# Derive $x$ when given $g,g^x$ and $g^{(1/x)}$?

If an adversary has access to the generator g of a group G and is given access to $g^{x}$ and $g^{(1/x)}$, will it make it any easier to derive the value of $x$ compared to when he had access to only $g$ and $g^{x}$?

EDIT: My question is different from “Can we reduce Diffie-Hellman problem to “Discrete-log inversion” problem?” as in this case the adversary has the values and does not need an oracle to derive it

• related question if you're in the DH setting: crypto.stackexchange.com/q/26264/23623
– SEJPM
May 24 '16 at 19:59
• If this were possible then most (all?) IBE and ABE schemes that support secret key delegation would be broken. May 24 '16 at 20:03
• Does this mean the attacker can get $g^{1/x}$ for each $g^x$ (more than one) of his choice or only for the $x$ being searched?
– SEJPM
May 24 '16 at 20:03
• @SEJPM I am trying to find out if an adversary is given those value without knowing what $x$ is. And also its not for more than one but only the $x$ being searched May 24 '16 at 20:06
• @ArtjomB. so that means the adversary will not be able to tell what the value of $x$ is? I was thinking the same thing. May 24 '16 at 20:07

Any group where you can derive $x$ from $g, g^x, g^{1/x}$ would also have the Discrete Log problem be equivalent to the (computational) Diffie-Hellman problem. Since this is not known to be true in general, we don't know of any general method for deriving $x$ from those values.
This equivalence is quite simple to demonstrate; if it based on the fact that solving the cDH program allows us to compute $g^{1/x}$ given $g, g^x$. So, if we assume we can recover $x$ from $g, g^x, g^{1/x}$, then we can solve the Discrete Log problem (given $g, g^x$) by first recovering $g^{1/x}$ (using our cDH Oracle), and then given $g, g^x, g^{1/x}$, recover $x$
• so what I am getting from your explanation is that it will not be possible to derive $x$ from those three values right? May 24 '16 at 22:04