1
$\begingroup$

Where $g$ is a group element in bilinear group $G$, $e(g,g)∈GT$ and $s, y, r, t, d$ are randomly chosen.

I understand it is very similar to the conventional DBDH problem, but $g^t, g^{st-rs}, g^{(yr+d)/t}$ are also known, possibly making it easier???

Does anyone know the answer or suggest some material for reference?

Many Thanks

$\endgroup$
1
  • $\begingroup$ Note that this can be simplified to "given $g^s, g^y, g^r, g^t, g^{st}$, is it hard to distinguish $e(g, g)^{syr}$ from random? $\endgroup$
    – poncho
    Jul 22, 2016 at 22:17

1 Answer 1

1
$\begingroup$

No, it's no easier than the standard DBDH problem.

Here's the reduction that shows that: suppose that we have an Oracle that solves your problem (given $g^s, g^y, g^r, g^t, g^{st-rs}, g^{(yr+d)/t}, e(g,g)^x$ is $e(g,g)^x = e(g,g)^{syr}$?)

Now, suppose we're given $g^s, g^y, g^r, e(g,g)^x$, and are asked whether $e(g,g)^x = e(g,g)^{syr}$.

What we do is select a random values $t'$ and $z$, and compute $g^{t'} / g^r = g^t$ and $(g^s)^{t'} = g^{st-rs}$; we don't know the value of $t = t' - r$, but we know that it exists). We further compute $g^z = g^{(yr+d)/t}$ (again, we don't know the value $d = zt - yr$; but we don't have to know).

Then, with these values, along with the values we got with the original query, we ask the Oracle (and get the answer).

$\endgroup$
1
  • $\begingroup$ Many thanks, @poncho I think $t$ should be $t=t'+r$ so that it can be canceled out with the term $-sr$ !! $\endgroup$
    – Alex
    Jul 23, 2016 at 3:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.