0

This paper talks about a generalization of the Decisional Diffie-Hellman problem over different polynomial exponents of the base generator to be given and be distinguished from each other. Throughout this question I'll be using jargon and notation from this paper.

I'm specifically interested in Lemma 6, which states the following:

Given a challenge $(P,Q)$ and another challenge $(P^\prime,Q^\prime)$ obtained from $(P,Q)$ via a DDH reduction. Then for any adversary $\cal{A}$ there exists an adversary $\cal{B}$ such that $\textbf{Adv}_\cal{A}^\textit{(P,Q)-DDH} = 2. \textbf{Adv}_\cal{B}^\textit{DDH} + \textbf{Adv}_\cal{A}^\textit{(P',Q')-DDH}$.

How does one derive this? For example, given $P = P^\prime = \{a,b,c\}, Q=\{abc\}$ and $Q^\prime = \{a d\}$, I can get (ignoring moduluses):

$\textbf{Adv}_\cal{A}^\textit{(P,Q)-DDH} = \textbf{Pr}[\cal{A}(g, g^a, g^b, g^c, g^{abc})=1] - \textbf{Pr}[\cal{A}(g, g^a, g^b, g^c, g^{ad})=1] + \textbf{Adv}_\cal{A}^\textit{(P',Q')-DDH}$

But I can't seem to figure out how to distinguish between the distributions $(g, g^a, g^b, g^c, g^{abc})$ and $(g, g^a, g^b, g^c, g^{ad})$ via two applications of a DDH distinguisher.

Honestly, even a way of showing that $\textbf{Adv}_\cal{A}^\textit{(P,Q)-DDH} \geq \textbf{Adv}_\cal{A}^\textit{(P',Q')-DDH}$ would be much appreciated.

0 Answers0