Triples of the first kind are often called DDH triples or DDH tuples.
The DDH assumption is related to the discrete log assumption. If it were possible to efficiently compute discrete logs in , then the DDH assumption would not hold in . Given , one could efficiently decide whether by first taking the discrete log of , and then comparing with .
For this reason, DDH is considered a stronger assumption than discrete log, in the following sense: there are groups for which detecting DDH tuples is easy, but computing discrete logs is believed to be hard. Thus, requiring that the DDH assumption holds in a group is a more restricting requirement.
The DDH assumption is also related to the Computational Diffie-Hellman assumption (CDH). If it were possible to efficiently compute from , then one could easily distinguish the two probability distributions above. Similar to above, DDH is considered a stronger assumption than CDH.
The problem of detecting DDH tuples is random self-reducible, meaning, roughly, that if it is hard for even a small fraction of inputs, it is hard for almost all inputs; if it is easy for even a small fraction of inputs, it is easy for almost all inputs.
When using a cryptographic protocol whose security depends on the DDH assumption, it is important that the protocol is implementing using groups where DDH is believed to hold:
Importantly, the DDH assumption does not hold in the multiplicative group , where is prime. This is because given and , one can efficiently compute the Legendre symbol of , giving a successful method to distinguish from a random group element.
The DDH assumption does not hold on elliptic curves over with small embedding degree (say, less than ), a class which includes supersingular elliptic curves. This is because the Weil pairing or Tate pairing can be used to solve the problem directly as follows: given on such a curve, one can compute and . By the bilinearity of the pairings, the two expressions are equal if and only if modulo the order of . If the embedding degree is large (say around the size of then the DDH assumption will still hold because the pairing cannot be computed. Even if the embedding degree is small, there are some subgroups of the curve in which the DDH assumption is believed to hold.
Factor Structure and Measurement Invariance of a 10-Item Decisional Balance Scale: Longitudinal and Subgroup Examination within an Adult Diabetic Sample
Oct 01, 2009; This study explores the longitudinal and subgroup measurement properties of a 10-item, physical activity decisional...
Rep. Benishek Introduces Bill Concerning Replacement of Current Forest Service Administrative Appeals Process with Pre-Decisional Administrative Review Process
Jul 08, 2011; WASHINGTON, July 8 -- Rep. Dan Benishek, R-Michigan has introduced the bill (H. R.2209), legislation that would "replace the...
Decisional Regret Theory: Reducing the Anxiety about Uncertain Outcomes during Group Decision Making through Shared Counterfactual Storytelling
Jun 01, 2006; It has been suggested that if pressed, people can imagine virtually anything (Roese & Olson, 1995a, p. ix). At the same time,...