Security of most significant bits of gx2
Information Processing Letters
CRYPTO '96 Proceedings of the 16th Annual International Cryptology Conference on Advances in Cryptology
Assumptions Related to Discrete Logarithms: Why Subtleties Make a Real Difference
EUROCRYPT '01 Proceedings of the International Conference on the Theory and Application of Cryptographic Techniques: Advances in Cryptology
Equitable Key Escrow with Limited Time Span (or, How to Enforce Time Expiration Cryptographically)
ASIACRYPT '98 Proceedings of the International Conference on the Theory and Applications of Cryptology and Information Security: Advances in Cryptology
Lower bounds for discrete logarithms and related problems
EUROCRYPT'97 Proceedings of the 16th annual international conference on Theory and application of cryptographic techniques
Discrete Applied Mathematics - Special issue: Coding and cryptography
ASIACRYPT '08 Proceedings of the 14th International Conference on the Theory and Application of Cryptology and Information Security: Advances in Cryptology
Discrete Applied Mathematics - Special issue: Coding and cryptography
A generalization of DDH with applications to protocol analysis and computational soundness
CRYPTO'07 Proceedings of the 27th annual international cryptology conference on Advances in cryptology
Relationships between diffie-hellman and “index oracles”
SCN'04 Proceedings of the 4th international conference on Security in Communication Networks
| Hi-index | 0.00 |
Given a cyclic group G and a generator g, the Diffie-Hellman function (DH) maps two group elements (ga, gb) to gab. For many groups G this function is assumed to be hard to compute. We generalize this function to the P-Diffie-Hellman function (P-DH) that maps two group elements (ga, gb) to gP(a,b) for a (non-linear) polynomial P in a and b. In this paper we show that computing DH is computationally equivalent to computing P-DH. In addition we study the corresponding decision problem. In sharp contrast to the computational case the decision problems for DH and P-DH can be shown to be not generically equivalent for most polynomials P. Furthermore we show that there is no generic algorithm that computes or decides the P-DH function in polynomial time.