Ast´ erisque, 66–67. Soci´ et´ e Math´ ematique de France, Paris, 1979

    1979

  10. [18]

    Flores, D

    R. Flores, D. Kahrobaei, Cryptography with Right-angled Artin Groups, Theoretical and Applied Informatics, 28 (2016), no. 3, 8–16

    2016

  11. [19]

    Flores, D

    R. Flores, D. Kahrobaei, T. Koberda, Algorithmic Problems in right-angled Artin groups: Complexity and Applications , J. Algebra 519 (2019), 111–129

    2019

  12. [20]

    Gryak and D

    J. Gryak and D. Kahrobaei, The status of the polycyclic group-based cryptography: A survey and open problems , Groups Complexity Cryptology, 8:171–186, 2016

    2016

  13. [21]

    Habeeb, D

    M. Habeeb, D. Kahrobaei, C. Koupparis, and V. Shpilrain, Public key exchange using semidirect product of (semi)groups , in: ACNS 2013, Applied Cryptography and Network Security, LNCS 7954 (2013), 475–486

    2013

  14. [22]

    Habeeb, D

    M. Habeeb, D. Kahrobaei, and V. Shpilrain, A Secret Sharing scheme based on group-presentation and word problem , Contemporary Mathematics, AMS 582 (2012), 143–150

    2012

  15. [23]

    Hart, D.H

    D. Hart, D.H. Kim, G. Micheli, G. Pascual Perez, C. Petit, Y. Quek, A Practical Cryptanalysis of WalnutDSA , LNCS, PKC, 2018

    2018

  16. [24]

    Kahrobaei, B

    D. Kahrobaei, B. Khan, A Non-Commutative Generalization of the El Gamal Key Exchange using Polycyclic Groups , Proceeding of IEEE, GLOBECOM (2006), 1–5

    2006

  17. [25]

    Kahrobaei, C

    D. Kahrobaei, C. Koupparis, Non-commutative digital signatures using non- commutative groups, Groups, Complexity, Cryptology 4 (2012), 377–384

    2012

  18. [26]

    Kahrobaei, K

    D. Kahrobaei, K. Mallahi-Karai, Some applications of arithmetic groups in cryp- tography, Groups Complexity, Cryptology, De Gruyter 11, no. 1, 1–9 (2019)

    2019

  19. [27]

    Kahrobaei, V

    D. Kahrobaei, V. Shpilrain, Using semidirect product of (semi)groups in public key cryptography, Computability in Europe 2016, LNCS 9709, 132–141 (2016)

    2016

  20. [28]

    Lanneau, F

    E. Lanneau, F. Valdez, Computing the Teichm¨ uller polynomial, J. Eur. Math. Soc. (JEMS) 19, no. 12, 3867–3910 (2017)

    2017

  21. [29]

    Levy-dit-Vehel, L

    F. Levy-dit-Vehel, L. Perret, On the Wagner-Magyarik Cryptosystem . In: Ytrehus (eds) Coding and Cryptography. LNCS, 3969, Springer, Berlin, Heidelberg, 2006

    2006

  22. [30]

    H. Liu, C. Wrathall, K. Zeger, Efficient solution of some problems in free partially commutative monoids , Information and Computation, 89 (1990), 180–198

    1990

  23. [31]

    C. T. McMullen, Polynomial invariants for fibered 3-manifolds and Teichm¨ u ller geodesics for foliations , Ann. Sci. ´Ecole Norm. Sup. (4) 33 (2000), no. 4, 519–560

    2000

  24. [32]

    Petrides, Cryptanalysis of the public key cryptosystem based on the wo rd problem on the Grigorchuk groups , Cryptography and coding, 234–244, 2003

    G. Petrides, Cryptanalysis of the public key cryptosystem based on the wo rd problem on the Grigorchuk groups , Cryptography and coding, 234–244, 2003

    2003

  25. [33]

    Roman’kov, An improved version of the AAG cryptographic protocol , Groups Complex

    V. Roman’kov, An improved version of the AAG cryptographic protocol , Groups Complex. Cryptol. (2019), appear

    2019

  26. [34]

    Shpilrain and A

    V. Shpilrain and A. Ushakov Thompson ’s group and public key cryptography , ACNS, 2005

    2005

  27. [35]

    Shpilrain and G

    V. Shpilrain and G. Zapata, Combinatorial group theory and public key cryptogra- phy, Applicable Algebra in Engineering, 17, 291–302, 2006

    2006

  28. [36]

    W. P. Thurston, A norm for the homology of 3-manifolds , Mem. Amer. Math. Soc. 59 (1986), no. 339, i–vi and 99–130

    1986

  29. [37]

    Tsaban, Polynomial-time solutions of computational problems in noncommutative-algebraic cryptography , J

    B. Tsaban, Polynomial-time solutions of computational problems in noncommutative-algebraic cryptography , J. Cryptology 28 (2015), no. 3, 601– 622

    2015

  30. [38]

    N. R. Wagner, M. R. Magyarik, A Public-Key Cryptosystem Based on the Word Problem In: Blakley G.R., Chaum D. (eds) Advances in Cryptology. CRY PTO 1984. Lecture Notes in Computer Science, 196, Springer, Berlin, Heidelberg, 1985

    1984

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.