<p>This assumption has been used in cryptographic constructions.  Both the computational and decisions are generally believed hard by the provable security community, but I doubt a reduction to, e.g., DH will be found.  See <a href="http://homepage.ruhr-uni-bochum.de/Eike.Kiltz/papers/dh_full.pdf" rel="nofollow">http://homepage.ruhr-uni-bochum.de/Eike.Kiltz/papers/dh_full.pdf</a> for discussion and references.</p>

CC BY-SA 3.0
2014-03-27T16:17:58.110Z
So, from the paper, can I infer, given $g,h∈G,\  g^a$, it is hard to compute $e(g,h)^{a^2}$ ?
Subhayan
CC BY-SA 3.0
2014-03-13T19:56:40.657Z
2014-03-13T19:56:40.657Z
David Cash
<p>Let $G$ be a group, $g ∈_R G, x ∈_R Z_q$, and  $e: G \times G \rightarrow G_T$ be a bilinear paring.</p>

<p>Then, given $g, g^x$, is it still hard to compute $g^{x^2}$?</p>

<p><strong>1. In other words is Square Diffie-Hellman hard in Bilinear Groups?</strong> </p>

<p>I am trying to look for references that have used this problem or a reduction which proves this is hard.</p>

<p>[I am aware of a variant of this called the Flexible Square Diffie-Hellman <a href="https://www.iacr.org/archive/asiacrypt2005/679/679.pdf" rel="nofollow"> [Laguillaumie et al]</a>, which asks to compute $(h,h^x,h^{x^2})$ given $g^x$.]</p>

<p><strong>2. What about the decisional version of the same problem?</strong></p>

CC BY-SA 3.0
2014-03-11T17:34:18.420Z
I'm assuming DH is diffie helman ? is there a link to a description of the problem ? is this well known ?
Suresh Venkat
CC BY-SA 3.0
2014-03-12T04:21:08.137Z
Yes, DH is Diffie Hellman. And no, I don't think the problem is well known (at least in the bilinear setting). Otherwise, traditional square DH is quite popular and  is known to be as hard as CDH.
Subhayan
<reference-request><cr.crypto-security>
Is Square DH hard in Bilinear Groups?
Subhayan
# Is Square DH hard in Bilinear Groups?

(Asked by: username_0 on 2014-03-11)

Let $G$ be a group, $g ∈\_R G, x ∈\_R Z\_q$, and $e: G \times G \rightarrow G\_T$ be a bilinear paring.

Then, given $g, g^x$, is it still hard to compute $g^{x^2}$?

**1. In other words is Square Diffie-Hellman hard in Bilinear Groups?**

I am trying to look for references that have used this problem or a reduction which proves this is hard.

[I am aware of a variant of this called the Flexible Square Diffie-Hellman  [[Laguillaumie et al]](https://www.iacr.org/archive/asiacrypt2005/679/679.pdf), which asks to compute $(h,h^x,h^{x^2})$ given $g^x$.]

**2. What about the decisional version of the same problem?**

**Tags:** reference-request, cr.crypto-security
> **Comments:**
> **username_1**: I'm assuming DH is diffie helman ? is there a link to a description of the problem ? is this well known ?  
> **username_0**: Yes, DH is Diffie Hellman. And no, I don't think the problem is well known (at least in the bilinear setting). Otherwise, traditional square DH is quite popular and  is known to be as hard as CDH.  

---

## 1 answers

### Answer by username_2 on 2014-03-13. Score: 2 | Accepted answer

This assumption has been used in cryptographic constructions. Both the computational and decisions are generally believed hard by the provable security community, but I doubt a reduction to, e.g., DH will be found. See <http://homepage.ruhr-uni-bochum.de/Eike.Kiltz/papers/dh_full.pdf> for discussion and references.

> **Comments:**
> **username_0**: So, from the paper, can I infer, given $g,h∈G,\  g^a$, it is hard to compute $e(g,h)^{a^2}$ ?  

---

