It is known that the Decision Diffie-Hellman (DDH) problem can be easily solved over groups on pairing friendly curves (that is: one can use pairing to tell if $g^x$ and $g^y$ and $g^z$ forms a DH tuple such that $z = x*y$). What about the "tripartite" case where one has the tuple ($g^x$, $g^y$, $g^z$ and $g^u$) and need to tell if $u= x*y*z$. Would that be easy?

It looks like not an easy problem to me, as pairing can only be applied once?

  • 2
    $\begingroup$ Isn't this the Decisional Bilinear DH (DBDH) assumption? (See, e.g., this paper.) $\endgroup$
    – ckamath
    Jul 28, 2021 at 14:54
  • $\begingroup$ Fantastic. Thanks for the information! $\endgroup$
    – Sean
    Jul 28, 2021 at 15:03


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.