Chapter 21 The Diffie-Hellman Problem This is a chapter from version 2.0 of the book “Mathematics of Public Key Cryptography” by Steven Galbraith, available from http://www.math.auckland.ac.nz/˜sgal018/crypto- book/crypto-book.html The copyright for this chapter is held by Steven Galbraith. This book was published by Cambridge University Press in early 2012. This is the extended and corrected version. Some of the Theorem/Lemma/Exercise numbers may be different in the published version. Please send an email to [email protected] if youfind any mistakes. This chapter gives a thorough discussion of the computational Diffie-Hellman problem (CDH) and related computational problems. We give a number of reductions between computational problems, most significantly reductions from DLP to CDH. We explain self-correction of CDH oracles, study the static Diffie-Hellman problem, and study hard bits of the DLP and CDH. We always use multiplicative notation for groups in this chapter (except for in the Maurer reduction where some operations are specific to elliptic curves). 21.1 Variants of the Diffie-Hellman Problem We present some computational problems related to CDH, and prove reductions among them. The main result is to prove that CDH and Fixed-CDH are equivalent. Most of the results in this section apply to both algebraic groups (AG) and algebraic group quotients (AGQ) of prime orderr (some exceptions are Lemma 21.1.9, Lemma 21.1.16 and, later, Lemma 21.3.1). For the algebraic group quotientsG considered in this book then one can obtain all the results by lifting from the quotient to the covering groupG ′ and applying the results there. A subtle distinction is whether the base elementg G is consideredfixed or variable in a CDH instance. To a cryptographer it is most∈ natural to assume the generator is fixed, since that corresponds to the usage of cryptosystems in the real world (the group G and elementg G arefixed for all users). Hence, an adversary against a cryptosystem leads to an oracle∈ for afixed generator problem. To a computational number theorist it is most natural to assume the generator is variable, since algorithms in computational number theory usually apply to all problem instances. Hence both problems are studied in the literature and when an author writes CDH it is sometimes not explicit which of the variants is meant. Definition 20.2.1 was for the case wheng varies. Definition 21.1.1 below is the case wheng isfixed. This issue is discussed in Section 5 of Shoup [554] and in Sadeghi and Steiner [508] (where it is called “granularity”). 447 448 CHAPTER 21. THE DIFFIE-HELLMAN PROBLEM Definition 21.1.1. LetG be an algebraic group (AG) or algebraic group quotient (AGQ) and letg G. The Fixed-base computational Diffie-Hellman problem (Fixed- CDH) with∈ respect tog is: Given (g a, gb) to computeg ab. In this book the acronym CDH will always refer to the case whereg is allowed to vary. Hence, an algorithm for CDH will always take three inputs (formally we should also include a description of the underlying groupG, but we assume this is implicit in the specification ofg) while an algorithm for Fixed-CDH will always take two inputs. It is trivial that Fixed-CDH R CDH, but the reverse implication is less obvious; see Corollary 21.1.18 below. ≤ Analogously, giveng G one can define Fixed-DLP (namely, givenh tofinda such thath=g a) and Fixed-DDH∈ (given (ga, gb, gc) determine whetherg c =g ab). Though Fixed-DLP is equivalent to DLP (see Exercise 21.1.2) it is not expected that DDH is equivalent to Fixed-DDH (see Section 5.3.4 of [554]). Exercise 21.1.2. Prove that Fixed-DLP is equivalent to DLP. Exercise 21.1.3. LetG be a cyclic group of prime orderr. Leth , h , h G such 1 2 3 ∈ thath j = 1 forj=1,2, 3. Show there exists someg G such that (g, h 1, h2, h3) is a Diffie-Hellman6 tuple. ∈ We now introduce some other variants of CDH. These are interesting in their own right, but are also discussed as they play a role in the proof of equivalence between CDH and Fixed-CDH. Definition 21.1.4. LetG be a group or algebraic group quotient of prime orderr. The computational problem Inverse-DH is: given a pairg,g a G 1 of elements of prime −1 ∈ −{ } orderr inG to computeg a (modr) . (Clearly, we must exclude the casea = 0 from the set of instances.) Lemma 21.1.5. Inverse-DH CDH. ≤ R a Proof: SupposeO is a perfect oracle for solving CDH. Let (g, g 1 =g ) be the given Inverse-DH instance. Then a−1 g=g 1 . a−1 a−1 a−2 CallingO(g 1, g, g)=O(g 1, g1 , g1 ) givesg 1 . Finally, a−2 a a−2 a−1 g1 = (g ) =g as required. Definition 21.1.6. LetG be an AG or AGQ. The computational problem Square-DH 2 is: given (g, ga) whereg G has prime orderr to computeg a . ∈ Exercise 21.1.7. Show that Square-DH CDH. ≤ R Lemma 21.1.8. Square-DH Inverse-DH. ≤ R a Proof: LetO be a perfect oracle that solves Inverse-DH and let (g, g 1 =g ) be given. If g1 = 1 then return 1. Otherwise, we have a−1 a a a a2 O(g1, g)=O(g 1, g1 ) =g 1 = (g ) =g . Hence Square-DH R Inverse-DH R CDH. Finally we show CDH R Square-DH and so all these problems≤ are equivalent.≤ ≤ 21.1. VARIANTS OF THE DIFFIE-HELLMAN PROBLEM 449 Lemma 21.1.9. LetG be a group of odd order. Then CDH Square-DH. ≤ R Proof: Let (g, ga, gb) be a CDH instance. LetO be a perfect oracle for Square-DH. Call a a2 b b2 a b a2+2ab+b2 O(g, g ) to getg 1 =g ,O(g, g ) to getg 2 =g andO(g, g g ) to getg 3 =g . Now compute 2−1 (modr) (g3/(g1g2)) , which isg ab as required. Exercise 21.1.10. LetG be a group of prime orderr. Show that Inverse-DH and Square- DH are random self-reducible. Hence give a self-corrector for Square-DH. Finally, show that Lemma 21.1.9 holds for non-perfect oracles. (Note that it seems to be hard to give a self-corrector for Inverse-DH directly, though one can do this via Lemma 21.1.8.) Note that the proofs of Lemmas 21.1.5 and 21.1.8 require oracle queries where the first group element in the input is notg. Hence, these proofs do not apply to variants of these problems whereg isfixed. We now define the analogous problems forfixedg and give reductions between them. Definition 21.1.11. Letg have prime orderr and letG= g . The computational h i −1 problem Fixed-Inverse-DH is: giveng a = 1 to computeg a (modr) . Similarly, the 2 computational problem Fixed-Square-DH6 is: giveng a to computeg a . Exercise 21.1.12. Show that Fixed-Inverse-DH and Fixed-Square-DH are random self- reducible. Lemma 21.1.13. Letg G. LetA be a perfect Fixed-CDH oracle. Leth=g a and let n n N. Then one can compute∈ g a (modr) using 2 log (n) queries toA. ∈ ≤ 2 ai (modr) Proof: AssumeA is a perfect Fixed-CDH oracle. Defineh i =g so thath 1 =h. One hash 2i =A(h i, hi) andh i+1 =A(h i, h). Hence one can computeh n by performing the standard square-and-multiply algorithm for efficient exponentiation. Note that the number of oracle queries in Lemma 21.1.13 can be reduced by using window methods or addition chains. Exercise 21.1.14. Show that if the conjecture of Stolarsky (see Section 2.8) is true then an one can computeg in log2(n) + log2(log2(n)) Fixed-CDH oracle queries. Lemma 21.1.15. Fixed-Inverse-DH Fixed-CDH. ≤ R Proof: Fixg G. LetO be a perfect Fixed-CDH oracle. Letg a be the given Fixed- ∈ a−1 1 Inverse-DH instance. Our task is to computeg . The trick is to note thata − = r 2 ar−2 a − (modr). Hence, one computesg using Lemma 21.1.13. The case of non-perfect oracles requires some care, although at least one can check the result usingO since one −1 should haveO(g a, ga ) =g. Lemma 21.1.16. Fixed-Square-DH Fixed-Inverse-DH. ≤ R Proof: Leth=g a be the input Fixed-Square-DH instance and letA be a perfect oracle (1+a)−1 1 for the Fixed-Inverse-DH problem. CallA(gh) to getg and callA(gh − ) to get (1 a)−1 g − . Multiplying these outputs gives (1+a)−1 (1 a)−1 2(1 a2)−1 w=g g − =g − . 2−1 (modr) 1 a2 a2 CallingA(w ) givesg − from which we computeg as required. We can now solve a non-fixed problem using an oracle for afixed problem. 450 CHAPTER 21. THE DIFFIE-HELLMAN PROBLEM Lemma 21.1.17. Square-DH Fixed-CDH. ≤ R Proof: Letg G befixed of prime orderr and letA be a perfect Fixed-CDH oracle. b ∈ a Letg 1, g1 be the input Square-DH problem. Writeg 1 =g . We are required to compute b2 ab2 g1 =g . b b a2b2 CallA(g 1, g1) to computeg . Use the perfect Fixed-CDH oracle as in Lemma 21.1.15 −1 2 2 −1 2 to computeg a .