Why is Decisional Diffie–Hellman assumption harder than the Computational Diffie–Hellman assumption in cryptography?

Question

I did not understand why the decisional Diffie-Hellman assumption is harder than computational Diffie-Hellman assumption, I read that there are groups where DDH is known to be easy but CDH is still assumed to be hard.
Please, could you explain this one, by using an example?

Answer 1

There are groups that allow a 'pairing' operation; that is, an efficiently computable function $e$ with the property:

$$e(x, y^a) = e(x^a, y)$$

for all group members $x, y$ and integers $a$. Actually, the pairing operation maps the pair into another group, with the additional property $e(x^a, y^b) = e(x, y)^{ab}$; that's not important here (but is important for other uses of the pairing function). We also assume that $e$ is nontrivial, that $e(x, y)$ doesn't uniformly map to the identity group member.

In any case, if we were given four values $g, g^a, g^b, g^c$, this function would allow us to check whether:

$$e(g, g^c) \stackrel{?}= e(g^a, g^b)$$

If this equation doesn't hold, then we know that $g^{ab} \ne g^c$ (and if we make some assumptions on $e$, then we can actually get equivalence).

However, this $e$ function doesn't give us any obvious way to recover the value $g^{ab}$, given $g, g^a, g^b$

Answer 2

CDH asks, given $g^a$ and $g^b$, to compute $g^{ab}$. DDH asks merely to obtain enough information about it to distinguish it from a random group element. For example, merely obtaining the last bit of $g^{ab}$ with probability better than $1/2$ is enough to break DDH, but not CDH.

Given the above, no example should be needed to justify the belief that breaking DDH can in certain cases be easier than breaking CDH, or in other words, that assuming the hardness of breaking DDH can be a stronger assumption than the same with CDH.