When thinking about a pairing-based cryptographic scheme, I encountered the following problem. Let $e \colon G_1, G_2 \to G_T$ be a Type 3 pairing. Then:
Given $P, zP \in G_1$ and $Q, zQ \in G_2$, compute $z$.
I haven't found this problem in the literature anywhere, so I am not aware of any name of it. It clearly implies the discrete logarithm problems in $G_1$ and $G_2$, but those two do not seem to imply this problem on their own or combined. On the other hand, it is implied by the co-CDH* as well as the q-SDH assumptions - but those are stronger than I need.
I'm wondering the following two things:
- Has this problem appeared anywhere in the literature?
- Is it implied by any other common assumptions?
It seems very natural to assume the hardness of this problem in a Type 3 cryptographic scheme. Usually the point of working with a Type 3 pairing is exactly to have such a tuple, and use the pairing to decide if the fourth element indeed equals $zQ$ or some other element. So if this problem is not hard and $z$ is private, then you're in trouble.