What are the typical instance parameters of non-commutative cryptographic schemes? Recently, I grew a tremendous interest for public-key cryptography based on &quot;groupoids&quot;, and collaborated with someone on this topic. What I notice afterwards, is that there had been a huge body of work on &quot;non-commutative&quot; cryptography, with a book from 2011 dedicated to that topic titled &quot;Non-commutative Cryptography and Complexity of Group-theoretic Problems&quot; written by A.Myasnikov et al. (published by American Mathematical Society), although I haven't gotten access to its content yet.
Obviously, non-commutative cryptography had not been matured to the stage where they'd get hash-sign-numbered standards like PKCS#1 for RSA, SEC#1 for elliptic-curve, and EESS#1 for NTRU.
What this question asks is, what are the typical parameters proposed for non-commutative cryptographic schemes? What're their typical cryptogram sizes?
The most common proposals around non-commutative cryptography have been around braid groups. Its proponents have struggled to find parameter sets that are agreed to resist security analysis. Recent proposals have included the algebraic eraser key establishment system and WalnutDSA, a signature scheme that was entered in the NIST post-quantum crytpography process, but failed to pass the first round.
I don't know if there are currently any proposed parameters for the Algebraic Eraser scheme, but this 2016 paper gives a cryptanalysis of the scheme proposed for ISO/IEC 29167-20 standardisation (the standard was not published). The Algebraic Eraser authors' response is also available.
The WalnutDSA submission can be found on the website of the NIST process (the WalnutDSA website link no longer works), as can the cryptanalysis that led to its non-progression.