Weak Decisional Diffie-Hellman Problem

Question

Is this problem still hard?

Given $$(g,g^a,g^b,c)$$ decide if $c=a\cdot b$?

If there is an adversary that solves the standard Decisional Diffie-Hellman Problem then it can solve my new problem. But I can't understand that my new problem still hard or not.

Did anyone see this problem or similar to my problem? Can anyone help me?

This might help What is the relation between Discrete Log, Computational Diffie-Hellman and Decisional Diffie-Hellman? — kelalaka, Feb 18 '21 at 08:10
@kelaka This doesn't answer the question. Indeed, as the question states - it is clear that if DDH is easy then so is this. However, this is not DL or CDH or DDH since the actual value $c=a\cdot b$ is given, and not $g^c$. — Yehuda Lindell, Feb 18 '21 at 09:08
As an aside, I would note that the similar problem "given $(g, g^a, g^b, c)$ is $c = a / b$" turns out to be easy... — poncho, Feb 19 '21 at 20:43

score 8 · Accepted Answer · answered Feb 19 '21 at 20:14

8

Yes it is. It can be formally reduced to the hardness of the decisional square Diffie-Hellman assumption, which states that distinguishing $(g,g^a,g^{a^2})$ from random is hard (this is a well established assumption).

It follows in a relatively simple way from the answer I wrote here to a related question. I can let you work out the details in case you want to play a bit with these reductions. In case you cannot figure out the formal reduction, just ask in the comment and I will elaborate.

answered Feb 19 '21 at 20:14

Geoffroy Couteau

19,919
2
46
68

Thank you very much for your answer. I think that my problem reduced to the decisional inverse Diffie-Hellman assumption, which states that distinguishing $(g,g^a,g^{a^{-1}})$ from random. – Mahdi Mahdavi Feb 20 '21 at 03:09

Weak Decisional Diffie-Hellman Problem

1 Answers1