TY - JOUR

T1 - The twin diffie-hellman problem and applications

AU - Cash, David

AU - Kiltz, Eike

AU - Shoup, Victor

N1 - Funding Information:
Supported by the research program Sentinels.

PY - 2009/10

Y1 - 2009/10

N2 - We propose a new computational problem called the twin Diffie-Hellman problem. This problem is closely related to the usual (computational) Diffie-Hellman problem and can be used in many of the same cryptographic constructions that are based on the Diffie-Hellman problem. Moreover, the twin Diffie-Hellman problem is at least as hard as the ordinary Diffie-Hellman problem. However, we are able to show that the twin Diffie-Hellman problem remains hard, even in the presence of a decision oracle that recognizes solutions to the problem-this is a feature not enjoyed by the Diffie-Hellman problem, in general. Specifically, we show how to build a certain "trapdoor test" that allows us to effectively answer decision oracle queries for the twin Diffie-Hellman problem without knowing any of the corresponding discrete logarithms. Our new techniques have many applications. As one such application, we present a new variant of ElGamal encryption with very short ciphertexts, and with a very simple and tight security proof, in the random oracle model, under the assumption that the ordinary Diffie-Hellman problem is hard. We present several other applications as well, including a new variant of Diffie and Hellman's non-interactive key exchange protocol; a new variant of Cramer-Shoup encryption, with a very simple proof in the standard model; a new variant of Boneh-Franklin identity-based encryption, with very short ciphertexts; a more robust version of a password-authenticated key exchange protocol of Abdalla and Pointcheval.

AB - We propose a new computational problem called the twin Diffie-Hellman problem. This problem is closely related to the usual (computational) Diffie-Hellman problem and can be used in many of the same cryptographic constructions that are based on the Diffie-Hellman problem. Moreover, the twin Diffie-Hellman problem is at least as hard as the ordinary Diffie-Hellman problem. However, we are able to show that the twin Diffie-Hellman problem remains hard, even in the presence of a decision oracle that recognizes solutions to the problem-this is a feature not enjoyed by the Diffie-Hellman problem, in general. Specifically, we show how to build a certain "trapdoor test" that allows us to effectively answer decision oracle queries for the twin Diffie-Hellman problem without knowing any of the corresponding discrete logarithms. Our new techniques have many applications. As one such application, we present a new variant of ElGamal encryption with very short ciphertexts, and with a very simple and tight security proof, in the random oracle model, under the assumption that the ordinary Diffie-Hellman problem is hard. We present several other applications as well, including a new variant of Diffie and Hellman's non-interactive key exchange protocol; a new variant of Cramer-Shoup encryption, with a very simple proof in the standard model; a new variant of Boneh-Franklin identity-based encryption, with very short ciphertexts; a more robust version of a password-authenticated key exchange protocol of Abdalla and Pointcheval.

UR - http://www.scopus.com/inward/record.url?scp=68549123481&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=68549123481&partnerID=8YFLogxK

U2 - 10.1007/s00145-009-9041-6

DO - 10.1007/s00145-009-9041-6

M3 - Article

AN - SCOPUS:68549123481

SN - 0933-2790

VL - 22

SP - 470

EP - 504

JO - Journal of Cryptology

JF - Journal of Cryptology

IS - 4

ER -