Diffie–Hellman problem

<h2 id="problem-description">Problem description</h2>
The Diffie–Hellman problem is stated informally as follows:

Given an element 
 
 
 
 g
 
 
 {\displaystyle g}
 
 and the values of 
 
 
 
 
 g
 
 x
 
 
 
 
 {\displaystyle g^{x}}
 
 and 
 
 
 
 
 g
 
 y
 
 
 
 
 {\displaystyle g^{y}}
 
, what is the value of 
 
 
 
 
 g
 
 x
 y
 
 
 
 
 {\displaystyle g^{xy}}
 
?
Formally, 
 
 
 
 g
 
 
 {\displaystyle g}
 
 is a <a href="/facts/Generating_set_of_a_group/B9q5lnFY">generator</a> of some <a href="/facts/Group_(mathematics)/IQTYqINt">group</a> (typically the <a href="/facts/Multiplicative_group/G209dICf">multiplicative group</a> of a <a href="/facts/Finite_field/UkMGJo3m">finite field</a> or an <a href="/facts/Elliptic_curve/60jvaHSA">elliptic curve</a> group) and 
 
 
 
 x
 
 
 {\displaystyle x}
 
 and 
 
 
 
 y
 
 
 {\displaystyle y}
 
 are randomly chosen integers.
For example, in the Diffie–Hellman key exchange, an eavesdropper observes 
 
 
 
 
 g
 
 x
 
 
 
 
 {\displaystyle g^{x}}
 
 and 
 
 
 
 
 g
 
 y
 
 
 
 
 {\displaystyle g^{y}}
 
 exchanged as part of the protocol, and the two parties both compute the shared key 
 
 
 
 
 g
 
 x
 y
 
 
 
 
 {\displaystyle g^{xy}}
 
. A fast means of solving the DHP would allow an eavesdropper to violate the privacy of the Diffie–Hellman key exchange and many of its variants, including <a href="/facts/ElGamal_encryption/sKDVyMyR">ElGamal encryption</a>.

<h2 id="computational-complexity">Computational complexity</h2>
In <a href="/facts/Cryptography/e94PEVau">cryptography</a>, for certain groups, it is assumed that the DHP is hard, and this is often called the Diffie–Hellman assumption. The problem has survived scrutiny for a few decades and no "easy" solution has yet been publicized.
As of 2006, the most efficient means known to solve the DHP is to solve the <a href="/facts/Discrete_logarithm_problem/k8TXh5bL">discrete logarithm problem</a> (DLP), which is to find x given g and gx. In fact, significant progress (by den Boer, <a href="/facts/Ueli_Maurer_(cryptographer)/QTrE4VAY">Maurer</a>, Wolf, <a href="/facts/Dan_Boneh/kQYdavuY">Boneh</a> and <a href="/facts/Richard_J._Lipton/aMHKxTMH">Lipton</a>) has been made towards showing that over many groups the DHP is almost as hard as the DLP. There is no proof to date that either the DHP or the DLP is a hard problem, except in generic groups (by Nechaev and Shoup). A proof that either problem is hard implies that P ≠ NP.

<h2 id="other-variants">Other variants</h2>
Many variants of the Diffie–Hellman problem have been considered. The most significant variant is the <a href="/facts/Decisional_Diffie%25E2%2580%2593Hellman_assumption/n1A9uKcH">decisional Diffie–Hellman problem</a> (DDHP), which is to distinguish gxy from a random group element, given g, gx, and gy. Sometimes the DHP is called the <a href="/facts/Computational_Diffie%25E2%2580%2593Hellman_assumption/hVJaoofR">computational Diffie–Hellman problem</a> (CDHP) to more clearly distinguish it from the DDHP. Recently groups with <a href="/facts/Pairing/G0qgKRD8">pairings</a> have become popular, and in these groups the DDHP is easy, yet the CDHP is still assumed to be hard. For less significant variants of the DHP see the references.

<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/Discrete_logarithm_problem/k8TXh5bL">Discrete logarithm problem</a></li>
<li><a href="/facts/Elliptic-curve_cryptography/YbjcXIWk">Elliptic-curve cryptography</a></li></ul>

<ul><li>B. den Boer, Diffie–Hellman is as strong as discrete log for certain primes in Advances in Cryptology – <a href="/facts/CRYPTO/TgVIMDmb">CRYPTO</a> 88, <a href="/facts/Lecture_Notes_in_Computer_Science/1UeA77BC">Lecture Notes in Computer Science</a> 403, Springer, p. 530, 1988.</li>
<li>U. M. Maurer and S. Wolf, Diffie–Hellman oracle in Advances in Cryptology – CRYPTO 96, (N. Koblitz, ed.), Lecture Notes in Computer Science 1070, Springer, pp. 268–282, 1996.</li>
<li>Maurer, Ueli M.; Wolf, Stefan (2000). "The Diffie–Hellman Protocol". Designs, Codes and Cryptography. 19 (2/3): 147–171. <a href="/facts/Doi_(identifier)/muM9Etpq">doi</a>:<a href="https://doi.org/10.1023%2FA%3A1008302122286">10.1023/A:1008302122286</a>. <a href="/facts/S2CID_(identifier)/ldJsHa2Y">S2CID</a> <a href="https://api.semanticscholar.org/CorpusID:42734334">42734334</a>.</li>
<li>D. Boneh and R. J. Lipton, Algorithms for black-box fields and their application to cryptotography in Advances in Cryptology – CRYPTO 96, (N. Koblitz, ed.), Lecture Notes in Computer Science 1070, Springer, pp. 283–297, 1996.</li>
<li>A. Muzereau, N. P. Smart and F. Vercauteran, The equivalence between the DHP and DLP for elliptic curves used in practical applications, LMS J. Comput. Math., 7, pp. 50–72, 2004. See [www.lms.ac.uk].</li>
<li>D. R. L. Brown and R. P. Gallant, <a href="http://eprint.iacr.org/2004/306">The Static Diffie–Hellman Problem</a>, IACR ePrint 2004/306.</li>
<li>V. I. Nechaev, Complexity of a determinate algorithm for the discrete logarithm, Mathematical Notes, 55 (2), pp. 165–172, 1994.</li>
<li>V. Shoup, Lower bounds for discrete logarithms and related problems in Advances in Cryptology – <a href="/facts/EUROCRYPT/TgVIMDmb">EUROCRYPT</a> 97, (W. Fumy, ed.), Lecture Notes in Computer Science 1233, Springer, pp. 256–266, 1997.</li>
<li>Bao, Feng; Deng, Robert H.; Zhu, Huafei (2003). "Variations of Diffie-Hellman Problem". ICICS 2003: Information and Communications Security. Lecture Notes in Computer Science. Vol. 2836. Springer. pp. 301–312. <a href="/facts/CiteSeerX_(identifier)/SceDmd3c">CiteSeerX</a> <a href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.104.3007">10.1.1.104.3007</a>. <a href="/facts/Doi_(identifier)/muM9Etpq">doi</a>:<a href="https://doi.org/10.1007%2F978-3-540-39927-8_28">10.1007/978-3-540-39927-8_28</a>. <a href="/facts/ISBN_(identifier)/15AdSPa9">ISBN</a> 978-3-540-20150-2.</li>
<li>Boneh, Dan (1998). "The Decision Diffie-Hellman problem". ANTS 1998: Algorithmic Number Theory. Lecture Notes in Computer Science. Vol. 1423. Springer. pp. 48–63. <a href="/facts/CiteSeerX_(identifier)/SceDmd3c">CiteSeerX</a> <a href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.461.9971">10.1.1.461.9971</a>. <a href="/facts/Doi_(identifier)/muM9Etpq">doi</a>:<a href="https://doi.org/10.1007%2Fbfb0054851">10.1007/bfb0054851</a>. <a href="/facts/ISBN_(identifier)/15AdSPa9">ISBN</a> 978-3-540-64657-0.</li>
<li>Bresson, Emmanuel; Chevassut, Olivier; Pointcheval, David (2003). <a href="https://www.di.ens.fr/~bresson/papers/BreChePoi02b.pdf">"The Group Diffie-Hellman Problems"</a> (PDF). SAC 2002: Selected Areas in Cryptography. Lecture Notes in Computer Science. Vol. 2595. Springer. pp. 325–338. <a href="/facts/Doi_(identifier)/muM9Etpq">doi</a>:<a href="https://doi.org/10.1007%2F3-540-36492-7_21">10.1007/3-540-36492-7_21</a>. <a href="/facts/ISBN_(identifier)/15AdSPa9">ISBN</a> 978-3-540-00622-0. <a href="/facts/S2CID_(identifier)/ldJsHa2Y">S2CID</a> <a href="https://api.semanticscholar.org/CorpusID:14425909">14425909</a>.</li>
<li>Biham, Eli; Boneh, Dan; Reingold, Omer (1999). "Breaking generalized Diffie–Hellman modulo a composite is no easier than factoring". Information Processing Letters. 70 (2): 83–87. <a href="/facts/CiteSeerX_(identifier)/SceDmd3c">CiteSeerX</a> <a href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.39.110">10.1.1.39.110</a>. <a href="/facts/Doi_(identifier)/muM9Etpq">doi</a>:<a href="https://doi.org/10.1016%2FS0020-0190%2899%2900047-2">10.1016/S0020-0190(99)00047-2</a>.</li>
<li>Steiner, Michael; Tsudik, Gene; Waidner, Michael (1996). <a href="https://archive.org/details/3rdacmconference00asso">"Diffie-Hellman key distribution extended to group communication"</a>. <a href="https://archive.org/details/3rdacmconference00asso/page/31">Proceedings of the 3rd ACM conference on Computer and communications security - CCS '96</a>. ACM. pp. <a href="https://archive.org/details/3rdacmconference00asso/page/31">31–37</a>. <a href="/facts/CiteSeerX_(identifier)/SceDmd3c">CiteSeerX</a> <a href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.35.9717">10.1.1.35.9717</a>. <a href="/facts/Doi_(identifier)/muM9Etpq">doi</a>:<a href="https://doi.org/10.1145%2F238168.238182">10.1145/238168.238182</a>. <a href="/facts/ISBN_(identifier)/15AdSPa9">ISBN</a> 978-0897918299. <a href="/facts/S2CID_(identifier)/ldJsHa2Y">S2CID</a> <a href="https://api.semanticscholar.org/CorpusID:13919278">13919278</a>.</li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1">Diffie, W.; Hellman, M. (1976-11-01). "New directions in cryptography". IEEE Transactions on Information Theory. 22 (6): 644–654. doi:10.1109/TIT.1976.1055638. ISSN 0018-9448 – via IEEE. <a href="https://ieeexplore.ieee.org/document/1055638/" target="_blank">https://ieeexplore.ieee.org/document/1055638/</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></li>
</ol>

Diffie–Hellman problem open-in-new

Diffie–Hellman problem