Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Let, $g^{a}$, $g^{b}$ are known elements, where $g\in G$ and $a, b\in Z_q$. According to Computational Diffie-Hellman (CDH) assumption, it is hard to compute $g^{ab}$.
If $g^{a^2}$ is also known then is it still fall into Computational Diffie-Hellman assumption? In other words, if $g$, $g^{a}$, $g^{b}$, $g^{a^2}$ and $q$ are known, is it still hard to compute $g^{ab}$?
No, the assumption "given $g, g^a, g^b, g^{a^2}$, it is infeasible to compute $g^{ab}$" is not known to reduce to the CDH assumption. In fact, we can even prove a separation in the generic group model (meaning, it is impossible to build such a reduction by using the group operations in a black box way). Intuitively, this is because we do not know how to generate an instance of the first assumption given a CDH instance: it requires computing $g^{a^2}$ from $g^a$, which is already equivalent to breaking the CDH assumption. However, this assumption remains a plausible one: a scheme whose security would reduce to this assumption would be considered secure in the crypto community. In fact, many assumptions of this type which are variants of the CDH assumption are common in the crypto community.
It does not compromise DH security. Because computing $a$ from $g^a$ and $g^{a^2}$ is as hard as finding $a$ from $g^a$. So without knowledge of $a$ we cant compute $g^{ab}$ from just $g^a$ and $g^b$ and vice a verse.
