Diffie–Hellman problem
Problem in cryptography
- 2 min read
- 3 chapters
Related on Lably
Through Group (mathematics)
Problem description
The Diffie–Hellman problem is stated informally as follows:
- Given an element and the values of and , what is the value of ?
Formally, is a generator of some group (typically the multiplicative group of a finite field or an elliptic curve group) and and are randomly chosen integers.
For example, in the Diffie–Hellman key exchange, an eavesdropper observes and exchanged as part of the protocol, and the two parties both compute the shared key . A fast means of solving the DHP would allow an eavesdropper to violate the privacy of the Diffie–Hellman key exchange and many of its variants, including ElGamal encryption.
Sign in to keep reading
2 more chapters are free with a Lably account.
Computational complexity
In cryptography, for certain groups, it is assumed that the DHP is hard, and this is often called the Diffie–Hellman assumption. The problem has survived scrutiny for a few decades and no "easy" solution has yet been publicized.
As of 2006, the most efficient means known to solve the DHP is to solve the discrete logarithm problem (DLP), which is to find x given g and gx. In fact, significant progress (by den Boer, Maurer, Wolf, Boneh and Lipton) has been made towards showing that over many groups the DHP is almost as hard as the DLP. There is no proof to date that either the DHP or the DLP is a hard problem, except in generic groups (by Nechaev and Shoup). A proof that either problem is hard implies that P ≠ NP.
Other variants
Many variants of the Diffie–Hellman problem have been considered. The most significant variant is the decisional Diffie–Hellman problem (DDHP), which is to distinguish gxy from a random group element, given g, gx, and gy. Sometimes the DHP is called the computational Diffie–Hellman problem (CDHP) to more clearly distinguish it from the DDHP. Recently groups with pairings have become popular, and in these groups the DDHP is easy, yet the CDHP is still assumed to be hard. For less significant variants of the DHP see the references.