# Could anyone explain what Two Oracle Diffie-Hellman assumption is?

I am really new to cryptography and I have asked a similar question which is about Decisional Diffie-Hellman assumption (What's the meaning of asterisk and PPT in this paper?) and it is already kind of difficult to me.

But this paper Practical Secure Aggregation for Privacy-Preserving Machine Learning (https://eprint.iacr.org/2017/281.pdf) proposes a Two Oracle Diffie-Hellman assumption, which is even more difficult to understand.

Could anyone please tell me bow the oracle function is used in the adversary M? I don't even really understand what the oracle is here.

• If you have trouble understanding the other answer perhaps take a MOOC such as Dan Boneh's to brush up on basics. You also do need understanding of probability and mathematics at least at a first college class level to understand the theoretical approach to probability, which includes things like advantage, randomised protocols, etc. May 10 at 11:01
• @kodlu I understand the math part. May 10 at 11:07
• I am not sure but I think the oracle is there to account for the the keys that the adversary might have learnt from previous sessions. Since it is a public chosen $X$ attack modeled as an oracle, it can be used to prevent session compromise if it was not actively attacked via DH MiTM because it was authenticated or something, even if other sessions using the same public keys on two sides and the same hash function $H$ was used Jun 12 at 4:15

The oracles are giving the image by $$H$$ of $$X^a$$ (for $$\mathcal{O}_a$$) and $$Y^b$$ (for $$\mathcal{O}_b$$) for any $$X\neq B$$ and $$Y\neq B$$.
Notice there is a typo in the definition, because $$b$$ is used for the definition of the bit parameter, and the scalar challenge (Here I'm considering the scalar challenge).