4

Is this problem still hard?

Given $$(g,g^a,g^b,c)$$ decide if $c=a\cdot b$?

If there is an adversary that solves the standard Decisional Diffie-Hellman Problem then it can solve my new problem. But I can't understand that my new problem still hard or not.

Did anyone see this problem or similar to my problem? Can anyone help me?

Ievgeni
  • 2,653
  • 1
  • 13
  • 35
Mahdi Mahdavi
  • 492
  • 2
  • 10

1 Answers1

8

Yes it is. It can be formally reduced to the hardness of the decisional square Diffie-Hellman assumption, which states that distinguishing $(g,g^a,g^{a^2})$ from random is hard (this is a well established assumption).

It follows in a relatively simple way from the answer I wrote here to a related question. I can let you work out the details in case you want to play a bit with these reductions. In case you cannot figure out the formal reduction, just ask in the comment and I will elaborate.

Geoffroy Couteau
  • 21,719
  • 2
  • 55
  • 78