3

I have some troubles in understanding the q-SDH problem. The discrete logarithm problem states the following.

Given a point P of order on an elliptic curve and a point Q on the same curve. It is hard to find a such that $0 \leq a \leq p-1 $ and $Q = aP$.

The q-SDH problem states the following:

Let $g_1$ be a generator of the elliptic curve. Given $\beta \in \mathbb{Z}_q^*$ and q+1 tuple $(g_1, \beta g_1, \beta^2g_1, ..., \beta^qg_1)$ it is hard to find the SDH tuple $(x, \frac{1}{\beta+x}g_1 ) $

I do not understand why we have to find $\frac{1}{\beta+x}g_1$. Why is this hard? What is the underlying problem? Is the discrete log problem somewhere hidden? Why do we need x?

null
  • 248
  • 1
  • 13

1 Answers1

2

The goal of the problem as you've described it is to find any $x$ along with $\frac{1}{\beta + x} g_1$.

There's no real reason it's in the denominator. That's just the definition of the problem. If you believe the assumption that this problem is hard, then you believe that finding those values (where $x, \beta$ are in the denominator) is hard to compute.

As for why it's hard: we don't know that it's hard, it's just an assumption (as one comment pointed out, it's definitely not harder than the discrete log problem).

lkowalcz
  • 56
  • 2