Is the $\ell$-Diffie Hellman Inversion easy when g is known?

Question

From here they define the $\ell$-Diffie Hellman inversion problem as:

Given $g^{a},g^{a^2}\ldots,g^{a^{\ell}} \in G$, compute $g^{a^{-1}}$

Would this problem become easy if the generator $g$ is also known?

fgrieu · Accepted Answer · 2022-02-14T14:04:36.170

4

No.

The stated $l$-DHI problem is believed to remain hard when $g$ is known.

Actually, in the quoted page, it is assumed that $g$ is known throughout. This is obvious in particular in the sections on DLP and CDH.

edited Feb 14 '22 at 14:04

answered Feb 29 '12 at 15:14

fgrieu

140,762
12
307
587

I missed that bit at the top of the page. I got confused because some of the other assumptions list g to be explicitly known. – blz Mar 01 '12 at 06:04
@blz: You did not miss that bit - it was missing, I added it. – fgrieu Mar 01 '12 at 09:08

score 3 · Answer 2 · answered Feb 29 '12 at 15:06

No. The generator $g$ is a public parameter of the group $G$. You cannot perform a Diffie-Hellman handshake unless both parties agree on the generator (as well as any other parameter that defines $G$), so naturally any variation of the Diffie-Hellman problem must, by definition, assume the same thing.

score 3 · Answer 3 · edited Feb 29 '12 at 23:00

3

Do you know about the paper Variations of Diffie-Hellman Problem (PDF)? The problem you stated is the generalization of the inversion problem stated in that paper. You can use their technique to prove the relation.

edited Feb 29 '12 at 23:00

Paŭlo Ebermann

22,656
7
79
117

answered Feb 29 '12 at 15:24

Jalaj

1,323
9
10

I fail to locate the paper. – fgrieu Feb 29 '12 at 16:30

Is the $\ell$-Diffie Hellman Inversion easy when g is known?

3 Answers3