Given an Elliptic curve group $E(\mathbb{F}_q)$ where the Discrete Logarithm Problem (DLP) is hard and a base point $G \in E(\mathbb{F}_q)$ with large prime order $n$, what will be the advantage of a polynomial-time bounded adversary $\mathcal{A}$ to solve the following problem:
- Given $\alpha = X+Y$ and $\beta = X+Y+Z+r.a.G$, $\mathcal{A}$ should output the point $Z$.
$X,Y,Z \in E(\mathbb{F}_q)$, and $r,a \in \mathbb{Z}^*_n$. It is worth nothing that $r,a$ are sampled at random.
One can assume that $\beta$ is an encryption of the message $X+Y+Z$ using ElGamal Cryptosystem over Elliptic Curve.
P.S: I have the impression that this problem can be reduced to breaking the DLP problem, but I am not certain.