3

I'm having trouble finding the first paper that introduced the $q$-Strong Bilinear Diffie-Hellman ($q$-SBDH) assumption which, roughly speaking, is:

Let $\mathbb{G},\mathbb{G}_T$ be two groups of order $p$, with a bilinear map $e$ from $\mathbb{G}$ to $\mathbb{G}_T$. Let $s \stackrel{$}{\leftarrow} \mathbb{Z}^*_p$ be a trapdoor. Given $pp = \langle g, g^s, g^{s^2},..., g^{s^q} \rangle \in \mathbb{G}^{q+1}$, an adversary has negligible probability of finding $\langle c, e(g, g)^{\frac{1}{s+c}} \rangle$ for some $c \in \mathbb{Z_p} \setminus \{-s\}$.

Some papers seem to point to Dan Boneh's "Short signatures without random oracles and the SDH assumption in bilinear groups" (Journal of Cryptography, 2008). However, as far as I've read the paper, only $q$-SDH is defined there, not $q$-SBDH.

Any help would be appreciated!

Alin Tomescu
  • 1,003
  • 10
  • 30
  • The q-SDH assumption is about groups with a bilinear pairing. This is clearly stated in the cited article. –  Sep 25 '17 at 03:34
  • Eh, right. $q$-SDH and $q$-SBDH are assumptions in groups with pairings, but they are different assumptions. In $q$-SDH, it's hard to find $\langle c, g^{\frac{1}{s+c}} \rangle$, while in $q$-SBDH it's hard to find $\langle c, e(g,g)^{\frac{1}{s+c}} \rangle$. – Alin Tomescu Sep 25 '17 at 04:14
  • Ok, maybe this one: https://eprint.iacr.org/2004/172.pdf –  Sep 25 '17 at 04:34
  • Thanks! Where exactly? They define $q$-BDHI which asks the adversary to find $e(g,g)^{\frac{1}{x}}$, which is different. – Alin Tomescu Sep 27 '17 at 19:07

1 Answers1

1

After some more investigation, the earliest paper I could find that introduces $q$-Strong Bilinear Diffie-Hellman was Reducing Trust in the PKG in Identity Based Cryptosystems by Vipul Goyal in CRYPTO 2007.

Alin Tomescu
  • 1,003
  • 10
  • 30