DDH-Like Assumptions Based on Extension Rings

Abstract

Abstract. We introduce and study a new type of DDH-like assumptions based on groups of prime order q. Whereas standard DDH is based on encoding elements of Fq "in the exponent" of elements in the group, we ask what happens if instead we put in the exponent elements of the extension ring R f = Fq[X]/(f ) where f is a degree-d polynomial. The decision problem that follows naturally reduces to the case where f is irreducible. This variant is called the d-DDH problem, where 1-DDH is standard DDH. We show in the generic group model that d-DDH is harder than DDH for d > 1 and that we obtain, in fact, an infinite hierarchy of progressively weaker assumptions whose complexities lie "between" DDH and CDH. This leads to a large number of new schemes because virtually all known DDH-based constructions can very easily be upgraded to be based on d-DDH. We use the same construction and security proof but get better security and moreover, the amortized complexity (e.g, computation per encrypted bit) is the same as when using DDH. We also show that d-DDH, just like DDH, is easy in bilinear groups. We therefore suggest a different type of assumption, the d-vector DDH problems (d-VDDH), which are based on f (X) = X d , but with a twist to avoid problems with reducible polynomials. We show in the generic group model that d-VDDH is hard in bilinear groups and that the problems become harder with increasing d. We show that hardness of d-VDDH implies CCA-secure encryption, efficient Naor-Reingold style pseudorandom functions, and auxiliary input secure encryption. This can be seen as an alternative to the known family of k-LIN assumptions.

Advanced attribute-based protocol based on the modified secret sharing scheme

“…Definition 4 (Decisional Diffie-Hellman (DDH) assumption[ [10,11]) ] Consider a (multiplicative) cyclic group G of the order q with the generator g.…”

New Signature and Multi-Signature Schemes with Tight Security Reduction Based on D-DDH Problem

“…So far, the practical cryptographic schemes are all based on some computational hard problems. Very recently, a new intractable problem named d-decisional Diffie-Hellman (d-DDH) problem is introduced by Cramer et al [18]. The problem is like the traditional decisional Diffie-Hellman problem (DDHP), but it is harder.…”

“…The d-Decisional Diffie-Hellman Problem. This is a new intractable problem introduced by Cramer et al in [18] very recently. We now review it briefly.…”

“…The follow theorem says that the d-DDH probelm is harder than DDH problem. Theorem 1 (Theorem 5 in [18]). In the generic group model, the d 2 -DDH assumption holds even when the adversary is given an oracle allowing him to solve the d 1 -DDH problem, for d 2 > 4(3d 1 − 2).…”