It is known that the Decision Diffie-Hellman (DDH) problem can be easily solved over groups on pairing friendly curves (that is: one can use pairing to tell if $g^x$ and $g^y$ and $g^z$ forms a DH tuple such that $z = x*y$). What about the "tripartite" case where one has the tuple ($g^x$, $g^y$, $g^z$ and $g^u$) and need to tell if $u= x*y*z$. Would that be easy?

It looks like not an easy problem to me, as pairing can only be applied once?

  • 2
    $\begingroup$ Isn't this the Decisional Bilinear DH (DBDH) assumption? (See, e.g., this paper.) $\endgroup$
    – ckamath
    Jul 28 '21 at 14:54
  • $\begingroup$ Fantastic. Thanks for the information! $\endgroup$
    – Sean
    Jul 28 '21 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.