# Tag Info

The closest that I can think of is a "symmetric bilinear group" (a.k.a. Type-I pairing group) that was popular when bilinear groups were first introduced. This is actually a pair of groups $(G, G_T)$ together with an efficient non-degenerate bilinear map $\otimes: G \times G \to G_T$. Obviously DDH is easy in $G$, since one can on input $(g, U, V, W) \in ... 5 This is a reduction showing that if you can compute$g^{a^2}$given$g^a$, then you can solve the computational Diffie Hellman problem. Here is the reduction. Let$A$be an adversary that given$g^a$for a random$a$, outputs$g^{a^2}$with probability$\epsilon$. We construct$A'$who receives$u=g^a$and$v=g^b$and works as follows.$A'$runs$A$three ... 1 You probably know that cyclic groups of any order exist, so it is perfectly possible to have a cyclic group of order$pq$, and to consider a generator thereof. 1 There is no standard "multiply two group elements" operation in an additive group. So you first need to define what you mean by$P*Q$. From the comments I gather that you want$P*Q = q P = p Q = (p \cdot q) G$. The computational Diffie-Hellman (CDH) problem is: Given$P=pG$and$Q=qG$compute$(p\cdot q)G$. which is clearly equivalent to your problem. ... 0 Well the equation$R = P * Q$simply isn't possible on an elliptic curve. The group of points on the EC is an additive group. Meaning it is only possible to compute$P + Q$or$[m] P$for some integer m. Taken$P=p \cdot G$and$Q=q \cdot G$you already got the answer yourself:$R=(p \cdot q)G$. Simply add the point$G$to itself$(p \cdot q)$-times. 1 When using any cryptosystem that relies on the Decisional Diffie-Hellman assumption (e.g., ElGamal, ECIES, Diffie-Hellman key exchange, etc.) then you need a group of prime order. Note that$\mathbb Z_p^*$where$p$is prime has order$p-1$. However, if$p=rq+1$where$q$is also a large prime, then you have a subgroup of$\mathbb Z_p^*$of order$q\$. If you ...