Is the composite order matrix-DDH secure?

filter hash

3/13/24, 2:23 PM

I recently read a paper that proposed a matrix-DDH which is a matrix variant of DDH assumption. The brief definition is follows:

Let $G$ be a group of prime order $q$. Then, the matrix-DDH says that it is hard to distinguish between two distributions: $\{[A], [A\cdot w] \} \approx \{[A], [u], u\leftarrow \text{random} \}$.

Here, the bracket notation $[x]$ denotes the group element with discrete logarithm $x$. For a vector $v = (v_1, \ldots,v_k)$, $[v]$ denotes a vector of the form $(g^{v_1}, \ldots, g^{v_k})$. For any matrix $A$, $[A]$ is similarly defined. That is, $[A]$ is a matrix of which $(i,j)$-th entry is $g^{A_{i,j}}$, where $A_{i,j}$ is the $(i,j)$-th entry of $A$.

The original paper only proves a case that $q$ is prime. On the other hand, when $q$ is a composite order, the matrix-DDH is still secure? I could not find any reference about this.

0 + 5

discrete-logarithm

hardness-assumptions

kodlu

3/13/24, 6:05 PM

please clarify the question with definition of how the matrices come in

filter hash

3/14/24, 9:07 AM

@kodlu Suppose that $A \leftarrow Z_q^{\ell \times k}, w \leftarrow \Z_q^k$ and $u\leftarrow \Z_q^\ell$. For a group $G$ of prime order $q$ with generator $g$, we use a notation [a] = g^a for any a. Under this setup, matrix DDH assumption says that the advantage of distinguishing two distributions in the main body is negligible. My question is what happen $q$ is composite number instead of prime.

Ievgeni

3/14/24, 10:44 AM

What is the vector $[w]$?

filter hash

3/14/24, 11:34 AM

Given $w=(w_1,\cdots,w_k)$, $[w]$ is denoted by $([w_1], \cdots, [w_k])$. I apologize for many mistatkes. For a matrix $A$, $[A]$ is similarly defined.

kodlu

3/14/24, 11:45 AM

Please put these clarifications into the question itself

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Is the composite order matrix-DDH secure?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.