# Explanation of the Decision Diffie Hellman (DDH) problem.

I'm extremely new to crypto, and very much inexperienced. Lately I've been reading about the Diffie-Hellman key-exchange methods, and specifically about the computational diffie-hellman assumption vs. decision diffie-hellman assumption. Specifically I'm referencing Dan Boneh's paper on DDH problem. However, I'm having some trouble understanding the difference between CDH and DDH. What are the differences? Similarities?

-

1
– Paŭlo Ebermann♦ Nov 2 '12 at 18:02
@PaŭloEbermann Thanks! – Nico Bellic Nov 4 '12 at 6:29

## 1 Answer

The Computational Diffie-Hellman (CDH) problem is:

Given some group $G$ and group element $g$, and the elements $g^a$ and $g^b$, compute the value $g^{ab}$.

The Decisional Diffie-Hellman (DDH) problem is:

Given some group $G$ and group elements $g$, and the elements $g^a$, $g^b$ and $g^c$, determine whether $g^c = g^{ab}$

These are obviously related problems, the difference is that the CDH problem asks us to derive the DH shared secret, while the DDH problem just asks us to recognize it.

In addition, the CDH problem appears to be potentially harder, in this sense: if we're given an oracle to solve the CDH problem, we can easily solve the DDH problem (simply by handing $g$, $g^a$ and $g^b$ to the oracle, have it compute the value $g^{ab}$ and comparing that value to $g^c$. In contrast, there's no known generic way to solve the CDH problem given a DDH oracle.

As for why the DDH problem comes up so often (and in cases where one would naively expect the CDH problem to to appropriate), well, many protocols do a DH-type computation, and then use the value $F(g^{ab})$ (for some function $F$); breaking the protocol may allow an attacker to recover the value $F(g^{ab})$. Now, recovering this value would allow us to solve the DDH problem (by comparing that value to $F(g^c)$); hence, breaking the protocol would allow us to solve the DDH problem; or equivalently, if the DDH problem is hard, the protocol is secure. However, if the function $F$ is one-way, recovering the value $F(g^{ab})$ doesn't give us the value $g^{ab}$, and so there is no reduction of the security of the protocol to the CDH problem.

-
{"extraction_info": {"found_math": true, "script_math_tex": 0, "script_math_asciimath": 0, "math_annotations": 0, "math_alttext": 0, "mathml": 0, "mathjax_tag": 0, "mathjax_inline_tex": 23, "mathjax_display_tex": 0, "mathjax_asciimath": 0, "img_math": 0, "codecogs_latex": 0, "wp_latex": 0, "mimetex.cgi": 0, "/images/math/codecogs": 0, "mathtex.cgi": 0}, "config": {"markdown_headings": true, "markdown_code": true, "boilerplate_config": {"ratio_threshold": 0.18, "absolute_threshold": 20, "end_threshold": 15, "enable": false}, "remove_buttons": true, "remove_image_figures": true, "remove_link_clusters": true, "table_config": {"min_rows": 2, "min_cols": 3, "format": "github"}, "remove_chinese": true, "remove_edit_buttons": true, "extract_latex": true}, "english_confidence": 0.905255138874054, "perplexity_flag": "middle"}