Skip to content

Proof that GAK can prevent doubles

Lymm edited this page Dec 6, 2025 · 3 revisions

Given a GAK cipher with group $G$, hidden subgroup $H$, plaintext alphabet $P$, ciphertext alphabet $C$, plaintext mapping function $p: P \to G$, and ciphertext mapping function $c: G \to C$ which partitions $G$ into right cosets of $H$, the state update and ciphertext output for plaintext letter $a_i \in P$ and state $g_i \in G$ are given by (assuming a left multiplication action):

$g_{i+1} = p(a_i) \circ g_i$

$c_i = c( p(a_i) \circ g_i )$

To avoid doubles when using a GAK cipher, the only requirement is to select PT mappings such that none of them are in the hidden subgroup $H$. Intuitively, if the mapping element was within the hidden state subgroup, then the effect on the cipher for that plaintext letter would be to change the hidden state without changing the visible state label, directly causing a double. Here's a proof.

Say the group is $G$ and the hidden state subgroup is $H$, and the current state is $g$, while the PT mapping associated with the plaintext letter to be encrypted is $p$. If you're using a left multiplication action, the next state will be $pg$, and the CT output will be the label assigned to the right coset containing $pg$. We want to show that $pg$ and $g$ must be in different right cosets. We will prove this by contradiction, showing that if $pg$ and $g$ are in the same coset, then it violates the conditions for how we selected PT mapping elements.

By definition, each coset is of the form $Hk$ for some $k \in G$. If $pg$ and $g$ are in the same coset, then $Hpg = Hg$. Right multiplying by $g^{-1}$ gives $Hp = H$, so $p$ would be in the same coset as the identity, which would be a contradiction as we choose PT mapping elements specifically avoiding the coset containing the identity. The proof goes the same way for a right multiplication action using left cosets. So we can always prevent doubles by choosing PT mapping elements avoiding the coset containing the identity, or equivalently that no PT mapping elements are in $H$.

This also works in the case that there is no hidden state, which really means the hidden state subgroup is the trivial subgroup containing only the identity, and the requirement to prevent doubles just becomes that none of the PT letters can act on the state group by the identity.

Clone this wiki locally