# Can Eve break this public key cryptosystem if she can solve DLP or DHP?

The PKC is in this way:

Alice and Bob fix a publicly known prime $$p$$, and all of the other numbers used are private (unless sent). Alice takes her message $$m$$, chooses a random exponent $$a$$, and sends the number $$u = m^a\pmod p$$ to Bob. Bob chooses a random exponent $$b$$ and sends $$v = u ^ b = m^{ab}\pmod p$$ back to Alice. Knowing the inverse of $$a\pmod{p-1}$$, Alice then computes $$w = v ^ {a^{-1}} = m^{b}\pmod p$$ and sends $$w$$ to Bob. Finally, Bob also computes $$w ^ {b^{-1}} = m\pmod p$$ and recovers the value of Alice's message.

I know a disadvantage of this PKC over ElGamal, that more times of data exchange is needed in order to send a single message. Are there any advantages of this cryptosystem over ElGamal? In particular, can Eve break it if she can solve the discrete logarithm problem? Can Eve break it if she can solve Diffie-Hellman problem?

• In the calculation for $w$, $u$ should be $v$. – Aman Grewal May 20 '20 at 11:55
• @AmanGrewal I edited the question. Thank you very much. – Kooranifar May 20 '20 at 13:30

Yes, at least, the computational Diffie-Hellman problem. This problem is "given the triplet $$h, h^x, h^y$$, recover $$h^{xy}$$"
Let us assume that Eve has an Oracle that solves this problem. Then, she sets $$h=m^{ab}$$, $$h^x = m^b = (m^{ab})^{a^{-1}}$$ and $$h^y = m^a = (m^{ab})^{b^{-1}}$$, and passes $$h, h^x, h^y$$ to her Oracle. The Oracle returns with $$h^{xy} = (m^{ab})^{a^{-1}b^{-1}} = m$$, problem solved.