Editing Decisional Diffie–Hellman assumption (section)

==Relation to other assumptions==

The DDH assumption is related to the [[discrete logarithm|discrete log assumption]].  If it were possible to efficiently compute discrete logs in <math>G</math>, then the DDH assumption would not hold in <math>G</math>. Given <math>(g^a,g^b,z)</math>, one could efficiently decide whether <math>z=g^{ab}</math> by first taking the discrete <math>\log_g</math> of <math>g^a</math>, and then comparing <math>z</math> with <math>(g^b)^a</math>.

DDH is considered to be a '''stronger''' assumption than the discrete logarithm assumption, because there are groups for which computing discrete logs is believed to be hard (and thus the DL Assumption is believed to be true), but detecting DDH tuples is easy (and thus DDH is false). Because of this, requiring that the DDH assumption holds in a group is believed to be a more restrictive requirement than DL.

The DDH assumption is also related to the [[computational Diffie–Hellman assumption]] (CDH).  If it were possible to efficiently compute <math>g^{ab}</math> from <math>(g^a,g^b)</math>, then one could easily distinguish the two probability distributions above. DDH is considered to be a stronger assumption than CDH because if CDH is solved, which means we can get <math>g^{ab}</math>, the answer to DDH will become obvious.