# Why the standard DH is not suﬃcient to ensure the security of the Diﬃe-Hellman key exchange?

I don't know mucho about Cryptography, I try to understand, It's for homework.

Why the standard DH is not suﬃcient to ensure the security of the Diﬃe-Hellman key exchange?

In the standard Diﬃe-Hellman key exchange protocol, both parties compute the secret value gαβ for two privately chosen values $$\alpha$$ (by Alice) and $$\beta$$ (by Bob). An eavesdropper can publicly see the pair ($$g^{\alpha},g^{\beta}$$). So, if checking whether, for some $$g^{\gamma}$$, it is the case that $$\gamma = \alpha \beta$$, were computationally easy —i.e., the DDH assumption fails—, then the eavesdropper would have found $$g^{\gamma} = g^{\alpha\beta}$$ without disclosing $$\alpha$$ nor $$\beta$$ explicitly, even if the DH assumption is true. This is why the CDH/DDH are the assumptions that really matter in the key exchange.
• Did you mean to say: why the DL assumption is not enough? Your example is going in the right direction and would need to be modified to say that even if the DL is hard, if it was possible to compute $g^{xy}$ from $g^x, g^y$ then the key exchange would not be secure – Marc Ilunga Jun 16 '20 at 19:27