A Heuristic Subexponential Algorithm to Find Paths in Markoff Graphs Over Finite Fields
share
Charles, Goren, and Lauter [J. Cryptology 22(1), 2009] explained how one can construct hash functions using expander graphs in which it is hard to find paths between specified vertices. The set of solutions to the classical Markoff equation X^2+Y^2+Z^2=XYZ in a finite field 𝔽_q has a natural structure as a tri-partite graph using three non-commuting polynomial automorphisms to connect the points. These graphs conjecturally form an expander family, and Fuchs, Lauter, Litman, and Tran [Mathematical Cryptology 1(1), 2022] suggest using this family of Markoff graphs in the CGL construction. In this note we show that in both a theoretical and a practical sense, assuming two randomness hypotheses, the path problem in a Markoff graph over 𝔽_q can be solved in subexponential time, and is more-or-less equivalent in difficulty to factoring q-1 and solving three discrete logarithm problem in 𝔽_q^*.
READ FULL TEXT