Anshel–Anshel–Goldfeld key exchange  Anshel–Anshel–Goldfeld protocol, also known as a commutator key exchange, is a key-exchange protocol using nonabelian groups. It was invented by Drs. Michael Anshel, Iris Anshel, and Dorian Goldfeld. Unlike other group-based protocols, it does not employ any commuting or commutative subgroups of a given platform group and can use any nonabelian group with efficiently computable normal forms. It is often discussed specifically in application of braid groups, which notably are infinite (and the group elements can take variable quantities of space to represent). The computed shared secret is an element of the group, so in practice this scheme must be accompanied with a sufficiently secure compressive hash function to normalize the group element to a usable bitstring. Let "G" be a fixed nonabelian group called a "platform group". Alice's public/private information:   Bob's public/private information:   Transitions:   Shared key:  The key shared by Alice and Bob is the group element formula_16 called the commutator of formula_17 and formula_18. From the standpoint of an attacker trying to attack the protocol, they usually learn the public keys formula_23 and formula_24, and the conjugated public keys formula_25 and formula_26. A direct attack then consists of trying to find a suitable formula_17 that is generated by the elements of formula_23, and that produces the appropriate conjugations formula_25 when applied. (An 'indirect' attack would consist of trying to find formula_19 directly, which would require some additional special structure of the group.) For this reason the public keys formula_23 and formula_24 must be chosen to generate a large subgroup of formula_8 — ideally, they form a full set of generators, so that formula_17 cannot be constrained just by knowing that is generated from formula_23. Solving for a suitable formula_17 given the conjugation relations is called the "conjugation problem", and substantial research has been done on attacks to the conjugacy problem on braid groups, although no full efficient solution has achieved.