# Understanding trapdoor test and some of my confusions about it

The trapdoor test says as follows:

Let $\mathbb{G}$ be a cyclic group of prime order $q$, generated by $g \in \mathbb{G}$. Suppose $X_1,r,s$ are pairwise independent random variables, such that $X_1\in\mathbb{G}$, $r,s$ is uniformly distributed over $\mathbb{Z}_q$. Now, define $X_2=g^s/X_1^r$. Further, suppose that $Y,Z_1,Z_2\in \mathbb{G}$ and they are random variables, each of which is defined as some function of $X_1$ and $X_2$. Then we have:

1. $X_2$ is uniformly distributed over $\mathbb{G}$;
2. $X_1$ and $X_2$ are independent;
3. if $X_1=g^{x_1}$ and $X_2=g^{x_2}$ ,then the probability that the truth value of $$Z_1^rZ_2=Y^s$$ does not agree with the truth value of $$Z_1=Y^{x_1}\wedge Z_2=Y^{x_2}$$ is at most $1/q$; moreover if item 3 holds ,then item 2 certainly holds.

You can refer to the original paper "The Twin Diﬃe-Hellman Problem and Applications" in section 2 published in EUROCRYPT 2008, which contains a proof. However, I'm finding it hard to understand. I'm unclear what indeed the trapdoor test tells us?

I'm now reading the paper "An ID-based Authenticated Key Exchange Protocol Based on Bilinear Difﬁe-Hellman Problem". Near the end of 1.1 related work, the author says:

We find that the trapdoor test technique makes it possible to remove the gap assumption in security proof of AKE protocols. This provides another new approach to the design of AKE protocols without gap assumption.

Intuitively, it's right. For all the papers I've read where the author's protocol relies on the CDH problem, then surely the trapdoor test will be used in the proof. Can the trapdoor test really weaken hardness assumptions?

The author doesn't justify this claim -- can someone prove this? Alternatively, is there a reason this might be hard to prove?

-