An open invitation to evaluate endomorphic Laver table based cryptosystems-Part II

In this post, I will give an analysis of the Ko-Lee key exchange for the functionally endomorphic Laver tables (the Ko-Lee key exchange for functional endomorphic Laver tables is simpler to analyze than the distributive version of the Anshel-Anshel-Goldfeld key exchange). In the next post, I will simply link a JavaScript program here on this site which will allow one to analyze the Ko-Lee key exchange for functional endomorphic Laver tables. We will leave an analysis of the more complex but probably more secure distributive version of the Anshel-Anshel-Goldfeld key exchange for functional endomorphic Laver tables for a later post (we believe that the distributive Anshel-Anshel-Goldfeld key exchange would be more secure for the functional endomorphic Laver tables).

Critical points

Suppose that $(X,*)$ is a Laver-like algebra. Then if $x,y\in X$, then define $\mathrm{crit}(x)\leq\mathrm{crit}(y)$ if $x^{n}*y\in\mathrm{Li}(X)$ for some $n$. We say that $\mathrm{crit}(x)=\mathrm{crit}(y)$ if $\mathrm{crit}(x)\leq\mathrm{crit}(y)$ and $\mathrm{crit}(y)\leq\mathrm{crit}(x)$. We shall call $\mathrm{crit}(x)$ the critical point of the element $x$. Let $\mathrm{crit}[X]=\{\mathrm{crit}(x)|x\in X\}$. Then $\mathrm{crit}[X]$ is a linearly ordered set.

If $\alpha\in\mathrm{crit}[X]$, then there is some $r\in X$ with $\mathrm{crit}(r)=\alpha$ and $r*r\in\mathrm{Li}(X)$. Suppose now that $\alpha\in\mathrm{crit}[X],\mathrm{crit}(r)=\alpha,r*r=\mathrm{Li}(X)$. Then define a congruence $\equiv^{\alpha}$ on $X$ by letting $x\equiv^{\alpha}y$ if and only if $r*x=r*y$. Then the congruence $\equiv^{\alpha}$ does not depend on the choice of $\alpha$. The congruence $\equiv^{\alpha}$ is the smallest congruence on $X$ such that if $\mathrm{crit}(x)\geq\alpha$, then $y\in\mathrm{Li}(X)$ for some $y$ with $y\equiv^{\alpha}x$. If $x\in X$, then define the mapping $x^{\sharp}:\mathrm{crit}[X]\rightarrow\mathrm{crit}[X]$ by letting $x^{\sharp}(\mathrm{crit}(y))=\mathrm{crit}(x*y)$. The mapping $x^{\sharp}$ is monotone; if $\alpha\leq\beta$, then $x^{\sharp}(\alpha)\leq x^{\sharp}(\beta)$. Suppose that $(X,E,F)$ is a Laver-like endomorphic algebra. Then suppose that $\alpha\in\mathrm{crit}(\Gamma(X,E))$. Then define the congruence $\equiv^{\alpha}$ on $(X,E,F)$ by letting $x\equiv^{\alpha}y$ if and only if $f(x_{1},…,x_{n_{f}},x)=f(x_{1},…,x_{n_{f}},y)$ where $x_{1},…,x_{n_{f}}\in X$ and $\mathrm{crit}(f,x_{1},…,x_{n_{f}})=\alpha$ and $(f,x_{1},…,x_{n_{f}})*(f,x_{1},…,x_{n_{f}})\in\mathrm{Li}(\Gamma(X,E))$.

In the Laver-like LD-systems which we have looked at which are suitable for cryptographic purposes, $\mathrm{crit}[X]$ tends to be rather small (for cryptographic purposes, $X$ should have at least about 9 critical points, but the largest classical Laver table ever computed $A_{48}$ has 49 critical points).

$\mathbf{Proposition}:$

  1. If $y\equiv^{\alpha}z$, then $x*y\equiv^{x^{\sharp}(\alpha)}x*z$ and $x\circ y\equiv^{x^{\sharp}(\alpha)}x\circ z$.
  2. Suppose that $X$ is a Laver-like LD-system and $x\in X$. Let $\alpha$ be the least critical point such that $x^{\sharp}(\alpha)=\max(\mathrm{crit}[X])$. Then if $y\equiv^{\alpha}z$, then $x*y=x*z$ and $x\circ y=x\circ z.$

Therefore if $\mathbf{y}\in X/\equiv^{\alpha}$ is the equivalence class of $y\in X$, then define $x*\mathbf{y}$ to be the equivalence class of $x*y$ in the quotient algebra $X/\equiv^{x^{\sharp}(\alpha)}$ and define $x\circ\mathbf{y}$ to be the equivalence class of $x\circ\mathbf{y}$ in $X/\equiv^{x^{\sharp}(\alpha)}$.

$\mathbf{Proposition}$ Suppose that $(X,t^{\bullet})$ is an $n+1$-ary Laver-like LD-system. Suppose that $\mathfrak{u}_{1},…,\mathfrak{u}_{n},\mathfrak{v}_{1},…,\mathfrak{v}_{n}\in\Diamond(X,t^{\bullet})$. Then $\mathrm{crit}(\mathfrak{u}_{1},…,\mathfrak{u}_{n})\leq\mathrm{crit}(\mathfrak{v}_{1},…,\mathfrak{v}_{n})$ in $\Gamma(\Diamond(X,t^{\bullet}))$ if and only if $\mathrm{crit}(\mathfrak{u}_{1}(\varepsilon),…,\mathfrak{u}_{n}(\varepsilon))\leq\mathrm{crit}(\mathfrak{v}_{1}(\varepsilon),…,\mathfrak{v}_{1}(\varepsilon))$.

We may therefore define $\mathrm{crit}(\mathfrak{u}_{1},…,\mathfrak{u}_{n})=\mathrm{crit}(\mathfrak{u}_{1}(\varepsilon),…,\mathfrak{u}_{1}(\varepsilon))$.

$\mathbf{Proposition}$ Suppose that $(X,t^{\bullet})$ is an $n+1$-ary Laver-like LD-system and $\alpha\in\mathrm{crit}(\Gamma(X,t^{\bullet}))=\mathrm{crit}(\Gamma(\Diamond(X,t^{\bullet})))$. Then $(\Diamond(X,t^{\bullet}))/\equiv^{\alpha}\simeq\Diamond((X,t^{\bullet})/\equiv^{\alpha})$. In particular, define a mapping $\phi:\Diamond(X,t^{\bullet})\rightarrow\Diamond((X,t^{\bullet})/\equiv^{\alpha})$ as follows. Let $\mathfrak{l}\in\Diamond(X,t^{\bullet})$. Let $\mathbf{BAD}_{\mathfrak{l}}$ be the set of all strings $i\mathbf{x}\in\{1,…,n\}^{*}$ with $\mathrm{crit}(1\mathbf{x},…,n\mathbf{x})\geq\alpha$. Let $\mathbf{GOOD}_{\mathfrak{l}}$ be the set of all strings in $\{1,…,n\}^{*}$ which are not in $\mathbf{BAD}_{\mathfrak{l}}$ nor have suffixes in $\mathbf{BAD}_{\mathfrak{l}}$. Then $\phi(\mathfrak{l})(\mathbf{x})=\mathfrak{l}(\mathbf{x})/\equiv^{\alpha}$ whenever $\mathbf{x}\in\mathbf{GOOD}_{\mathfrak{l}}$ and $\phi(\mathfrak{l})(\mathbf{x})=\#$ otherwise. Then $\phi$ is a homomorphism whose kernel is $\equiv^{\alpha}$.

Analysis of the Ko-Lee key exchange for Laver-like LD-systems.

The security of the Ko-Lee key exchange for Laver-like LD-systems depends on the difficulty of the following problem.

Problem A for $(a,x,b)$ in $X$: Suppose that $X$ is a Laver-like algebra. Suppose that $a,x,b\in X,r=a\circ x,s=x\circ b$. Let $\alpha$ be the least ordinal such that $a^{\sharp}(\alpha)=\max(\mathrm{crit}[X])$ and let $\beta$ be the least ordinal such that $r^{\sharp}(\beta)=\max(\mathrm{crit}[X])$.

INPUT: $x,r,s,\alpha,\beta$ are known.

OBJECTIVE: Find $a’$ such that $r=a’\circ x$ (Problem A-1) or find $\mathbf{b}\in X/\equiv^{\beta}$ such that $x\circ\mathbf{b}\equiv^{\alpha}s$ (Problem A-2).

Note: In the above problem, we assume that $\alpha$ is known since $X$ usually has a limited number of critical points and $\alpha$ can either be solved or there are a limited number of possibilities for $\alpha$.

We take note that problem A is asymmetric in the roles of $a$ and $b$. In particular, Problem A-2 seems to be an easier problem than problem A-1 since $X/\equiv^{\beta}$ is simpler than $X$.

Constructing endomorphic Laver tables

Suppose that $(X,*)$ is a Laver-like LD-system. If $t:X^{n}\rightarrow X$ is a mapping that satisfies the identity $x*t(x_{1},…,x_{n})=t(x*x_{1},…,x*x_{n})$, then define an operation $T:X^{n+1}\rightarrow X$ by letting $T(x_{1},…,x_{n},x)=t(x_{1},…,x_{n})*x$. Then the algebra $(X,T)$ is a Laver-like endomorphic algebra.

$\mathbf{Proposition:}$ Suppose that $(X,*)$ is a Laver-like LD-system and $t:X^{n}\rightarrow X$ is a mapping that satisfies the identity $x*t(x_{1},…,x_{n})=t(x*x_{1},…,x*x_{n})$. Then define $T:X^{n+1}\rightarrow X$ by letting $T(x_{1},…,x_{n},x)=t(x_{1},…,x_{n})*x$. Then
$\mathrm{crit}(T,x_{1},…,x_{n})\leq\mathrm{crit}(T,y_{1},…,y_{n})$ in $\Gamma(X,T)$ if and only if
$\mathrm{crit}(t(x_{1},…,x_{n}))\leq\mathrm{crit}(t(y_{1},…,y_{n}))$ in $(X,*)$.

By the above Proposition, we will hold to the convention that $\mathrm{crit}(T,x_{1},…,x_{n})=\mathrm{crit}(t(x_{1},…,x_{n}))$.

If $x>0$, then define $(x)_{r}$ to be the unique integer with $1\leq(x)_{r}\leq r$ and where $(x)_{r}=x\mod\,r$. If $n\geq m$, then define a mapping $\pi_{n,m}:A_{n}\rightarrow A_{m}$ by letting $\pi_{n,m}(x)=(x)_{2^{m}}$. Define a linear ordering $\leq^{L}_{n}$ on the classical Laver table $A_{n}$ by induction on $n$ by letting $x<^{L}_{n+1}y$ if and only if $\pi_{n+1,n}(x)<^{L}_{n}\pi_{n+1,n}(y)$ or $\pi_{n+1,n}(x)=\pi_{n+1,n}(y),x < y$. For simplicity, we shall simply write $\leq^{L}$ for $\leq^{L}_{n}$. Then $y\leq^{L}z\rightarrow x*_{n}y\leq^{L}x*_{n}z$.

Suppose that $\mathbf{S}$ is a function such that

  1. if $n$ is a natural number and $x_{1},…,x_{r}\in A_{n}$, then $\mathbf{S}(n;x_{1},…,x_{r})\in\{0,1\}$, and
  2. if $x_{1},…,x_{r}\in A_{m},y_{1},…,y_{r}\in A_{n}$ and there is an isomorphism $\iota:\langle x_{1},…,x_{r}\rangle\rightarrow\langle y_{1},…,y_{r}\rangle$ with $\iota(x_{1})=y_{1},…,\iota(x_{r})=y_{r}$ and which preserves $\leq^{L}$, then $\mathbf{S}(m,x_{1},…,x_{r})=\mathbf{S}(n,y_{1},…,y_{r})$.

Then define a mapping $\mathbf{S}_{n}:A_{n}^{r}\rightarrow A_{n}$ for all $n$ by induction on $n$. Suppose that $\mathbf{S}_{n}$ has been defined already and suppose that $x_{1},…,x_{r}\in A_{n+1}$. Then let $v=\mathbf{S}_{n}(\pi_{n+1,n}(x_{1}),…,\pi_{n+1,n}(x_{r}))$. If $|\{v,v+2^{n}\}\cap\langle x_{1},…,x_{r}\rangle|=1$, then let $\mathbf{S}_{n+1}(x_{1},…,x_{r})$ be the unique element in $\{v,v+2^{n}\}\cap\langle x_{1},…,x_{r}\rangle$. If $|\{v,v+2^{n}\}\cap\langle x_{1},…,x_{r}\rangle|=2$, then let $\mathbf{S}_{n}(x_{1},…,x_{r})=v+2^{n}\cdot\mathbf{S}(n;x_{1},…,x_{r})$.

Then for all $n$, the operation $\mathbf{S}_{n}$ satisfies the identity $x*_{n}\mathbf{S}_{n}(x_{1},…,x_{r})=\mathbf{S}_{n}(x*_{n}x_{1},…,x*_{n}x_{r})$.

Analysis of the Ko-Lee key exchange for functional endomorphic Laver tables.

For our analysis of the Ko-Lee key exchange for functional endomorphic Laver tables, assume that $t:A_{n}^{2}\rightarrow A_{n}$ is a mapping that satisfies the identity $x*_{n}t(y,z)=t(x*_{n}y,x*_{n}z)$ and $T^{\bullet}:A_{n}^{3}\rightarrow A_{n}$ is defined by $T^{\bullet}(x,y,z)=t(x,y)*z$.

In the classical Laver table $A_{n}$, we have $\mathrm{crit}(x)\leq\mathrm{crit}(y)$ if and only if $\gcd(x,2^{n})\leq\gcd(y,2^{n})$. Therefore, for the classical Laver table $A_{n}$, we define $\mathrm{crit}(x)=\log_{2}(\gcd(x,2^{n}))$. In the classical Laver table $A_{n}$, we have $x\equiv^{m}y$ if and only if $x=y\mod 2^{m}$. If $x\in A_{n}$, then let $o_{n}(x)$ be the least natural number $m$ such that $x*_{n}2^{m}=2^{n}$. In other words, $o_{n}(x)$ is the least critical point $\alpha\in\mathrm{crit}[A_{n}]$ where in $A_{n}$, we have $x^{\sharp}(\alpha)=\max(\mathrm{crit}[A_{n}])$.

Let $\mathfrak{u}_{1},\mathfrak{u}_{2},\mathfrak{l}_{1},\mathfrak{l}_{2},\mathfrak{v}_{1},\mathfrak{v}_{2}\in\Diamond(X,T^{\bullet})$. Then in order for problem A for $(\mathfrak{u}_{1},\mathfrak{u}_{2}),(\mathfrak{l}_{1},\mathfrak{l}_{2}),(\mathfrak{v}_{1},\mathfrak{v}_{2})$ to be difficult, one needs for $o_{n}(t(\mathfrak{u}_{1}(\varepsilon),\mathfrak{u}_{2}(\varepsilon))\circ_{n}t(\mathfrak{l}_{1}(\varepsilon),\mathfrak{l}_{2}(\varepsilon)))$ to be as large as possible. We therefore recommend for $o_{n}(t(\mathfrak{u}_{1}(\varepsilon),\mathfrak{u}_{2}(\varepsilon))\circ_{n}t(\mathfrak{l}_{1}(\varepsilon),\mathfrak{l}_{2}(\varepsilon)))\geq 4$ for the functional endomorphic Laver table based Ko-Lee key exchange to be secure. Unfortunately, $o_{n}(x\circ y)$ is usually very small $\leq 4$ except for highly specialized values of$ x,y$. If $x,y\in A_{n}$, then $o_{n}(x\circ_{n}y)\leq\min(o_{n}(x),o_{n}(y))$, so $o_{n}(x\circ_{n}y)$ is typically very small.

The following function shows that $o_{n}(x)$ is usually small (usually 2 or 4).

Function:The following function maps $n$ to the number of elements $x\in A_{20}$ with $o_{20}(x)=n$.
[0→1,1→20,2→555085,3→ 107010,4→ 316545,5→ 55,6→ 37235,7→ 7255,8→ 21230,9→ 24, 10→2193, 11→462, 12→1191, 13→12, 14→144, 15→41, 16→58, 17→4, 18→8, 19→2, 20→1 ]
Increasing $n$ past $10$ in $A_{n}$ will probably not increase the security of functional endomorphic Laver table based cryptosystems.

While $\{o_{n+1}(x),o_{n+1}(x)+2^{n}\}\subseteq\{o_{n}(x),o_{n}(x)+2^{n}\}$, and $o_{n+1}(x+2^{n})=o_{n}(x)$, the following data indicates that for $n\geq 10$ increasing $n$ has little effect on $o_{n}(x)$ since it is very rare for $o_{n+1}(x)=o_{n}(x)+1$ as $n$ gets large.

The n-th entry in the following data list is the probability (from a sample size of 100000) that $o_{n}(x)-o_{n}((x)_{2^{n-1}})=1$ for $x\in A_{n}$.
[1→0.5004, 2→ 0.50211, 3→ 0.5006, 4→ 0.37539, 5→ 0.37352, 6→ 0.25163, 7→ 0.18058, 8→ 0.11521, 9→ 0.0929, 10→ 0.05558, 11→ 0.0364, 12→ 0.02191, 13→ 0.01572, 14→ 0.00878, 15→ 0.00513, 16→ 0.00324, 17→ 0.00242, 18→ 0.00124, 19→ 0.00072, 20→ 0.00043, 21→ 0.00041, 22→
0.0002, 23→ 0.00012, 24→ 2.e-05, 25→ 4.e-05, 26→ 1.e-05, 27→ 2.e-05, 28→ 0., 29→ 0., 30→ 0., 31→ 0., 32→ 0., 33→ 0., 34→ 0., 35→ 0., 36→ 0., 37→ 0., 38→ 0., 39→ 0., 40→ 0., 41→ 0., 42→ 0., 43→ 0., 44→ 0., 45→ 0., 46→ 0., 47→ 0., 48→ 0. ]

While one can show that $o_{n}(1)\rightarrow\infty$ using large cardinals, there is no known proof in ZFC that $o_{n}(1)\rightarrow\infty$ and it is known that if $o_{n}(1)\rightarrow\infty$, then $o_{n}(1)$ must diverge very slowly.

Increases $n$ past about 10 or so does not seem to increase the security of the functional endomorphic Laver table based cryptosystems. If $n$ is much larger than $10$, and if $f$ is a $k$-ary term in $\Diamond(X,T^{\bullet})$ and $\mathfrak{l}_{1},…,\mathfrak{l}_{k}\in\Diamond(X,T^{\bullet})$, then $f(\mathfrak{l}_{1},…,\mathfrak{l}_{k})(\mathbf{x})$ is either very close to $2^{n}$, very close to $1$, or very close to $\mathfrak{l}_{i}(\mathbf{y})$ for some string $\mathbf{y}$. Said differently, increasing the size of $n$ past about 10 or so does not seem to make problem A (or any other cryptographic problem) much harder to solve.

An open invitation to evaluate endomorphic Laver table based cryptosystems-Part I

In my research on the generalizations of Laver tables, I found that the endomorphic Laver tables could be used as platforms for several cryptosystems. I am currently the only one looking at endomorphic Laver table based cryptosystems, and it is unclear whether endomorphic Laver table based cryptosystems are secure or not. I am therefore giving this post to invite researchers to evaluate the security of endomorphic Laver table based cryptosystems and to give them some basic information about such cryptosystems. While these posts will give some information that will allow a basic cryptanalysis of endomorphic Laver table based cryptosystems, one would definitely need to read my paper generalizations of Laver tables for a thorough understanding of the algebras involved in these cryptosystems. One should also read the chapter Elementary Embeddings and Algebra in the Handbook of Set Theory (Chapter 11) and Chapters 10-13 in Dehornoy’s book Braids and Self-Distributivity for the an outline of the development of the classical Laver tables before I started my work in 2015.

If you are interested in evaluating the security of endomorphic Laver table based cryptosystems, then please post a comment to this post or send me an e-mail or otherwise contact me.

As a general principle, the non-abelian group based cryptosystems extend to self-distributive algebra based cryptosystems. In particular, the Ko-Lee key exchange, Anshel-Anshel-Goldfeld key exchange, and conjugacy based authentication system, which are some of the most important non-abelian group based cryptosystems, extend from group based cryptosystems to self-distributive algebra based cryptosystems, and the endomorphic Laver tables seem to be good platforms for these self-distributive algebra based cryptosystems.

It seems like endomorphic Laver tables based cryptosystems would even remain secure even against adversaries who have access to quantum computers. I do not believe that quantum computers pose any more of a threat to these cryptosystems than classical computers would since none of the techniques for constructing quantum algorithms (besides Grover’s algorithm which works in general) seem applicable to anything remotely related endomorphic Laver tables. Unless there is a fairly obvious attack, I do not foresee that we will be able to mathematically prove that there is an polynomial time classical or quantum algorithm that breaks these cryptosystems. Nevertheless, I am concerned that these cryptosystems may be susceptible to heuristic attacks.

I have only been able to efficiently compute the endomorphic Laver table operations for two months now (see my previous post for more information about the difficulties in computing the endomorphic Laver table operations and how it was overcome), so these algebras and cryptosystems are fairly unknown.

Endomorphic algebras

An LD-system is an algebra $(X,*)$ that satisfies the self-distributivity identity $x*(y*z)=(x*y)*(x*z)$. LD-systems arise naturally in set theory and in the theory of knots and braids. One can generalize the notion of self-distributivity to algebras with multiple operations, operations of higher arity, and algebras where only some of the fundamental operations are self-distributive.

Suppose that $(X,E,F)$ is an algebraic structure where each $f\in E$ has arity $n_{f}+1$. If $f\in E,a_{1},\dots,a_{n_{f}}\in X$, then define the mapping $L_{f,a_{1},\dots,a_{n_{f}}}$ by letting $L_{f,a_{1},\dots,a_{n_{f}}}(x)=f(a_{1},\dots,a_{n_{f}},x)$. Then we say that $(X,E,F)$ is a partially endomorphic algebra if the mapping $L_{f,a_{1},\dots,a_{n_{f}}}$ is an endomorphism of $(X,E,F)$ whenever $f\in E,a_{1},\dots,a_{n_{f}}\in X$. If $F=\emptyset$, then we shall call $(X,E,F)$ an endomorphic algebra (and we may write $(X,E)$ to denote the endomorphic algebra $(X,E,\emptyset)$). If $(X,t)$ is an endomorphic algebra and $t$ is an $n+1$-ary operation, then we shall call $(X,t)$ an $n+1$-ary self-distributive algebra. The partially endomorphic algebras are the universal algebraic analogues of the LD-systems.

If $(X,E)$ is an endomorphic algebra, then let
$$\Gamma(X,E)=(\bigcup_{f\in E}\{f\}\times X^{n_{f}},*)$$
where the operation $*$ is defined by
$$(f,x_{1},\dots,x_{n_{f}})*(g,y_{1},\dots,y_{n_{g}})=(g,f(x_{1},\dots,x_{n_{f}},y_{1}),\dots,f(x_{1},\dots,x_{n_{f}},y_{n_{g}})).$$
Then $\Gamma(X,E)$ is an LD-system.

Endomorphic algebra based cryptosystems

The Ko-Lee key exchange for semigroups

The following key exchange is a simplified version of the Ko-Lee key exchange for semigroups.

The simplified Ko-Lee key exchange: A semigroup $(X,\circ)$ along with an element $x\in X$ are public.

  1. Alice selects an element $a\in X$ and sends $r=a\circ x$ to Bob.
  2. Bob selects an element $b\in X$ and sends $s=x\circ b$ to Alice.
  3. Let $K=a\circ x\circ b$.

  4. Alice computes $K$ using the fact that $K=a\circ s$.
  5. Bob computes $K$ using the fact that $K=r\circ b$.

An eavesdropper listening in to the communications between Alice and Bob cannot compute $K$. The full-fledged Ko-Lee key exchange would not work for Laver-like algebras since the associative operation on Laver-like algebras has very little commutativity.

The Anshel-Anshel-Goldfeld key exchange for self-distributivity

In this paper, Kalka and Teicher have extended the Anshel-Anshel-Goldfeld key exchange to LD-systems. The following key exchange extends this cryptosystem by Kalka and Teicher to partially endomorphic algebras.

The Anshel-Anshel-Goldfeld key exchange for endomorphic algebras: An partially endomorphic algebra $(X,E,F)$ along with $x_{1},\dots,x_{m},y_{1},\dots,y_{n}\in X$ are public. Let
$$A=\langle x_{1},\dots,x_{m}\rangle,B=\langle y_{1},\dots,y_{n}\rangle.$$

  1. Alice selects some $a\in A$ along with some term $t$ such that $t(x_{1},\dots,x_{m})=a$. Alice selects an
    $f\in E$ along with a tuple $\mathbf{a}=(a_{1},\dots,a_{n_{f}})\in X^{n_{f}}$. Alice then sends $$u_{1}=f(\mathbf{a},y_{1}),\dots,u_{n}=f(\mathbf{a},y_{n}),p_{0}=f(\mathbf{a},a)$$
    to Bob.
  2. Bob selects some $g\in E$ along with $\mathbf{b}=(b_{1},\dots,b_{n_{g}})\in B^{n_{g}}$ and terms
    $t_{1},\dots,t_{n_{g}}$ such that
    $$b_{1}=t_{1}(y_{1},\dots,y_{n}),\dots,b_{n_{g}}=t_{n_{g}}(y_{1},\dots,y_{n}).$$
    Bob then sends the elements $v_{1}=g(\mathbf{b},x_{1}),\dots,v_{m}=g(\mathbf{b},x_{m})$ to Alice.
  3. Let $K=f(\mathbf{a},g(\mathbf{b},a))$.

  4. Alice computes $K$. Alice is able to compute $K$ since Alice knows $f,\mathbf{a}$ and since
    $$g(\mathbf{b},a)=g(\mathbf{b},t(x_{1},\dots,x_{m}))=t(g(\mathbf{b},x_{1}),\dots,g(\mathbf{b},x_{m}))
    =t(v_{1},\dots,v_{m}).$$
  5. Bob computes $K$. Bob is able to compute $K$ since

    $$K=f(\mathbf{a},g(\mathbf{b},a))=f(\mathbf{a},g(b_{1},\dots,b_{n_{g}},a))$$

    $$=g(f(\mathbf{a},b_{1}),\dots,f(\mathbf{a},b_{n_{g}}),f(\mathbf{a},a))$$

    $$=g(f(\mathbf{a},t_{1}(y_{1},\dots,y_{n})),\dots,f(\mathbf{a},t_{n_{g}}(y_{1},\dots,y_{n})),p_{0})$$

    $$=g(t_{1}(f(\mathbf{a},y_{1}),\dots,f(\mathbf{a},y_{n})),\dots,t_{n_{g}}(f(\mathbf{a},y_{1}),\dots,f(\mathbf{a},y_{n})),p_{0})$$

    $$=g(t_{1}(u_{1},\dots,u_{n}),\dots,t_{n_{g}}(u_{1},\dots,u_{n}),p_{0}).$$

  6. No third party will be able to compute the common key $K$.

Laver tables

The classical Laver table $A_{n}$ is the unique algebraic structure $(\{1,\dots,2^{n}\},*_{n})$ that satisfies the self-distributivity identity $x*_{n}(y*_{n}z)=(x*_{n}y)*_{n}(x*_{n}z)$ and where $x*_{n}1=x+1\,\mod 2^{n}$ for $x\in A_{n}$. The operation $*_{n}$ can easily be computed from a 2.5 MB file of precomputed data as long as $n\leq 48$. We believe that it is feasible with current technology to compute $*_{n}$ when $n\leq 96$ though. The classical Laver tables alone are unsuitable as platforms for self-distributive algebra based cryptosystems (the classical Laver tables will offer at most 96 bits of security and in practice such cryptosystems based on the classical Laver tables are effortlessly and instantly broken). The multigenic Laver tables are not suitable as platforms for such cryptosystems either since elements in multigenic Laver tables can easily be factored.

If $(X,*)$ is an LD-system, then a subset $L\subseteq X$ is said to be a left-ideal if $x*y\in L$ whenever $y\in L$. An element $x\in X$ is said to be a left-identity if $x*y=y$ whenever $y\in X$. Let $\mathrm{Li}(X)$ denote the set of all left-identities in the set $(X,*)$. We say that an LD-system $(X,*)$ is Laver-like if

  1. $\mathrm{Li}(X)$ is a left-ideal in $X$, and
  2. Whenever $x_{n}\in X$ for all natural numbers $n$, there is some $N$ such that $x_{0}*\dots*x_{N}\in\mathrm{Li}(X)$ (here the implied parentheses are grouped on the left. i.e. $x*y*z=(x*y)*z$. ).

For example, the classical Laver tables $A_{n}$ are always Laver-like.

If $(X,*)$ is an LD-system, then define the Fibonacci terms $t_{n}$ for $n\geq 1$ by letting $t_{1}(x,y)=y,t_{2}(x,y)=x$ and $t_{n+2}(x,y)=t_{n+1}(x,y)*t_{n}(x,y)$. If $(X,*)$ is a Laver-like LD-system, then define an operation $\circ$ on $X\setminus\mathrm{Li}(X)$ by letting $x\circ y=t_{n+1}(x,y)$ whenever $t_{n}(x,y)\in\mathrm{Li}(X)$ (the operation $\circ$ does not depend on the choice of $n$). The operation $\circ$ is associative and hence suitable for the Ko-Lee key exchange. The operation $\circ$ also satisfies the identity $(x\circ y)*z=x*(y*z)$.

A partially endomorphic algebra $(X,E,F)$ is said to be Laver-like if the hull $\Gamma(X,E)$ is Laver-like. Any Laver-like algebra may be used to induce a partially endomorphic Laver table, but for simplicity, we shall only define the functional endomorphic Laver tables induced by the endomorphic algebras with only one fundamental operation.

Suppose now that $(X,t^{\bullet})$ is a $n+1$-ary Laver-like algebra. Let $\Diamond(X,t^{\bullet})$ be the algebra with underlying set consisting of all functions $\mathfrak{l}:\{1,\dots,n\}^{*}\rightarrow X\cup\{\#\}$ such that

  1. $\mathfrak{l}(\varepsilon)\in X$.
  2. If $\mathfrak{l}(\mathbf{x})\in\#$, then $\mathfrak{l}(i\mathbf{x})\in\#$ for all $i\in\{1,\dots,n\}$.
  3. If $\mathfrak{l}(\mathbf{x})\in X$, then either $\mathfrak{l}(i\mathbf{x})\in X$ for all $i\in\{1,\dots,n\}$ or
    $\mathfrak{l}(i\mathbf{x})=\#$ for all $i\in\{1,\dots,n\}$.
  4. If $\mathfrak{l}(i\mathbf{x})\in X$ for all $i\in\{1,\dots,n\}$, then $(\mathfrak{l}(1\mathbf{x}),\dots,\mathfrak{l}(n\mathbf{x}))\not\in \mathbf{Li}(\Gamma((X,t^{\bullet})))$.
  5. If $\mathfrak{l}(\mathbf{x})\in X$, and $\mathfrak{l}(i\mathbf{x})\in X$ for all $i\in\{1,\dots,n\}$, then
    there is some $x\in X$ where $t(\mathfrak{l}(1\mathbf{x}),\dots,\mathfrak{l}(n\mathbf{x}),x)=\mathfrak{l}(\mathbf{x})$.
  6. $\mathfrak{l}(\mathbf{x})\in X$ for only finitely many strings $\mathbf{x}\in\{1,\dots,n\}^{*}$.

If $\mathfrak{l}_{1},\dots,\mathfrak{l}_{n}\in\Diamond(X,t)$ and $(\mathfrak{l}_{1}(\varepsilon),\dots,\mathfrak{l}_{n}(\varepsilon))\not\in\Gamma((X,t^{\bullet}))$, then define $t_{x}(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n})\in\Diamond(X,t^{\bullet})$ by $t(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n})(\varepsilon)=t^{\bullet}(\mathfrak{l}_{1}(\varepsilon),\dots,\mathfrak{l}_{n}(\varepsilon),x)$ and where $t(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n})(\mathbf{x}i)=\mathfrak{l}_{i}(\mathbf{x})$.

Now define an operation $t^{\sharp}:\Diamond(X,t^{\bullet})^{n+1}\rightarrow\Diamond(X,t^{\bullet})$ by letting

  1. $t^{\sharp}(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n},\mathfrak{l})=\mathfrak{l}$ whenever
    $(\mathfrak{l}_{1}(\varepsilon),\dots,\mathfrak{l}_{n}(\varepsilon))\in\mathrm{Li}(\Gamma(X,t^{\bullet}))$,
  2. otherwise, if $\mathfrak{l}(i)=\#$ for $1\leq i\leq n$, then define
    $t^{\sharp}(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n},\mathfrak{l})=t_{\mathfrak{l}(\varepsilon)}(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n})$,
  3. otherwise if $\mathfrak{l}=t(\mathfrak{u}_{1},\dots,\mathfrak{u}_{n})$, then
    $$t^{\sharp}(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n},\mathfrak{l})$$

    $$=t^{\sharp}(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n},t_{x}(\mathfrak{u}_{1},\dots,\mathfrak{u}_{n}))$$

    $$=t^{\sharp}(t^{\sharp}(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n},\mathfrak{u}_{1}),\dots,t^{\sharp}(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n},\mathfrak{u}_{n}),t_{x}(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n})).$$

Then the algebra $(\Diamond(X,t^{\bullet}),t^{\sharp})$ is an $n+1$-ary self-distributive algebra which we shall refer to as a functional endomorphic Laver table. Every functional endomorphic Laver table is a Laver-like endomorphic algebra. If one has an efficient algorithm for computing $\mathfrak{l}_{1},\dots,\mathfrak{l}_{n},\mathfrak{l}$, then one also has a reasonably efficient algorithm for computing $t^{\sharp}(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n},\mathfrak{l})$.

The Ko-Lee key exchange for endomorphic Laver tables

One could apply the Ko-Lee key exchange to the operation $\circ$ in $\Gamma(\Diamond(X,t^{\bullet}),t^{\sharp})$. However, since we are only able to compute $t^{\bullet}(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n},\mathfrak{l})(\mathbf{x})$ instead of the entire function $t^{\bullet}(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n},\mathfrak{l})$, we will need to modify the Ko-Lee key exchange so that the endomorphic Laver tables can be used as a platform for this cryptosystem. The self-distributive Anshel-Anshel-Goldfeld key exchange can be modified in the same way.

The Ko-Lee key exchange for endomorphic Laver tables: Suppose that $(X,t^{\bullet})$ is an $n+1$-ary Laver-like algebra. Then in this key exchange algorithms for computing $\mathfrak{l}_{1},\dots,\mathfrak{l}_{n}\in\Diamond(X,t^{\bullet})$ are public.

  1. Alice selects secret algorithms for computing $\mathfrak{u}_{1},\dots,\mathfrak{u}_{n}\in\Diamond(X,t^{\bullet})$. Let
    $(\mathfrak{j}_{1},\dots,\mathfrak{j}_{n})=(\mathfrak{u}_{1},\dots,\mathfrak{u}_{n})\circ(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n})$. Then Alice has secret algorithms for computing $\mathfrak{j}_{1},\dots,\mathfrak{j}_{n}$.
  2. Bob selects secret algorithms for computing $\mathfrak{v}_{1},\dots,\mathfrak{v}_{n}\in\Diamond(X,t^{\bullet})$. Let
    $(\mathfrak{k}_{1},\dots,\mathfrak{k}_{n})=(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n})\circ(\mathfrak{v}_{1},\dots,\mathfrak{v}_{n})$. Bob has secret algorithms for computing $\mathfrak{k}_{1},\dots,\mathfrak{k}_{n}$.

    Let
    $$(\mathfrak{w}_{1},\dots,\mathfrak{w}_{n})$$
    $$(\mathfrak{u}_{1},\dots,\mathfrak{u}_{n})\circ(\mathfrak{l}_{1},\dots,\mathfrak{l}_{n})\circ(\mathfrak{v}_{1},\dots,\mathfrak{v}_{n}).$$

  3. Let $i\in\{1,\dots,n\},\mathbf{x}\in\{1,\dots,n\}^{*}$, and let $K=\mathfrak{w}_{i}(\mathbf{x})$.

  4. Alice computes $K$. Bob will not reveal the algorithms for computing $\mathfrak{k}_{1},\dots,\mathfrak{k}_{n}$ since Bob’s algorithms for computing $\mathfrak{k}_{1},\dots,\mathfrak{k}_{n}$ depend on his algorithms for computing $\mathfrak{v}_{1},\dots,\mathfrak{v}_{n}$. However, upon request from Alice, Bob will send specific values of the form $\mathfrak{k}_{j}(\mathbf{y})$ to Alice. Alice will be able to compute $K$ using her algorithms for computing $\mathfrak{u}_{1},\dots,\mathfrak{u}_{n}$ and using the values $\mathfrak{k}_{j}(\mathbf{y})$ sent from Bob. In general, Alice will need to ask Bob for the values of $\mathfrak{k}_{j}(\mathbf{y})$ several times.
  5. Bob computes $K$ in a similar manner. Alice will not reveal algorithms for computing $\mathfrak{j}_{1},\dots,\mathfrak{j}_{n}$ either. However, Alice will reveal specific values of the form $\mathfrak{j}_{j}(\mathbf{y})$ to Bob. Bob will therefore compute $K$ using his secret algorithms for computing $\mathfrak{v}_{1},\dots,\mathfrak{v}_{n}$ along with values of the form $\mathfrak{j}_{j}(\mathbf{y})$ sent by Alice.

Remark: The common key $K$ may only have a couple of bits of entropy so the common key $K$ could be found by an eavesdropping party by guessing the most common possibilities. The most obvious way to mitigate this problem is to perform the above key exchange multiple times in order to obtain a large enough key. Another probably more efficient way to mitigate this problem is to use $(\mathfrak{w}_{i}(\mathbf{x}_{0}),\dots,\mathfrak{w}_{i}(\mathbf{x}_{r}))$ as the common key instead where $(\mathbf{x}_{0},\dots,\mathbf{x}_{r})$ is an enumeration of the suffixes of $\mathbf{x}$.

To be continued

In the second post, I will give a detailed analysis of the Ko-Lee key exchange for endomorphic Laver tables. Furthermore, at the same time, I will release an online JavaScript program for analyzing the Ko-Lee key exchange for endomorphic Laver tables.

Endomorphic Laver tables can be computed efficiently

The partially endomorphic Laver tables are the generalizations of the notion of the classical Laver table to algebraic structures which may have an arbitrary number of fundamental operations each of arbitrary arity and where only some of the fundamental operations are required to be self-distributive. While the endomorphic Laver tables have much richer combinatorial structure than is found in the corresponding classical Laver tables and multigenic Laver tables, we are still able to somewhat efficiently compute information about the output of the fundamental operations on endomorphic Laver tables. In fact, as I have mentioned before, you may compute in endomorphic Laver tables here and here.

Since we are able to compute the endomorphic Laver tables, it is plausible that the endomorphic Laver tables could be used as platforms for cryptosystems which are secure against classical attacks and even quantum attacks, but much more research still needs to be done on this topic.

The definition of Laver-like partially endomorphic algebras and partially endomorphic Laver tables

The definition of the partially endomorphic Laver tables is somewhat complicated. For simplicity, we shall only define the well-founded partially endomorphic Laver tables induced from known partially endomorphic Laver-like algebras.

Suppose that $X$ is a set and $E,F$ are sets of operations on $X$. Suppose that each $\mathfrak{g}\in F$ has arity $n_{\mathfrak{g}}$ and each $f\in E$ has arity $n_{f}+1$. If $f\in E,a_{1},…,a_{n_{f}}\in X$ then let $L_{f,a_{1},…,a_{n_{f}}}:X\rightarrow X$ be the mapping defined by $L_{f,a_{1},…,a_{n_{f}}}(x)=f(a_{1},…,a_{n_{f}},x)$. Then we say that $(X,E,F)$ is an endomorphic algebra if each mapping $L_{f,a_{1},…,a_{n_{f}}}$ is an endomorphism of $(X,E,F)$. In other words, the partially endomorphic algebras are precisely the algebras where one has the notion of an inner endomorphism. If $F=\emptyset$ and $(X,E,F)$ is a partially endomorphic algebra, then we say that $(X,E)$ is an endomorphic algebra. We say that an algebra $(X,*)$ is an LD-system (or left-distributive algebra) if $(X,*)$ satisfies the identity $x*(y*z)=(x*y)*(x*z)$.

Suppose that $(X,*)$ is a left-distributive algebra. Then we say that a subset $L\subseteq X$ is a left-ideal if $x*y\in L$ whenever $y\in L$. We say that an element $x\in X$ is a left-identity if $x*y=y$ for all $y\in X$. Let $\mathrm{Li}(X)$ denote the set of all left-identities in $X$. A left-distributive algebra $(X,*)$ is said to be Laver-like if $\mathrm{Li}(X)$ is a left-ideal and whenever $x_{n}\in X$ for all $n\in\omega$ there is some $N$ where $x_{0}*…*x_{N}\in\mathrm{Li}(X)$.

If $(X,*)$ is Laver-like, then define $\preceq$ to be the smallest partial ordering on $X$ where $x\preceq x*y$ whenever $x\in X\setminus\mathrm{Li}(X)$. Then $(X,\preceq)$ is a dual well-founded partially ordered set and the dual well-foundedness of $(X,\preceq)$ is necessary for all inductive proofs involving the generalizations of Laver tables.

If $(X,E)$ is an endomorphic algebra, then define the hull $\Gamma(X,E)$ of $(X,E)$ to be the algebra with underlying set
$\bigcup_{f\in E}\{f\}\times X^{n_{f}}$ and binary operation $*$ defined by
$$(f,x_{1},…,x_{n_{f}})*(g,y_{1},…,y_{n_{g}})$$
$$=(g,f(x_{1},…,x_{n_{f}},y_{1}),…,f(x_{1},…,x_{n_{f}},y_{n_{g}})).$$ Then the hull $\Gamma(X,E)$ of an endomorphic algebra is always a left-distributive algebra. We say that a partially endomorphic algebra $(X,E,F)$ is Laver-like if $\Gamma(X,E)$ is Laver-like.

Suppose that $\mathcal{V}=(V,(f^{\mathcal{V}})_{f\in E},(\mathfrak{g}^{\mathcal{V}})_{\mathfrak{g}\in F})$ is a Laver-like partially endomorphic algebra. Suppose furthemore that $X$ is a set of variables and $v_{x}\in V$ for all $x\in X$. For each $x\in X$ and $f\in E$, let $f_{x}$ be an $n_{f}$-ary function symbol. Let $\mathcal{G}=\{f_{x}\mid f\in E,x\in X\}\cup F$. Let $\mathbf{T}_{\mathcal{G}}[X]$ be the set of all terms in the language $\mathcal{G}$ with variables in $X$. Let $L$ be the subset of $\mathbf{T}_{\mathcal{G}}[X]$ and let $\phi:L\rightarrow V$ be the mappings defined by induction on the complexity of the term $\ell\in\mathbf{T}_{\mathcal{G}}[X]$ according to the following rules:

  1. $X\subseteq L$ and $\phi(x)=v_{x}$ for each $x\in X$.
  2. If $\mathfrak{g}\in F$ and $\ell_{1},…,\ell_{n_{\mathfrak{g}}}\in L$, then $\mathfrak{g}(\ell_{1},…,\ell_{n_{\mathfrak{g}}})\in L$ and
    $\phi(\mathfrak{g}(\ell_{1},…,\ell_{n_{\mathfrak{g}}}))=\mathfrak{g}(\phi(\ell_{1}),…,\phi(\ell_{n_{\mathfrak{g}}}))$.
  3. if $f\in E,x\in X$ and $\ell_{1},…,\ell_{n_{f}}\in L$, then $f_{x}(\ell_{1},…,\ell_{n_{f}})\in L$ if and only if
    $$(f,\phi(\ell_{1}),…,\phi(\ell_{n_{f}}))\not\in\mathrm{Li}(\Gamma(V,(f^{\mathcal{V}})_{f\in E})).$$
    If $f_{x}(\ell_{1},…,\ell_{n_{f}})\in L$, then
    $$\phi(f_{x}(\ell_{1},…,\ell_{n_{f}}))=f^{\mathcal{V}}(\phi(\ell_{1}),…,\phi(\ell_{n_{f}}),v_{x})).$$

For each $f\in E$, define an operation $f^{\sharp}$ on $L$ by
$f^{\sharp}(\ell_{1},…,\ell_{n},\ell)=\ell$ whenever $f_{x}(\ell_{1},…,\ell_{n})\in L$ and if
$f_{x}(\ell_{1},…,\ell_{n})\not\in L$ then

  1. $f^{\sharp}(\ell_{1},…,\ell_{n},x)=f_{x}(\ell_{1},…,\ell_{n})$
  2. $f^{\sharp}(\ell_{1},…,\ell_{n},\mathfrak{g}(u_{1},…,u_{n_{g}}))
    =\mathfrak{g}(f^{\sharp}(\ell_{1},…,\ell_{n},u_{1}),…,f^{\sharp}(\ell_{1},…,\ell_{n},u_{n_{g}})),$
  3. $f^{\sharp}(\ell_{1},…,\ell_{n},g_{x}(u_{1},…,u_{n_{g}}))
    =g^{\sharp}(f^{\sharp}(\ell_{1},…,\ell_{n_{g}},u_{1}),…,f^{\sharp}(\ell_{1},…,\ell_{n_{g}},u_{n_{g}}),f_{x}(\ell_{1},…,\ell_{n_{g}})).$

Then we shall write $\mathbf{L}((v_{x})_{x\in X},\mathcal{V})$ for the algebra $(L,(f^{\sharp})_{f\in E},F)$. The algebra $(L,(f^{\sharp})_{f\in E},F)$ is a Laver-like partially endomorphic algebra.

Endomorphic Laver tables are usually infinite

The classical Laver tables and multigenic Laver tables are always locally finite. Furthermore, every Laver-like LD-system is locally finite. In particular, the quotient algebra of elementary embeddings $\mathcal{E}_{\lambda}/\equiv^{\gamma}$ is always locally finite. On the other hand, the partially endomorphic Laver tables with at least one fundamental operation of arity at least 3 that we have looked at are all infinite. Since the endomorphic Laver tables that we have looked at are all infinite, it is unclear as to how these endomorphic Laver tables could arise naturally from the algebras of rank-into-rank embeddings.

Endomorphic Laver tables are abundant

There are many ways to construct $N$-ary operations $t:A_{n}^{N}\rightarrow A_{n}$ with $x*t(x_{1},…,x_{N})=t(x*x_{1},\ldots,x*x_{N})$. If $t$ satisfies the identity $x*t(x_{1},…,x_{N})=t(x*x_{1},\ldots,x*x_{N})$, then define a mapping $T:A_{n}^{N+1}\rightarrow A_{n}$ by letting $T(x_{1},…,x_{N},x)=t(x_{1},…,x_{N})*x$. Then $(X,T)$ is a Laver-like $N+1$-ary algebra.

Every term $t$ in the language of LD-systems satisfies the identity $x*t(x_{1},…,x_{N})=t(x*x_{1},\ldots,x*x_{N})$.

Let $(x)_{r}$ be the unique natural number such that $1\leq(x)_{r}\leq r$ and $(x)_{r}=x\mod\,r$. Then define a mapping $\pi_{n,m}:A_{n}\rightarrow A_{m}$ by $\pi_{n,m}(x)=(x)_{2^{m}}$ whenever $n\geq m$. If $x,y\in A_{n}$, then say that $x\leq^{L}y$ if $x=y$ or if $m$ is the least natural number with $\pi_{n,m}(x)\neq\pi_{n,m}(y)$, then $\pi_{n,m}(x)<\pi_{n,m}(y).$ Then $\leq^{L}$ is a linear ordering with $y\leq^{L}z\rightarrow x*y\leq^{L}x*z$ whenever $x,y,z\in A_{n}$. Define an operation $T_{k,r}:A_{n}^{r}\rightarrow A_{n}$ by letting $T_{k,r}(x_{1},...,x_{r})=x_{\sigma(k)}$ where $\sigma$ is a permutation of $\{1,...,r\}$ with $x_{\sigma(1)}\leq^{L}...\leq^{L}x_{\sigma(n)}$. Then $A_{n}$ satisfies the identity $x*T_{k,r}(x_{1},...,x_{r})=T_{k,r}(x*x_{1},...,x*x_{r})$ as well. There are more complex techniques for constructing mappings $t:A_{n}^{N}\rightarrow A_{n}$ that satisfy the identity $x*t(x_{1},...,x_{N})=t(x*x_{1},\ldots,x*x_{N})$.

At least exponential growth in output length

Let $e$ be a variable. Let $\ell_{1}=e$. Let $\mathcal{V}=(A_{n},t^{\mathcal{V}})$ where $t^{\mathcal{V}}$ is the operation defined by $t^{\mathcal{V}}(x,y,z)=y*z$. Let $L=\mathbf{L}((1)_{r\in\{e\}},\mathcal{V})$. For $1\leq i<2^{n}$, let $\ell_{i+1}=t(\ell_{i},\ell_{i})$. Then the term $\ell_{i}$ has $2^{i-1}$ instances of the variable $e$ and by induction one can show that in $L$, we have $t^{\sharp}(\ell_{r},\ell_{r},\ell_{s})=\ell_{r*_{n}s}$. Such large output is typical for endomorphic Laver table operations. Therefore the output of an endomorphic Laver table operation is often too large to be stored completely by a computer. Some computer experiments suggest that the output size of the endomorphic Laver table operations may be super-exponential.

The trick to computing endomorphic Laver tables

In one sense, the endomorphic Laver table operations are not efficiently computable since our output grows at least exponentially, but we are able to find a sense in which the endomorphic Laver table operations are efficiently computable. The first idea to computing endomorphic Laver tables is not to compute the entire term $t^{\sharp}(\ell_{1},…,\ell_{n},\ell)$ but to recursively compute just a piece of information from the term $t^{\sharp}(\ell_{1},…,\ell_{n},\ell)$ or an approximation of the term $t^{\sharp}(\ell_{1},…,\ell_{n},\ell)$. We shall see that these approximations of the term $t^{\sharp}(\ell_{1},…,\ell_{n},\ell)$ are analogous to how floating point numbers approximate the real numbers. The second idea is to use the original endomorphic Laver-like algebra to extract the necessary information about the terms.

For simplicity of notation, assume that $(X,t^{\bullet})$ is an $n+1$-ary Laver-like algebra.

Let $\Diamond(X,t^{\bullet})$ be the set of all functions $\mathfrak{l}:\{1,…,n\}^{*}\rightarrow X\cup\{\#\}$ that satisfy the following conditions:

  1. $\mathfrak{l}(\varepsilon)\in X$.
  2. If $\mathfrak{l}(\mathbf{x})=\#$, then $\mathfrak{l}(i\mathbf{x})=\#$ for $1\leq i\leq n$.
  3. If $\mathfrak{l}(\mathbf{x})\in X$, then either $\mathfrak{l}(i\mathbf{x})\in X$ for $1\leq i\leq n$ or
    $\mathfrak{l}(i\mathbf{x})=\#$ for $1\leq i\leq n$.
  4. If $\mathfrak{l}(i\mathbf{x})\in X$ for $1\leq i\leq n$, then
    $(\mathfrak{l}(1\mathbf{x}),…,\mathfrak{l}(n\mathbf{x}))\not\in\mathrm{Li}(\Gamma(X,t^{\bullet}))$.
  5. If $\mathfrak{l}(i\mathbf{x})\in X$ for $1\leq i\leq n$, then there is some $x\in X$ where
    $t^{\bullet}(\mathfrak{l}(1\mathbf{x}),…,\mathfrak{l}(n\mathbf{x}),x)=\mathfrak{l}(\mathbf{x})$.
  6. $\mathfrak{l}(\mathbf{x})\in X$ for only finitely many $\mathbf{x}\in X$.

Now if $\mathfrak{l}_{1},…,\mathfrak{l}_{n}\in\Diamond(X,t^{\bullet})^{n}$ and
$(\mathfrak{l}_{1}(\varepsilon),…,\mathfrak{l}_{n}(\varepsilon))\not\in\mathrm{Li}(\Gamma(X,t^{\bullet}))$, and
$x\in X$, then define $t_{x}(\mathfrak{l}_{1},…,\mathfrak{l}_{n}):\{1,…,n\}^{*}\rightarrow X\cup\{\#\}$ by letting
$t_{x}(\mathfrak{l}_{1},…,\mathfrak{l}_{n})(\varepsilon)=t^{\bullet}(\mathfrak{l}_{1}(\varepsilon),…,\mathfrak{l}_{n}(\varepsilon),x)$ and where $t_{x}(\mathfrak{l}_{1},…,\mathfrak{l}_{n})(\mathbf{x}i)=\mathfrak{l}_{i}(\mathbf{x})$ whenever $i\mathbf{x}\in\{1,…,n\}^{*}$.

Then there is a unique operation $t^{\sharp}:\Diamond(X,t^{\bullet})^{n+1}\rightarrow\Diamond(X,t^{\bullet})$ such that

  1. $t^{\sharp}(\mathfrak{l}_{1},…,\mathfrak{l}_{n},\mathfrak{l})=\mathfrak{l}$ whenever
    $(\mathfrak{l}_{1}(\varepsilon),…,\mathfrak{l}_{n}(\varepsilon))\in\mathrm{Li}(\Gamma(X,t^{\bullet}))$,
  2. Otherwise, if $\mathfrak{l}(i)=\#$ for $1\leq i\leq n$, then
    $t^{\sharp}(\mathfrak{l}_{1},…,\mathfrak{l}_{n},\mathfrak{l})=t_{\mathfrak{l}(\varepsilon)}(\mathfrak{l}_{1},…,\mathfrak{l}_{n})$, and
  3. $$t^{\sharp}(\mathfrak{l}_{1},…,\mathfrak{l}_{n},t^{\sharp}(\mathfrak{u}_{1},…,\mathfrak{u}_{n},\mathfrak{u}))$$
    $$=t^{\sharp}(t^{\sharp}(\mathfrak{l}_{1},…,\mathfrak{l}_{n},\mathfrak{u}_{1}),…,
    t^{\sharp}(\mathfrak{l}_{1},…,\mathfrak{l}_{n},\mathfrak{u}_{n}),t^{\sharp}(\mathfrak{l}_{1},…,\mathfrak{l}_{n},\mathfrak{u})).$$

Then the algebra $\Diamond(X,t^{\bullet})$ is isomorphic to a quotient of the endomorphic Laver table $\mathbf{L}((x)_{x\in X},(X,t^{\bullet}))$ by a very small congruence. Furthermore, it is easy to embed any desired endomorphic Laver table into an algebra of the form $\Diamond(X,t^{\bullet})$. Instead of computing the entire output $t^{\sharp}(\mathfrak{l}_{1},…,\mathfrak{l}_{n},\mathfrak{l})$, one could just compute $t^{\sharp}(\mathfrak{l}_{1},…,\mathfrak{l}_{n},\mathfrak{l})(\mathbf{x})$ for some string $\mathbf{x}$.

Endomorphic Laver tables can be computed quickly

Suppose that $(X,t^{\bullet})$ is an $r+1$-ary Laver-like algebra. By our experiments, we have concluded that if $f(x_{1},…,x_{r})$ is a term whose only function symbol is $t^{\sharp}$, then in $\Diamond(X,t^{\bullet})$, the value of
$f(\mathfrak{l}_{1},…,\mathfrak{l}_{r})(\mathbf{x})$ is usually computable in a few seconds as long as $|\mathbf{x}|<500$ or so in the language JavaScript on a web browser. When $\mathbf{x}$ gets to long, I usually run out of memory or the computation fails from too deep recursion errors.

A limitless source of combinatorial complexity.

While the classical Laver tables and multigenic Laver tables collectively can be thought of as an unlimited source of combinatorial complexity, since every classical Laver table and multigenic Laver table is locally finite, each classical Laver table and multigenic Laver table must only have a limited amount of combinatorial complexity. However, each endomorphic Laver table seems to contain an unlimited amount of combinatorial complexity and there does not appear to be a formula for computing $t^{\bullet}(\mathfrak{l}_{1},…,\mathfrak{l}_{n},\mathfrak{l})(\mathbf{x})$ even for endomorphic Laver tables originally obtained from $A_{5}$. The output of an endomorphic Laver table operation is usually unpredictable, but among the complexity of the output of the endomorphic Laver tables, there is some order amidst the complexity. The output of endomorphic Laver table operations seem to exhibit a sort of periodicity which is similar to the periodicity found in the classical and multigenic Laver tables.

Possible applications to public key cryptography

The endomorphic Laver tables incorporate the following attributes which are necessary for public key cryptography.

  1. The classical Laver tables are combinatorially complicated since they may be used to produce recursive functions which grow faster than the Ackermann function. The multigenic Laver tables are even more complicated. However, the combinatorial richness of the classical Laver tables and multigenic Laver tables is surpassed by the combinatorial complexity that arises from the endomorphic Laver tables.
  2. While the endomorphic Laver tables are combinatorially intricate, the endomorphic Laver tables still retain much algebraic structure. In other words, there is order to the chaos that arises from endomorphic Laver tables.
  3. The endomorphic Laver tables are fairly easy to compute.
  4. The endomorphic Laver tables currently have nothing to do with linear algebra, fourier transforms, or anything of that sort. This is an advantage since quantum algorithms tend to rely on these techniques that have nothing to do with Laver tables. Therefore since quantum algorithms do not seem to help with calculating anything related to Laver tables, endomorphic Laver tables may be useful in post-quantum cryptography (post-quantum cryptography refers to the study of public key cryptosystems that resist attacks from parties that have access to quantum computers).

I will put up a post soon about the various endomorphic Laver tables based cryptosystems along with a preliminary analysis of one of those cryptosystems. It is currently unclear as to whether endomorphic Laver table based cryptosystems are secure and much more investigation on endomorphic Laver tables is necessary before I can gain any confidence about the security of endomorphic Laver table based cryptosystems.

Generalizations of Laver tables Abridged posted!

The abridged version of the paper containing all the research on generalizations of Laver tables which I have done on and off for about two years is now posted here. This version contains all definitions, theorems, but I have omitted the proofs of the theorems since I am still editing the proofs. The unabridged version of the paper should be about 135 pages or so.

From the mid 1990’s to about 2012, no results have been published on Laver tables or the quotient algebras of elementary embeddings. Nevertheless, set theorists have considered the algebras of elementary embeddings to be important enough that they have devoted Chapter 11 in the 24 chapter Handbook of Set Theory to the algebras of elementary embeddings.

Since I am the only one researching generalizations of Laver tables, and only 3 other people have published on Laver tables since the 1990’s, I have attempted to make the paper self-contained and readable to a general mathematician.

Any comments or criticism either by e-mail or on this post about the paper would be appreciated including typos and other errors.

Let me now summarize some of the results from the paper.

  1. The double inductive definition of a Laver table extends greatly to a universal algebraic context where we may have some of the following:
    • The algebra may be generated by many elements (multigenic Laver tables).
    • The algebra may have many fundamental operations (multi-Laver tables).
    • The algebra may have fundamental operations of higher arity (endomorphic Laver tables).
    • Only some of the fundamental operations are self-distributive (partially endomorphic Laver tables).
    • The fundamental operations satisfy a twisted version of self-distributivity such as
      $$t(a,b,c,t(w,x,y,z))$$ $$=t(t(a,b,c,w),t(b,c,a,x),t(c,a,b,y),t(a,b,c,z))$$
      (twistedly endomorphic Laver tables).
  2. The notion of a permutative LD-system algebraizes most of the properties that one obtains from the quotient algebras of elementary embeddings. For instance, permutative LD-systems have a notion of a composition operation, critical point, and equivalence up to an ordinal and these notions satisfy most of the properties that algebras of elementary embeddings satisfy. These notions are not contrived to look like the algebras of elementary embeddings since the critical point, composition, and equivalence up to an ordinal are fundamental to the theory of permutative LD-systems. Every quotient algebra of elementary embeddings $\mathcal{E}_{\lambda}/\equiv^{\gamma}$ is a permutative LD-system but the converse does not hold. The notion of a permutative LD-system provides a natural framework by which one can prove results about finite structures using large cardinal hypotheses.
  3. The set $(A^{\leq 2^{n}})^{+}$ consisting of all non-empty strings from the alphabet $A$ of length at most $2^{n}$ can be endowed with a unique self-distributive operation $*$ such that $\mathbf{x}*\mathbf{y}=\mathbf{y}$ whenever $|\mathbf{x}|=2^{n}$ and where $\mathbf{x}*a=\mathbf{x}a$ whenever $|\mathbf{x}|<2^{n}$ ($((A^{\leq 2^{n}})^{+},*)$ is a multigenic Laver table). The operation $*$ can be computed on a standard computer as long as $n$ is at most 26 or so (if $n=26$, then the output $\mathbf{x}*\mathbf{y}$ could have length up to $2^{26}$ so we run into some memory issues). All of the combinatorial information in the operation $*$ is contained within the classical Laver table $A_{n}$ along with a function $FM_{n}^{-}:\{1,...,2^{n}\}\times\{1,...,2^{n}\}\rightarrow\mathbb{Z}\setminus\{0\}$ called the final matrix. Entries in $FM_{n}^{-}$ can generally be computed on a standard computer in milliseconds as long as $n\leq 48$ (we reach the limit $n\leq 48$ since $A_{48}$ is the largest classical Laver table ever computed.). While the entries in $FM_{n}^{-}$ can be computed fairly quickly when one knows the classical Laver table $A_{n}$, the final matrices are combinatorially complex objects which contain intricacies which are not present in the classical Laver tables. The positive entries of the final matrix presumably form a subset of the Sierpinski triangle. There are many phenomena in the final matrices which I have observed experimentally but which have not been proven mathematically and which currently do not have any explanation.
  4. The multigenic Laver tables $(A^{\leq 2^{n}})^{+}$ form an inverse system. If for all $n$, there exists an $n$-huge cardinal, then almost every finite or countable subset of $\varprojlim_{n}(A^{\leq 2^{n}})^{+}$ freely generates a free LD-system (and even a free LD-monoid). Recall that Richard Laver has proven in the 1990’s that the free left-distributive algebra on one generator can be embedded into an inverse limit of classical Laver tables. I have therefore constructed the machinery to prove an analogous result for free left-distributive algebras on multiple generators.
  5. We present methods of producing new finite permutative LD-systems from old finite permutative LD-systems including
    • extending a multigenic Laver table to a larger multigenic Laver table with one more critical point, and
    • extending a permutative LD-system to a larger permutative LD-system by adding one point at a time.
  6. Not every finite reduced permutative LD-system arises as a subalgebra of a quotient of an algebra of elementary embeddings. This counterexample suggests that there may be an inconsistency in the large cardinal hierarchy first appearing somewhere between the huge cardinals and Berkeley cardinals (and hopefully at the level above I0).
  7. While the output of the endomorphic Laver table operations is typically very large. One can still compute information about the output of the endomorphic Laver table operations. As one would expect, the endomorphic Laver tables exhibit a sort of combinatorial complexity beyond the classical and multigenic Laver tables.
  8. Non-abelian group based cryptosystems such as the Anshel-Anshel-Goldfeld and Ko-Lee key exchanges extend to self-distributive algebras and also endomorphic algebras. The endomorphic Laver tables may be a good platform for such cryptosystems, but I do not know much about the security of the endomorphic Laver table based cryptosystem, and I have much uneasiness about the security of such cryptosystems even though I have not yet launched an attack (I have an idea of how an attack may work though).

Ternary Laver table calculator (now optimized for efficiency)

At this link, you can find an easy-to-use ternary Laver table calculator which I have just programmed which returns specific information about the output of a ternary Laver table operation. The calculator works for very specific types of ternary Laver tables. Furthermore, at this link, you can find another ternary Laver table calculator that will return the entire (sometimes very large) output of a certain ternary Laver table operation.

The ternary Laver tables are much different than the classical and multigenic Laver tables (I used to call the multigenic Laver tables “generalized Laver tables”) computationally in the following ways:

  1. Unlike the classical Laver tables and multigenic Laver tables which are locally finite, the endomorphic Laver tables are infinite.
  2. The output of a ternary Laver table operation can grow exponentially with respect to the size of the input.
  3. While the fundamental operation on the multigenic Laver tables $(A^{\leq 2^{n}})^{+}$ can be completely described by the final matrix, there does not seem to be any final matrix for the ternary Laver tables. Each ternary Laver table seems to offer unlimited combinatorial complexity.
  4. The ternary Laver tables are much more abundant than the multigenic Laver tables. We have very general methods of constructing many ternary Laver tables.
  5. While the classical Laver tables and multigenic Laver tables are not suitable platforms for public key cryptosystems, it seems like the ternary Laver tables could be platforms for public key cryptosystems.

And I will probably post the version of the paper on Generalizations of Laver tables (135 pages with proofs and 86 pages without proofs) without proofs in a couple of days. Let me know if the calculator is easy to use or not.

As with the classical and multigenic Laver tables, the ternary Laver tables also produce vivid images. I will post these images soon.

Zoom into the classical Laver table fractals

At this link, you may zoom into the fractal representing the classical Laver tables.

For all $n$, let $L_{n}:\{0,\ldots,2^{n-1}\}\rightarrow\{0,\ldots,2^{n-1}\}$ be the mapping that reverses the digits in the binary expansion of a natural number. Let $L_{n}^{\sharp}:\{1,\ldots,2^{n}\}\rightarrow\{1,\ldots,2^{n}\}$ be the mapping where
$L_{n}^{\sharp}(x)=L_{n}(x-1)+1$. Let $\#_{n}$ be the operation on $\{1,\ldots,2^{n}\}$ defined by $x\#_{n}y=L_{n}^{\sharp}(L_{n}^{\sharp}(x)*_{n}L_{n}^{\sharp}(y))$ where $*_{n}$ is the classical Laver table operation on $\{1,\ldots,2^{n}\}$.

Let $C_{n}=\{(\frac{x}{2^{n}},\frac{x\#_{n}y}{2^{n}})\mid x,y\in\{1,\ldots,2^{n}\}\}$. Then $C_{n}$ is a subset of $[0,1]\times[0,1]$ and the sets $C_{n}$ converge in the Hausdorff metric to a compact subset $C\subseteq[0,1]\times[0,1]$. The link that I gave gives images of $C$ that you may zoom in to.

Since $A_{48}$ is still the largest classical Laver table ever computed, we are only able to zoom into $C$ with $2^{48}\times 2^{48}$ resolution (which is about 281 trillion by 281 trillion so we can see microscopic detail).

As I kind of expected, these images of the classical Laver tables are quite tame compared to the wildness of the final matrix which one obtains from the generalized Laver tables $(A^{\leq 2^{n}})^{+}$; the generalized Laver tables give more fractal-like images while the classical Laver tables give more geometric images. I conjecture that the set $C$ has Hausdorff dimension $1$ though I do not have a proof. The simplicity of these images of the classical Laver tables gives some hope for computing the classical Laver tables past even $A_{96}$.

Some regions in the set $C$ may look to be simply smooth vertical or diagonal lines, but if there exists a rank-into-rank cardinal, then every single neighborhood in $C$ has fractal features if you zoom in far enough (I suspect that you will need to zoom in for a very very long time before you see any fractal features and I also suspect that you will need to zoom into the right location to see the fractal behavior).

Some new results on finite algebras whose only known proof uses large cardinals (updated)

The large cardinals above hugeness are a very powerful tool for proving results about finite self-distributive algebras, but mathematicians so far have neglected to exploit the tremendous power of these very large cardinals to prove results about finite objects. Initially around the late 80’s and early 90’s, Laver and other mathematicians have established some very good classical results about the Laver tables. On the other hand, from the later 1990’s to the 2010’s, no mathematician has published any original research that directly relates to what I call Laver-like LD-systems. Furthermore, before my work on the algebras of elementary embeddings, nobody has investigated what will happen in the algebras of elementary embeddings generated by more than one element.
There are two results about the classical Laver tables which presumably require large cardinals to establish. One of these results states that the inverse limit of the classical Laver tables contains free left-distributive algebras on one generator while the other result states that in the classical Laver table $A_{n}$, we have $2*_{n}x=2^{n}\Rightarrow 1*_{n}x=2^{n}$. All of the other results about the classical Laver tables are known to hold in ZFC.

In this post, we shall use large cardinals and forcing to prove the existence of certain classes of finite self-distributive algebras with a compatible linear ordering. The results contained in this note shall be included in my (hopefully soon to be on Arxiv) 100+ page paper Generalizations of Laver tables. In this post, I have made no attempt to optimize the large cardinal hypotheses.

For background information, see this post or see Chapter 11 in the Handbook of Set Theory.

We shall let $\mathcal{E}_{\alpha}$ denote the set of all elementary embeddings $j:V_{\alpha}\rightarrow V_{\alpha}.$
By this answer, I have outlined a proof that the algebra $\mathcal{E}_{\lambda}/\equiv^{\gamma}$ is locally finite. We therefore have established a deep connection between the top of the large cardinal hierarchy and finite algebras.

In this note, we shall use two important ideas to construct finite self-distributive algebras. The main idea is to generalize the square root lemma for elementary embeddings so that one obtains elementary embeddings with the desired properties.

$\textbf{Theorem: (Square Root Lemma)}$ Let $j\in\mathcal{E}_{\lambda+1}$. Then there is some $k\in\mathcal{E}_{\lambda}$ where $k*k=j|_{V_{\lambda}}$.

$\mathbf{Proof}:$ By elementarity
$$V_{\lambda+1}\models\exists k\in\mathcal{E}_{\lambda}:k*k=j|_{V_{\lambda}}$$
if and only if
$$V_{\lambda+1}\models\exists k\in\mathcal{E}_{\lambda}:k*k=j(j|_{V_{\lambda}})$$
which is true. Therefore, there is some $k\in\mathcal{E}_{\lambda}$ with $k*k=j|_{V_{\lambda}}$. $\mathbf{QED}$

The other idea is to work in a model such that there is a cardinal $\lambda$ where there are plenty of rank-into-rank embeddings from $V_{\lambda}$ to $V_{\lambda}$ but where $V_{\lambda}\models\text{V=HOD}$. If $V_{\lambda}\models\text{V=HOD}$, then $V_{\lambda}$ has a definable linear ordering which induces a desirable linear ordering on rank-into-rank embeddings and hence linear orderings on finite algebras. The following result can be found in this paper.

$\mathbf{Theorem}$ Suppose that there exists a non-trivial elementary embedding $j:V_{\lambda+1}\rightarrow V_{\lambda+1}$. Then in some forcing extension $V[G]$ there is some elementary embedding $k:V[G]_{\lambda+1}\rightarrow V[G]_{\lambda+1}$ where
$V[G]_{\lambda}\models\text{V=HOD}$.

Therefore it is consistent relative to large cardinals that there exists a non-trivial elementary embedding $j:V_{\lambda+1}\rightarrow V_{\lambda+1}$ such that $V_{\lambda}\models\text{V=HOD}$.

Now suppose that $V_{\lambda}\models\text{V=HOD}$. Then there exists a linear ordering $\ll$ of $V_{\lambda}$ which is definable in $V_{\lambda}$. If $j\in\mathcal{E}_{\lambda}$ and $\gamma$ is a limit ordinal with $\gamma<\lambda$, then define $j\upharpoonright_{\gamma}:V_{\gamma}\rightarrow V_{\gamma+1}$ by $j\upharpoonright_{\gamma}(x)=x\cap V_{\gamma}$ for each $x\in V_{\gamma}.$ Take note that $j\upharpoonright_{\gamma}=k\upharpoonright_{\gamma}$ if and only if $j\equiv^{\gamma}k$. Define a linear ordering $\trianglelefteq$ on $\mathcal{E}_{\lambda}$ where $j\trianglelefteq k$ if and only if $j=k$ or there is a limit ordinal $\alpha$ where $j\upharpoonright_{\alpha}\ll k\upharpoonright_{\alpha}$ but where $j\upharpoonright_{\beta}=k\upharpoonright_{\beta}$ whenever $\beta<\alpha$. Define a linear ordering $\trianglelefteq$ on $\{j\upharpoonright_{\gamma}\mid j\in\mathcal{E}_{\lambda}\}$ by letting $j\upharpoonright_{\gamma}\triangleleft k\upharpoonright_{\gamma}$ if and only if there is some limit ordinal $\beta\leq\gamma$ where $j\upharpoonright_{\beta}\ll k\upharpoonright_{\beta}$ but where $j\upharpoonright_{\alpha}=k\upharpoonright_{\alpha}$ whenever $\alpha$ is a limit ordinal with $\alpha<\beta$. By elementarity, the linear ordering $\trianglelefteq$ satisfies the following compatibility property: if $k\upharpoonright_{\gamma}\trianglelefteq l\upharpoonright_{\gamma}$, then $(j*k)\upharpoonright_{\gamma}\trianglelefteq(j*l)\upharpoonright_{\gamma}$. We say that a linear ordering $\leq$ on a Laver-like LD-system $(X,*)$ is a compatible linear ordering if $y\leq z\Rightarrow x*y\leq x*z$. If $V_{\lambda}\models\text{V=HOD}$, then $\mathcal{E}_{\lambda}/\equiv^{\gamma}$ has a compatible linear ordering defined by $[j]_{\gamma}\leq[k]_{\gamma}$ if and only if $j\upharpoonright_{V_{\gamma}}\trianglelefteq k\upharpoonright_{V_{\gamma}}$.

Using generalized Laver tables, we know that the set $\{\text{crit}(j):j\in\langle j_{1},…,j_{n}\rangle\}$ has order-type $\omega$. Let $\text{crit}_{r}(j_{1},…,j_{n})$ be the $r$-th element of the set $$\{\text{crit}(j):j\in\langle j_{1},…,j_{n}\rangle\}$$ ($\text{crit}_{0}(j_{1},…,j_{n})$ is the least element of $\{\text{crit}(j):j\in\langle j_{1},…,j_{n}\rangle\}$). Let $T:\bigcup_{n\in\omega}\mathcal{E}_{\lambda}^{n}\rightarrow V_{\omega\cdot 2}$ be a mapping definable in $(V_{\lambda+1},\in)$ where $T(j_{1},…,j_{m})=T(k_{1},…,k_{n})$ if and only if $m=n$ and if $\gamma=\text{crit}_{r} (j_{1},…,j_{m})$ and $\delta=\text{crit}_{r}(k_{1},…,k_{n})$, then there is some isomorphism $\phi:\langle j_{1},…,j_{m}\rangle/\equiv^{\gamma}\rightarrow\langle k_{1},…,k_{n}\rangle/\equiv^{\delta}$ where $\phi([j_{i}]_{\gamma})=[k_{i}]_{\delta}$. We remark that if $T(j_{1},…,j_{m})=T(k_{1},…,k_{n})$, then the subspaces $\overline{\langle j_{1},…,j_{m}\rangle}$ and $\overline{\langle k_{1},…,k_{n}\rangle}$ of $\mathcal{E}_{\lambda}$ are homeomorphic by an isomorphism of algebras preserving $*,\circ$ ($\mathcal{E}_{\lambda}$ can be given a complete metric that induces a canonical uniformity on $\mathcal{E}_{\lambda}$).

The following technical result is a generalization of the Square-Root Lemma, and a simplified special case of the following results can be found in this answer that I gave.

$\mathbf{Theorem:}$ Suppose the following:

  1. $\ell_{1},…,\ell_{p},j_{1},…,j_{m}\in\mathcal{E}_{\lambda}$ and $(k_{r,s})_{1\leq r\leq n,1\leq s\leq p}\in(\mathcal{E}_{\lambda})^{n\cdot p}$.
  2. $\ell_{1},…,\ell_{p}$ are I1 embeddings.
  3. $T(\ell_{i}*j_{1},…,\ell_{i}*j_{m},k_{1,i},…,k_{n,i})=x_{i}$ whenever $1\leq i\leq p$.
  4. $v$ is a natural number.
  5. there is some $\mu<\lambda$ where $\mu=\text{crit}_{v}(k_{1,1},...,k_{n,1})=\ldots=\text{crit}_{v}(k_{1,p},...,k_{n,p})$.
  6. $k_{r,1}\equiv^{\mu}…\equiv^{\mu}k_{r,p}$ for $1\leq r\leq n$.
  7. $\ell_{1}\equiv^{\mu+\omega}…\equiv^{\mu+\omega}\ell_{p}$.

Then there are $(w_{r,s})_{1\leq r\leq n,1\leq s\leq p}$ in $\mathcal{E}_{\lambda}$ where

  1. $T(j_{1},…,j_{m},w_{1,i},…,w_{n,i})=x_{i}$ for $1\leq i\leq p$,
  2. there is some $\alpha<\lambda$ where $\text{crit}_{v}(w_{1,i},...,w_{n,i})=\alpha$ for $1\leq i\leq p$, and
  3. $w_{r,1}\equiv^{\alpha}\ldots\equiv^{\alpha}w_{r,p}$ for $1\leq r\leq n$.

$\mathbf{Proof:}$ For $1\leq i\leq p$, let $A_{i}$
$$=\{(w_{1}\upharpoonright_{\text{crit}_{v}(w_{1},…,w_{n})},…,w_{n}\upharpoonright_{\text{crit}_{v}(w_{1},…,w_{n})}):
T(j_{1},…,j_{m},w_{1},…,w_{n})=x_{i}\}.$$
Then $\ell_{i}(A_{i})$
$$=\{(w_{1}\upharpoonright_{\text{crit}_{v}(w_{1},…,w_{n})},…,w_{n}\upharpoonright_{\text{crit}_{v}(w_{1},…,w_{n})}):
T(\ell_{i}*j_{1},…,\ell_{i}*j_{m},w_{1},…,w_{n})=x_{i}\}.$$
Therefore,
$$(k_{1,i}\upharpoonright_{\mu},…,k_{n,i}\upharpoonright_{\mu})\in\ell_{i}(A_{i})$$ for $1\leq i\leq p$. Since
$k_{r,1}\upharpoonright_{\mu}=…=k_{r,p}\upharpoonright_{\mu}$, we have
$$(k_{1,1}\upharpoonright_{\mu},…,k_{n,1}\upharpoonright_{\mu})=…=(k_{1,p}\upharpoonright_{\mu},…,k_{n,p}\upharpoonright_{\mu}).$$
Therefore, let $$(\mathfrak{k}_{1},…,\mathfrak{k}_{n})=(k_{1,1}\upharpoonright_{\mu},…,k_{n,1}\upharpoonright_{\mu}).$$
Then
$$(\mathfrak{k}_{1},…,\mathfrak{k}_{n})\in\ell_{1}(A_{1})\cap…\ell_{p}(A_{p})\cap V_{\mu+\omega}$$
$$=\ell_{1}(A_{1})\cap…\cap\ell_{1}(A_{p})\cap V_{\mu+\omega}$$
$$\subseteq\ell_{1}(A_{1}\cap…\cap A_{p}).$$
Therefore, $A_{1}\cap…\cap A_{p}\neq\emptyset.$

Let $(\mathfrak{w}_{1},…,\mathfrak{w}_{n})\in A_{1}\cap…\cap A_{p}$. Then there are $(w_{r,s})_{1\leq r\leq n,1\leq s\leq p}$ in $\mathcal{E}_{\lambda}$ where
$$(\mathfrak{w}_{1},…,\mathfrak{w}_{n})=(w_{1,i}\upharpoonright_{\text{crit}_{v}(w_{1,i},…,w_{n,i})},…,w_{n,i}\upharpoonright_{\text{crit}_{v}(w_{1,i},…,w_{n,i})})$$
and
$$T(j_{1},…,j_{m},w_{1,i},…,w_{n,i})=x_{i}$$
for $1\leq i\leq p.$ Therefore, there is some $\alpha<\lambda$ with $\text{crit}_{v}(w_{1,s},...,w_{n,s})=\alpha$ for $1\leq s\leq p$ and where $w_{r,1}\equiv^{\alpha}\ldots\equiv^{\alpha}w_{r,p}$ for $1\leq r\leq n$. $\mathbf{QED}$

$\mathbf{Remark:}$ The above theorem can be generalized further by considering the classes of rank-into-rank embeddings
described in this paper.

$\mathbf{Theorem:}$ Suppose that there exists an I1 cardinal. Suppose furthermore that

  1. $U_{1},…,U_{p},V_{1},…,V_{m}$ and $(W_{r,s})_{1\leq r\leq n,1\leq s\leq p}$ are unary terms in the language with function symbols $*,\circ$,
  2. $L$ is an $np+1$-ary term in the language with function symbols $*,\circ$,
  3. $v$ is a natural number,
  4. There is some classical Laver table $A_{N}$ where in $A_{N}$, we have
    \[\mu=\text{crit}_{v}(W_{1,1}(1),…,W_{n,1}(1))=…=\text{crit}_{v}(W_{1,p}(1),…,W_{n,p}(1))<\text{crit}(2^{n}).\]
  5. For all $N$, we have $W_{r,1}\equiv^{\mu}\ldots\equiv^{\mu}W_{r,p}(1)$ for $1\leq r\leq n$,
  6. $U_{1}(1)\equiv^{\mu^{+}}\ldots\equiv^{\mu^{+}}U_{p}(1)$.

If $Y$ is a finite reduced Laver-like LD-system, then let $\approx$ be the relation on $Y^{<\omega}$ where $(x_{1},...,x_{m})\approx(y_{1},...,y_{n})$ if and only if $m=n$ and whenever $\langle x_{1},...,x_{m}\rangle$ and $\langle y_{1},...,y_{n}\rangle$ both have more than $v+1$ critical points, then there is an isomorphism \[\iota:\langle x_{1},...,x_{m}\rangle/\equiv^{\text{crit}_{v}(x_{1},...,x_{m})}\rightarrow \langle y_{1},...,y_{n}\rangle/\equiv^{\text{crit}_{v}(y_{1},...,y_{n})}\] where $\iota([x_{i}])=[y_{i}]$ for $1\leq i\leq n$.
Then there is some finite reduced Laver-like LD-system $X$ along with
\[x,(y_{r,s})_{1\leq r\leq n,1\leq s\leq p}\in X\]
such that

  1. $X$ has a compatible linear ordering,
  2. \[(U_{s}(x)*V_{1}(x),…,U_{s}(x)*V_{m}(x),W_{1,s}(x),…,W_{n,s}(x))\]
    \[\approx(V_{1}(x),…,V_{m}(x),y_{1,s},…,y_{n,s}),\]
  3. ind

  4. there is some critical point $\alpha$ where $\text{crit}_{v}(y_{1,s},…,y_{n,s})=\alpha$ for all $s$, and
  5. $y_{r,1}\equiv^{\alpha}\ldots\equiv^{\alpha}y_{r,p}$.
  6. $L(x,(y_{r,s})_{1\leq r\leq n,1\leq s\leq p})\neq 1$.
Challenge

I challenge the readers of this post to remove the large cardinal hypotheses from the above theorem (one may still use the freeness of subalgebras $\varprojlim_{n}A_{n}$ and the fact that $2*_{n}x=2^{n}\Rightarrow 1*_{n}x=2^{n}$ though).

Added 2/4/2017

So it turns out that by taking stronger large cardinal axioms, one can induce a linear ordering on the algebras of elementary embeddings without having to resort to working in forcing extensions. We say that a cardinal $\delta$ is an I1-tower cardinal if for all $A\subseteq V_{\delta}$ there is some $\kappa<\delta$ such that whenever $\gamma<\delta$ there is some cardinal $\lambda<\delta$ and non-trivial elementary embedding $j:V_{\lambda+1}\rightarrow V_{\lambda+1}$ such that $\text{crit}(j)=\kappa$ and where $j(\kappa)>\delta$ and where $j(A)=A$. If $A$ is a good enough linear ordering on $V_{\delta}$, then $A\cap V_{\lambda}$ induces a compatible linear ordering the set of all elementary embeddings $j:V_{\lambda}\rightarrow V_{\lambda}$ such that $j(A\cap V_{\gamma})=A\cap V_{j(\gamma)}$ for all $\gamma<\lambda$. It is unclear where the I1-tower cardinals stand on the large cardinal hierarchy or whether they are even consistent.

Added 2/12/2017

It turns out that we can directly show that if $j:V_{\lambda+1}\rightarrow V_{\lambda+1}$ is a non-trivial elementary embedding, then there is a linear ordering $B$ of $V_{\lambda}$ where $j(B)=B$. In fact, if $j:V_{\lambda}\rightarrow V_{\lambda}$ is a non-trivial elementary embedding, $\mathrm{crit}(j)=\kappa$, and $A$ is a linear ordering of $V_{\lambda}$, then if we let $B=\bigcup_{n}j^{n}(A)$, then $B$ is a linear ordering of $V_{\lambda}$ and $j(B\cap V_{\gamma})=B\cap V_{j(\gamma)}$ whenever $\gamma<\lambda$. In particular, if $j$ extends to an elementary embedding $j^{+}:V_{\lambda+1}\rightarrow V_{\lambda+1}$, then $j^{+}(B)=B$. One can therefore prove the results about finite permutative LD-systems by working with the linear ordering that comes from $B$ instead of the linear ordering that comes from the fact that $V_{\lambda}[G]\models V=HOD$ in some forcing extension. One thing to be cautious of when one announces results before publication is that perhaps the proofs are not optimal and that one can get away with a simpler construction.

Philosophy and research project proposals

In the above results, we have worked in a model $V$ where there are non-trivial maps $j:V_{\lambda}\rightarrow V_{\lambda}$ and where $V_{\lambda}\models\text{V=HOD}$ in order to obtain compatible linear orderings on finite algebras. However, if we work in different forcing extensions with rank-into-rank embeddings instead, then I predict that one may obtain from large cardinals different results about finite algebras.

I predict that in the near future, mathematicians will produce many results about finite or countable self-distributive algebras using forcing and large cardinals where the large cardinal hypotheses cannot be removed. I also predict that rank-into-rank cardinals will soon prove results about structures that at first glance have little to do with self-distributivity.

The question of consistency

I must admit that I am not 100 percent convinced of the consistency of the large cardinals around the rank-into-rank level. My doubt is mainly due to the existence of finite reduced Laver-like LD-systems which cannot be subalgebras of $\mathcal{E}_{\lambda}/\equiv^{\gamma}$. However, if no inconsistency is found, then the results about finite or countable structures that arise from very large cardinals would convince me not only of the consistency of very large cardinals but also the existence of these very large cardinals. Therefore, people should investigate the finite algebras which arise from very large cardinals in order to quell all doubts about the consistency or the existence of these very large cardinals.

Since it is much more likely that the Reinhardt cardinals are inconsistent than say the I1 cardinals are inconsistent, I also propose that we attempt to use the algebras of elementary embeddings to show that Reinhardt cardinals are inconsistent. I have not seen anyone investigate the self-distributive algebras of elementary embeddings at the Reinhardt level. However, I think that investigating the self-distributive algebras of elementary embeddings would be our best hope in proving that the Reinhardt cardinals are inconsistent.

Some new pages on Laver tables.

I have added the following new pages on the classical Laver tables.

The classical Laver tables can be given in ZFC a linear ordering such that the endomorphisms are monotone functions. When we reorder the classical Laver tables according to this compatible linear ordering we get the tables in the following link.
http://boolesrings.org/jvanname/lavertables-database-classical-fullcompatibletabletoa5/

The following link gives the compressed versions of the multiplication table for the classical Laver tables reordered according to the compatible linear ordering.
http://boolesrings.org/jvanname/lavertables-database-classical-alltablescompatibletoa10/

The compatible linear ordering on the classical Laver tables produces fractal like patterns that converge to a compact subset of the unit square. These images are found on the following link.
http://boolesrings.org/jvanname/lavertables-visualization-classical-imagesofcompatibletables/

And this page gives images of the fractal pattern that comes from the classical Laver tables.
http://boolesrings.org/jvanname/lavertables-visualization-classical-imagesoftables/

Hopefully I will be able to finish my long paper on the classical Laver tables over the next couple of months.

Why complete regularity rather than Hausdorff is the correct cutoff point between lower and higher separation axioms

Disclaimer: By regular (completely regular) we mean regular (completely regular) and $T_{0}$

In general topology, there are two different kinds of topological spaces. There are the topological spaces that satisfy higher separation axioms such as the 3 dimensional space that we live in; when most people think of general topology (especially analysts and algebraic topologists), they usually think of spaces which satisfy higher separation axioms. On the other hand, there are topological spaces which only satisfy lower separation axioms; these spaces at first glance appear very strange since sequences can converge to multiple points. They feel much different from spaces which satisfy higher separation axioms. These spaces include the Zariski topology, finite non-discrete topologies, and the cofinite topology. Even spaces that set theorists consider such as the ordinal topology on a cardinal $\kappa$ or the Stone-Cech compactication $\beta\omega$ satisfy higher separation axioms; after all, $\beta\omega$ is the maximal ideal space of $\ell^{\infty}$. The general topology of lower separation axioms is a different field of mathematics than the general topology of higher separation axioms.

However, can we in good conscience formally draw the line between the lower separation axioms and the higher separation axioms or is the notion of a higher separation axiom simply an informal notion? If there is a line, then where do we draw the line between these two kinds of topological spaces?

As the sole owner of a silver badge in general topology on mathoverflow, I declare that the axiom complete regularity is the place where we need to draw the line between the lower separation axioms and the higher separation axioms. I can also argue that complete regularity is correct cutoff point by appealing to an authority greater than myself; the American Mathematical Society’s MSC-classification (the authority on classifying mathematics subjects) also delineates the lower separation axioms and the higher separation axioms at around complete regularity:
54D10-Lower separation axioms ($T_0$–$T_3$, etc.)
54D15-Higher separation axioms (completely regular, normal, perfectly or collectionwise normal, etc.)

Let me now give a few reasons why complete regularity is the pivotal separation axiom.

Hausdorffness is not enough. We need at least regularity.

Hausdorff spaces are appealing to mathematicians because Hausdorff spaces are precisely the spaces where each net (or filter) converges to at most one point. However, the condition that every net converges to at most one point should not be enough for a space to feel like it satisfies higher separation axioms. Not only do I usually want filters to converge to at most one point, but I also want the closures of the elements in a convergent filter to also converge. However, this condition is equivalent to regularity.

$\mathbf{Proposition}:$ Let $X$ be Hausdorff space. Then $X$ is regular if and only if whenever $\mathcal{F}$ is a filter that converges to a point $x$, the filterbase $\{\overline{R}\mid R\in\mathcal{F}\}$ also converges to the point $x$.

The next proposition formulates regularity in terms of the convergence of nets. The intuition behind the condition in the following proposition is that for spaces that satisfy higher separation axioms, if $(x_{d})_{d\in D},(y_{d})_{d\in D}$ are nets such that $x_{d}$ and $y_{d}$ get closer and closer together as $d\rightarrow\infty$, and if $(y_{d})_{d\in D}$ converges to a point $x$, then $(x_{d})_{d\in D}$ should also converge to the same point $x$.

$\mathbf{Proposition}$ Let $X$ be a Hausdorff space. Then $X$ is regular if and only if whenever $(x_{d})_{d\in D}$ is a net that does not converge to a point $x$, there are open neighborhoods $U_{d}$ of $x_{d}$ such that whenever $y_{d}\in U_{d}$ for $d\in D$, the net $(y_{d})_{d\in D}$ does not converge to the point $x$ either.

$\mathbf{Proof:}$ $\rightarrow$ Suppose that $(x_{d})_{d\in D}$ does not converge to $x$. Then there is an open neighborhood $U$ of $x$ where $\{d\in D\mid x_{d}\not\in U\}$ is cofinal in $D$. Therefore, there is some open set $V$ with $x\in V\subseteq\overline{V}\subseteq U$. Therefore, let $U_{d}=(\overline{V})^{c}$ whenever $d\in D$ and $U_{d}$ be an arbitrary set otherwise. Then whenever $y_{d}\in U_{d}$ for each $d\in D$, the set $\{d\in D\mid y_{d}\not\in U\}$ is cofinal in $D$. Therefore, $(y_{d})_{d\in D}$ does not converge to $x$ either.

$\leftarrow$ Suppose now that $X$ is not regular. Then there is an $x\in X$ and an open neighborhood $U$ of $x$ such that if $V$ is an open set with $x\in V$, then $V\not\subseteq U$. Therefore, let $D$ be a directed set and let $U_{d}$ be an open neighborhood of $x$ for each $d\in D$ such that for all open neighborhoods $V$ of $x$ there is a $d\in D$ so that if $e\geq d$, then $U_{d}\subseteq V$. Then let $x_{d}\in\overline{U_{d}}\setminus U$ for all $d\in D$. Then $(x_{d})_{d\in D}$ does not converge to $x$. Now suppose that $V_{d}$ is a neighborhood of $x_{d}$ for each $d\in D$. Then for each $d\in D$, we have $V_{d}\cap U_{d}\neq\emptyset$. Therefore, let $y_{d}\in V_{d}\cap U_{d}$. Then $(y_{d})_{d\in D}$ does converge to $x$. $\mathbf{QED}$.

Complete regularity is closed under most reasonable constructions

If there is a main separation axiom that draws the line between higher separation axioms and lower separation axioms, then this main separation axiom should be closed under constructions such as taking subspaces and taking arbitrary products. Since every completely regular space is isomorphic to a subspace $[0,1]^{I}$, the crossing point between lower and higher separation axioms should be no higher than complete regularity.

Not only are the completely regular spaces closed under taking products and subspaces, but the completely regular spaces are also closed under taking ultraproducts, the $P$-space coreflection, box products and other types of products, and various other constructions. Since we want our main separation axiom to be closed under most reasonable standard constructions and no lower than regularity, regularity and complete regularity are the only two candidates for our main separation axiom. We shall now find out why complete regularity is a better candidate than regularity for such a separation axiom.

Completely regular spaces can be endowed with richer structure

The completely regular spaces are precisely the spaces which can be given extra structure that one should expect to have in a topological space.

While a topological space gives one the notion of whether a point is touching a set, a proximity gives on the notion of whether two sets are touching each other. Every proximity space has an underlying topological space. Proximity spaces are defined in terms of points and sets with no mention of the real numbers, but proximity spaces are always completely regular. Furthermore, the compatible proximities on a completely regular space are in a one-to-one correspondence with the Hausdorff compactifications of the space.

$\mathbf{Theorem:}$ A topological space is completely regular if and only if it can be endowed with a compatible proximity.

The notion of a uniform space is a generalization of the notion of a metric space so that one can talk about concepts such as completeness, Cauchy nets, and uniform continuity in a more abstract setting. A uniform space gives one the notion of uniform continuity in the same way the a topological space gives one the notion of continuity. The definition of a uniform space is also very set theoretic, but it turns out that that every uniform space is induced by a set of pseudometrics and hence completely regular.

$\mathbf{Theorem:}$ A topological space is completely regular if and only if it can be endowed with a compatible uniformity.

For example, it is easy to show that every $T_{0}$-topological group can be given a compatible uniformity. Therefore, since the topological groups can always be given compatible uniformities, every topological group (and hence every topological vector space) is automatically completely regular.

Complete regularity is the proper line of demarcation between low and high separation axioms since the notions of a proximity and uniformity (which capture intuitive notions related to topological spaces without referring to the real numbers) induce precisely the completely regular spaces.

The Hausdorff separation axiom generalizes poorly to point-free topology

I realize that most of my readers probably have not yet been convinced of the deeper meaning behind point-free topology, but point-free topology gives additional reasons to prefer regularity or complete regularity over Hausdorffness.

Most concepts from general topology generalize to point-free topology seamlessly including separation axioms (regularity, complete regularity, normality), connectedness axioms (connectedness, zero-dimensionality, components), covering properties (paracompactness,compactness, local compactness, the Stone-Cech compactification), and many other properties. The fact that pretty much all concepts from general topology extend without a problem to point-free topology indicates that point-free topology is an interesting and deep subject. However, the notion of a Hausdorff space does not generalize very well from point-set topology to point-free topology. There have been a couple attempts to generalize the notion of a Hausdorff space to point-free topology. For example, John Isbell has defined an I-Hausdorff frame to be a frame $L$ such that the diagonal mapping $D:L\rightarrow L\oplus L$ is a closed localic mapping ($\oplus$ denotes the tensor product of frames). I-Hausdorff is a generalization of Hausdorffness since it generalizes the condition “$\{(x,x)\mid x\in X\}$ is closed” which is equivalent to Hausdorffness. Dowker and Strauss have also proposed several generalizations of Hausdorffness. You can read more about these point-free separation axioms at Karel Ha’s Bachelor’s thesis here. These many generalizations of the Hausdorff separation axioms are not equivalent. To make matters worse, I am not satisfied with any of these generalizations of Hausdorffness to point-free topology.

It is often the case that when an idea from general topology does not extend very well to point-free topology, then that idea relies fundamentally on points. For example, the axiom $T_{0}$ is completely irrelevant to point-free topology since the axiom $T_{0}$ is a pointed concept. Similarly, the axiom $T_{1}$ is not considered for point-free topology since the notion of a $T_{1}$-space is also fundamentally a pointed notion rather than a point-free notion. For a similar reason, Hausdorffness does not extend very well to point-free topology since the definition of Hausdorffness seems to fundamentally rely on points.

Just like in point-set topology, in point-free topology there is a major difference between the spaces which do not satisfy higher separation axioms and the spaces which do satisfy higher separation axioms. The boundary between lower separation axioms and higher separation axioms in point-set topology should therefore also extend to a boundary between lower separation axioms and higher separation axioms in point-free topology. Almost all the arguments for why complete regularity is the correct boundary between lower and higher separation axioms that I gave here also hold for point-free topology. Since Hausdorffness is not very well-defined in a point-free context, one should not regard Hausdorffness as the line of demarcation between lower separation axioms and higher separation axioms in either point-free topology or point-set topology.

Conclusion

Spaces that only satisfy lower separation axioms are good too.

While completely regular spaces feel much different from spaces which are not completely regular, spaces which satisfy only lower separation axioms are very nice in their own ways. For example, non $T_{1}$-spaces have a close connection with ordered sets since every non-$T_{1}$-space has a partial ordering known as the specialization ordering. I do not know much about algebraic geometry, but algebraic geometers will probably agree that spaces which only satisfy the lower separation axioms are important. Frames (point-free topological spaces) which only satisfy lower separation axioms are also very nice from a lattice theoretic point of view; after all, frames are precisely the complete Heyting algebras.

The underappreciation for complete regularity

The reason why Hausdorffness is often seen as a more important separation axiom than complete regularity is that Hausdorffness is easy to define than complete regularity. The definition of Hausdorffness only refers to points and sets while complete regularity refers to points, sets, and continuous real-valued functions. Unfortunately, since the definition of complete regularity is slightly more complicated than the other separation axioms, complete regularity is not often given the credit it deserves. For example, in the hierarchy of separation axioms, complete regularity is denoted as $T_{3.5}$. It is not even given an integer. However, Hausdorffness is denoted as $T_{2}$, regularity is denoted as $T_{3}$ and normality is denoted as $T_{4}$. Furthermore, when people often mention separation axioms they often fail to give complete regularity adequate attention. When discussing separation axioms in detail, one should always bring up and emphasize complete regularity.

In practice, the Hausdorff spaces that people naturally comes across are always completely regular. I challenge anyone to give me a Hausdorff space which occurs in nature or has interest outside of general topology which is not also completely regular. The only Hausdorff spaces which are not completely regular that I know of are counterexamples in general topology and nothing more. Since all Hausdorff spaces found in nature are completely regular, complete regularity should be given more consideration than it is currently given.