The Anshel-Anshel-Goldfeld (AAG) key-exchange protocol was implemented and studied with the braid groups as its underlying platform. The length-based attack, introduced by Hughes and Tannenbaum, has been used to cryptanalyze the AAG protocol in this setting. Eick and Kahrobaei suggest to use the polycyclic groups as a possible platform for the AAG protocol. In this paper, we apply several known variants of the length-based attack against the AAG protocol with the polycyclic group as the underlying platform. The experimental results show that, in these groups, the implemented variants of the length-based attack are unsuccessful in the case of polycyclic groups having high Hirsch length. This suggests that the length-based attack is insu cient to cryptanalyze the AAG protocol when implemented over this type of polycyclic groups. This implies that polycyclic groups could be a potential platform for some cryptosystems based on conjugacy search problem, such as non-commutative Di e-Hellman, El Gamal and Cramer-Shoup key-exchange protocols. Moreover, we compare for the rst time the success rates of the di erent variants of the length-based attack. These experiments show that, in these groups, the memory length-based attack introduced by Garber, Kaplan, Teicher, Tsaban and Vishne does better than the other variants proposed thus far in this context.

Garber, Kahrobaei, and Lam studied polycyclic groups generated by number field as platform for the AAG key-exchange protocol. In this paper, we discuss the use of a different kind of polycyclic groups, Heisenberg groups, as a platform group for AAG by submitting Heisenberg groups to one of AAG's major attacks, the length-based attack.After the introduction of the Anshel-Anshel-Goldfeld (AAG) key-exchange protocol in 1999 [1], it has been studied extensively with different groups as platform, for example, using braid groups by Ko et al. [17], using Thompson's group by Shpilrain and Ushakov [23]. Different attack methods have also been applied to AAG [18,12,21].One of the major attack methods of the AAG protocol is the length-based attack (LBA), originated with Hughes and Tannenbaum [14], whose paper provided an example in braid groups, together with remark on the importance of the length function. Garber et al. studied the infeasibility of the length based attack with a choice of length function [11], but then introduced a variant of it using memory which succeeded in breaking AAG for braid group [10]. Myasnikov and Ushakov also studied the length-based attack for braid group and provided several variants with which it was possible to break AAG [20]. Similar attack was implemented against system based on the Thompson group [22] In 2004, Eick and Kahrobaei suggested using polycyclic groups as platform group for the AAG key-exchange protocol [4]. This idea was realized by Garber, Kahrobaei, and Lam [9]. In that paper, several variants of LBA were tested on an AAG implementation using polycyclic groups generated from number field. The result suggests that this type of polycyclic group is resistant to the length-based attack. Taking inspiration from this, we want to study the Heisenberg group as platform group for AAG. We use the variants of the length-based attack presented in [9] to conduct tests on an implementation of the Heisenberg group. The result is then analysed, and we conclude that the Heisenberg groups can be used as platform for the AAG protocol given the correct parameters.Furthermore, the conjugacy search problem has been used for several other cryptographic protocols, such as the non-commutative Diffie-Hellman key exchange [17], the non-commutative El-Gamal key exchange [15], the non-abelian Cramer-Shoup key exchange [2] and the non-commutative digital signatures [16]. The lengthbased attack can be applied to all of these protocols, hence testing different groups against it and collecting data about parameters that make them resistant to LBA is important, not just for the implementation of AAG but also of other protocols.The paper is organized as follows: in Section 1, we introduce the Anshel-Anshel-Goldfeld key exchange protocol, in Section 2, there is a short review of polycyclic

No abstract