主流的密码学 hardness/computational 假设

1. Discrete logarithm problem

Let $g$为 a known element of prime order $r$ in a group (with group operation written multiplicatively). Let $G=<g>$ be the group generated by $g$.

常用的group选择有：

• multiplicative group of a finite field;
• algebraic torus over a finite field;
• elliptic curve over a finite field;
• divisor class group of a curve over a finite field。

Discrete logarithm problem常用假设有：

• DLP: discrete logarithm problem。常用于Schnorr signatures, DSA signatures。
  已知$h\in G$，找到$x$使得$h=g^x$。

• CDH: computational Diffie-Hellman problem。常用于 Diffie-Hellman key exchange and variants, Elgamal encryption and variants, BLS signatures and variants。
  已知$g^a,g^b\in G$，计算$g^{ab}$。

• SDH: static Diffie-Hellman problem。
  Fix $g,g^a\in G$. Given $h\in G$，计算$h^a$。

• gap-CDH: Gap Diffie-Hellman problem。常用于 ECIES proof in the Random Oracle Model, Chaum undeniable signature。
  已知$g^a,g^b\in G$，计算$g^{ab}$，when the algorithm has access to an oracle which solves the DDH problem。

• DDH: decision Diffie-Hellman problem。常用于 Diffie-Hellman key exchange and variants, Elgamal encryption and variants.
  已知$g^a,g^b,h\in G$，判断$h=g^{ab}$是否成立？

• Strong-DDH: strong decision Diffie-Hellman problem
  已知$g,g^a,g^b,g^{b^{-1}},h\in G$，判断$h=g^{ab}$是否成立？

• sDDH: skewed decision Diffie-Hellman problem。
  Let $f$ 为任意的uninvertible function with domain ${\mathbb{Z}}_r$。已知$f(a),g^b,h\in G$，判断$h=g^{ab}$是否成立？

• PDDH: parallel decision Diffie-Hellman problem。
  已知$g^{x_1},\cdots ,g^{x_n},h_1,\cdots ,h_n\in G$，判断$h_1=g^{x_1{x}_2},\cdots ,h_{n-1}=g^{x_{n-1}{x}_n},h_n=g^{x_n{x}_1}$是否成立？

• Square-DH: Square Diffie-Hellman problem. The best known algorithm for Square-DH is to actually solve the DLP.
  已知$g^a\in G$，计算$g^{a^2}$。

• l-DHI: l-Diffie-Hellman inversion problem. The best known algorithm for l-DHI is to actually solve the DHP.
  已知$g^a,g^{a^2},\cdots ,g^{a^l}\in G$，计算$g^{1/a}$。

• l-DDHI: l-Decisional Diffie-Hellman inversion problem
  已知$g^a,g^{a^2},\cdots ,g^{a^l},v\in G$，判断$v=g^{1/a}$是否成立？

• REPRESENTATION: Representation problem. The best known algorithm for REPRESENTATION is to solve the DLP.
  已知$g_1,\cdots ,g_k,h\in G$，找到$a_1,\cdots ,a_k$使得$h=g_1^{a_1}\cdots g_k^{a_k}$成立。

• LRSW: LRSW Problem. The best known algorithm for LRSW is to solve the DLP.
  已知$g,g^x,g^y$，已知 oracle $O$（输入为 $s$，其选择一个随机值 $a=g^z$，然后其输出为$(a,a^{sy},a^{x+sxy})$），对于任意的$t$（not one of the 输入$s$）和$b\ne 1$值 计算$(t,b,b^{ty},b^{x+txy})$。

• Linear: Linear problem。The best known algorithm for Linear is to solve the DLP。
  已知$g^a,g^b,g^{ac},g^{bd}\in G$，计算$g^{c+d}$。

• D-Linear1: Decision Linear problem (version 1)
  已知$g^a,g^b,g^{ac},g^{bd},v\in G$，判断$v=g^{c+d}$是否成立？

• l-SDH: l-Strong Diffie-Hellman problem
  已知$g^a,g^{a^2},\cdots ,g^{a^l}\in G$，找到$w\in F_q$并计算$g^{1/(a+w)}$。

• c-DLSE: Discrete Logarithm with Short Exponents。The best known algorithm for the c-DLSE is to use the baby-step-giant-step or Pollard kangaroo algorithms for solving the DLP in a short interval. 常用于
  Gennaro pseudorandom generator。
  Let $G={\mathbb{Z}}_p^{\ast }$ 其中$p-1=2q$，$p,q$均为primes，let $c$为integer。已知 $g^x\mathrm{m}\mathrm{o}\mathrm{d}p$ 且 $0\le x\le 2^c$，求解相应的$x$值。

• CONF: (conference-key sharing scheme)。常用于Okamoto’s conference-key sharing scheme。
  已知$g^a,g^b,g^{ab}\in G$，计算$g^b$。

• 3PASS: 3-Pass Message Transmission Scheme。常用于Shamir’s 3-pass message transmission scheme。
  已知$A,B,C\in G$，找到相应的$s$使得$A=s^a,B=s^b,C=s^{ab}$成立。

• LUCAS: Lucas Problem。
  已知$p,z\in <V_t(m)>$，找到相应的$x$，使得$V_x(m)=z$成立。其中$V_t(m)$的定义为：$V_0(m)=2,V_1(m)=m,V_t(m)=m{V}_{t-1}(m)-V_{t-2}(m)。$

• XLP: x-Logarithm Problem。
  对于Elliptic curve $E({\mathbb{F}}_q)$上的任意一点 $P=(x,y)\in {\mathbb{F}}_q^2$，将$x(P)=\bar{x}$ 表示为$P$点$ X坐标的二进制表示。对任意的group element $g^a$，$x=x(g^a)$，是否能区分$g^a$和$g^x$？

• MDHP: Matching Diffie-Hellman Problem。常用于E-Cash。
  Let $g$ be a generator of group $G$ having order $q$，let $a_0,b_0,a_1,b_1\in {\mathbb{Z}}_q$ and $r{\in }_R\{0,1\}$。已知$(g^{a_0},g^{a_0{b}_0},g^{a_1},g^{a_1{b}_1})$和$(g^{b_r},g^{b_{1-r}})$，找到相应的$r$。

• DDLP: Double Discrete Logarithm Problem。常用于Public verifiable secret sharing。
  Let $p,q$ 为素数且$q=(p-1)/2$，设置$G$为group of order $p$ with generator $g$，$h\in {\mathbb{Z}}_p^{\ast }$为an element of order $q$。已知$g,h,a=g^{(h^x)}$，求解$x$。

• rootDLP: Root of Discrete Logarithm Problem。常用于Camenisch and Stadler group signature scheme。
  已知group generator $g$, positive integer $e$ 和 $a\in G$，计算$x$使得$a=g^{(x^e)}$成立。

• n-M-DDH: Multiple Decision Diffie-Hellman Problem。常用于 Group key exchange。
  Let $n\ge 2$，$D=(g^{x_1},\cdots ,g^{x_n},\{g^{x_i{x}_j}{\}}_{1\le i<j\le n})$ 其中$x_1,\cdots ,x_n\in {\mathbb{Z}}_r$为随机值；$D_{random}=(g_1,\cdots ,g_n,\{g_{ij}{\}}_{1\le i<j\le n})$为a random tuple in $G$。很难区分$D$和$D_{random}$。

• l-HENSEL-DLP: l-Hensel Discrete Logarithm Problem。
  Let $G$为a subgroup or prime order $r$ in ${\mathbb{Z}}_p^{\ast }$，其中$p$为a prime with polynomial binary length；Let $1<g<p$ be an integer满足$g^r\equiv 1(\mathrm{m}\mathrm{o}\mathrm{d}{p}^{l-1}),g^r\not\equiv 1\mathrm{m}\mathrm{o}\mathrm{d}{p}^l)$，其中$l>1且为整数$。已知$g^x\mathrm{m}\mathrm{o}\mathrm{d}p$，$x$为$[1,r-1]$范围内的随机数，计算$g^x\mathrm{m}\mathrm{o}\mathrm{d}{p}^l$。

• DLP(Inn(G)): Discrete Logarithm Problem over Inner Automorphism Group。常用于MOR Public Key Cryptosystem。
  已知$\varphi ,{\varphi }^s\in Inn(G)$ for $s\in \mathbb{Z}$，求解$s(\mathrm{m}\mathrm{o}\mathrm{d}|\varphi |)$。

• IE: Inverse Exponent。
  为l-DHI （l-Diffie-Hellman inversion problem） $l=1$的特例情况。

• TDH: The Twin Diffie-Hellman Assumption。
  Let $G$ 为 a cyclic group with generator $g$，and of prime order $q$。定义$dh(X,Y)=Z$，其中$X=g^x,Y=g^y,Z=g^{xy}$。定义twin DH function $2dh:G^3\to G^2(X_1,X_2,Y)\to (dh(X_1,Y),dh(X_2,Y))$。定义相应的twin DH predicate为：$2dhp(X_1,X_2,\hat{Y},{\hat{Z}}_1,{\hat{Z}}_2)=1iff2dh(X_1,X_2,\hat{Y})=({\hat{Z}}_1,{\hat{Z}}_2)$。
  twin DH assumption是指：已知random $X_1,X_2,Y\in G$，计算$2dh(X_1,X_2,Y)$很难。
  strong twin DH assumption是指：已知$X_1,X_2,Y\in G$ along with access to a decision oracle for the predicate $2dhp(X_1,X_2,\cdot ,\cdot ,\cdot )$ which on input $(\hat{Y},{\hat{Z}}_1,{\hat{Z}}_2)$ returns $2dhp(X_1,X_2,\hat{Y},{\hat{Z}}_1,{\hat{Z}}_2)$，计算$2dh(X_1,X_2,Y)$很难。

• XTR-DL: XTR discrete logarithm problem。Most protocols based on DLP can be used with XTR.
  Let $Tr(g)$ 为an XTR representation of an element of the XTR subgroup of ${\mathbb{F}}_{p^6}^{\ast }$，已知$t$，求解$x$使得$t=Tr(g^x)$成立。

• XTR-DH: XTR Diffie-Hellman problem。Most protocols based on DLP can be used with XTR.
  Let $Tr(g)$ 为an XTR representation of an element of the XTR subgroup of ${\mathbb{F}}_{p^6}^{\ast }$，已知$t_1,t_2$，求解$t_3$使得$t_1=Tr(g^x),t_2=Tr(g^y),t_3=Tr(g^{xy})$成立。

• XTR-DHD: XTR decision Diffie-Hellman problem.Most protocols based on DLP can be used with XTR.
  Let $Tr(g)$ 为an XTR representation of an element of the XTR subgroup of ${\mathbb{F}}_{p^6}^{\ast }$，已知$t_1=Tr(g^x),t_2=Tr(g^y),t_3$，判断$t_3=Tr(g^{xy})$是否成立？

• CL-DLP: discrete logarithms in class groups of imaginary quadratic orders。常用于key exchange。
  为standard discrete logarithm problems in a class group of imaginary quadratic orders。

• TV-DDH: Tzeng Variant Decision Diffie-Hellman problem。常用于Conference key agreement.
  Let $p,q=2p+1$均为素数，let $G\subseteq {\mathbb{F}}_p^{\ast }$ 为subgroup of order $q$。$h\in G$为$[1,p-1]$内的整数，$h\mathrm{m}\mathrm{o}\mathrm{d}q$为$[0,q-1]$内整数。已知$g_1,g_2\in G$ 且 $0\le u_1,u_2<q$，取任意整数$a$，判断$u_1=g_1^a\mathrm{m}\mathrm{o}\mathrm{d}q,u_2=g_2^a\mathrm{m}\mathrm{o}\mathrm{d}q$是否成立？

• n-DHE: n-Diffie-Hellman Exponent problem。常用于 Broadcast encryption, accumulators.
  对于a group $G$ of prime order $q$，let $g_i=g^{{\lambda }^i},\lambda \leftarrow {\mathbb{Z}}_q$，已知$\{g,g_1,g_2,\cdots ,g_n,g_{n+2},\cdots ,g_{2n}\}\in G^{2n}$，计算$g_{n+1}。$

2. Factoring

Factoring problems通常针对的是products of two random primes。如$n=pq,n\in \mathbb{N}$，其中$p,q$均为素数。
通常基于安全考虑，定义强素数的形式为$p=2p^{\prime }+1$，其中$p$和$p^{\prime }$均为素数。

• FACTORING: integer factorisation problem
  已知正整数$n\in \mathbb{N}$，寻找其素数因式分解 $n=p_1^{e_1}{p}_2^{e_2}\cdots p_k^{e_k}$，其中$p_i$为pairwise distinct 素数，$e_i>0$。

• SQRT: square roots modulo a composite
  已知复合正整数$n\in \mathbb{N}$ 和 a square $a$ modulo $n$，求$a$ modulo $n$的平方根，即求解integer $x$ 使得 $x^2\equiv a(modn)$。
  常用于Rabin encryption。

• $CHARACTE{R}^d$: character problem
  Let $n$和$d$为正整数，已知$x\in {\mathbb{Z}}_n^{\ast }$，设计算法$\chi (x)$，其中$\chi$为a non-trivial character of ${\mathbb{Z}}_n^{\ast }$ of order $d$。
  常用于Undeniable Signautres。
  可看成是quadratic residuosity problem的generalisation。

• $MOV{A}^d$: character problem
  Let $n\in \mathbb{Z},s\in {\mathbb{Z}}^{+}$，$\chi$为a character of order $d$ on ${\mathbb{Z}}_n^{\ast }$。已知$s$个pairs $({\alpha }_i,\chi ({\alpha }_i))$，其中${\alpha }_i\in {\mathbb{Z}}_n^{\ast }$ for all $i\in [1,\cdots ,s]$，$x\in {\mathbb{Z}}_n^{\ast }$，计算$\chi (x)$。
  常用于Undeniable Signautres。

• $CYCLOFAC{T}^d$: factorisation in Z[θ]
  Let $\theta$ 为 $d^{th}$ root of unity，$\sigma$ 为 an element of $\mathbb{Z}[\theta ]$，求$\sigma$的因式分解。

• $FERMA{T}^d$: factorisation in Z[θ]
  Let $\theta$ 为 $d^{th}$ root of unity，$n\in \mathbb{Z}$ 使得$n=\pi \bar{\pi }$ for some $\pi \in \mathbb{Z}[\theta ]$。已知$n$，求$\pi$。

• RSAP: RSA problem
  已知正整数$n$为至少2个素数的乘积，已知整数$e$ (coprime with $\phi (n)$) 和整数$c$，求整数$m$使得$m^e\equiv c(modn)$成立。

• Strong-RSAP: strong RSA problem
  已知正整数$n$为至少2个素数的乘积，已知整数$c$，求奇数$e\ge 3$和整数$m$，使得$m^e\equiv c(modn)$成立。

• Difference-RSAP: Difference RSA problem
  已知正整数$n$为至少2个素数的乘积，已知an element $D\in {\mathbb{Z}}_n^{\ast }$ 和 $m-1$ 个pairs $(x_i,y_i)$ 使得 $x_i^e-y_i^e=D(modn)$，求解新的pair $x_m^e-y_m^e=D(modn)$ 成立。

• Partial-DL-ZN2P: Partial Discrete Logarithm problem in ${\mathbb{Z}}_{n^2}^{\ast }$
  已知正整数$n=pq$，其中$p=2p^{\prime }+1,q=2q^{\prime }+1$，$p,p^{\prime },q,q^{\prime }$均为素数，已知an element $g\in {\mathbb{Z}}_{n^2}^{\ast }$ of maximal order in $G=Q{R}_{n^2}$ 和 $h=g^{a}mod{n}^2$ for some $a\in \{1,\cdots ,ord(G)\}$，求解整数$x$使得$x=a(modn)$。
  常用于homomorphic public key encryption, public key encryption with double trapdoor decryption mechanism。

• DDH-ZN2P: Decision Diffie-Hellman problem over ${\mathbb{Z}}_{n^2}^{\ast }$
  已知正整数$n=pq$，其中$p=2p^{\prime }+1,q=2q^{\prime }+1$，$p,p^{\prime },q,q^{\prime }$均为素数，已知an element $g\in {\mathbb{Z}}_{n^2}^{\ast }$ of maximal order in $G=Q{R}_{n^2}$ 和 elements $X=g^{x}mod{n}^2,Y=g^{y}mod{n}^2$ for some $x,y\in \{1,\cdots ,ord(G)\}$ 以及 $Z\in G$，判断$Z=g^{xy}mod{n}^2$是否成立。
  常用于public key encryption with double trapdoor decryption mechanism。

• Lift-DH-ZN2P: Lift Diffie-Hellman problem over ${\mathbb{Z}}_{n^2}^{\ast }$
  已知正整数$n=pq$，其中$p=2p^{\prime }+1,q=2q^{\prime }+1$，$p,p^{\prime },q,q^{\prime }$均为素数，已知an element $g\in {\mathbb{Z}}_{n^2}^{\ast }$ of maximal order in $G=Q{R}_{n^2}$ 和 elements $X=g^{x}mod{n}^2,Y=g^{y}mod{n}^2$ for some $x,y\in \{1,\cdots ,ord(G)\}$ 以及 $Z=g^{xy}modn$，求$Z^{\prime }=g^{xy}mod{n}^2$。
  常用于public key encryption with double trapdoor decryption mechanism。

• EPHP: Election Privacy Homomorphism problem
  已知固定的小素数$e$、素数$p$ 使得 $e|(p-1)$、素数$q$使得$e\nmid (q-1)$，有$n=pq$、$g\in {\mathbb{Z}}_n$ 且$e$ divides the order of $g$。由$g$作为generator生成的group表示为$G$。
  EPHP是指：已知$w\in G$、$v\in [0,e]$，是否存在$r\in N$，使得$w=g^{v+er}$成立。存在的概率应高于$(e-1)/e$。
  常用于homomorphic public key encryption 和 electronic voting protocols。

• AERP: Approximate e-th root problem
  已知正整数$n=p^{2}q$，其中$p,q$为素数且$|n|=3k$，已知整数$e\ge 4$、$y\in {\mathbb{Z}}_n$，求整数$x$，使得$(x^{e}modn)\in I_k(y)$成立，其中$I_k(y)=\{u|y\le u<y+2^{2k-1}\}$。
  常用于ESIGN signature scheme。

• $l$-HENSEL-RSAP: $l$-Hensel RSA
  已知$N=pq$，$e$ coprime with $\varphi (N)$，$x^e(modN)$ for a random integer $1<x<N$，求$x^e(mod{N}^l)$。
  常用于public-key encryption。

• DSeRP: Decisional Small e-Residues in ${\mathbb{Z}}_{n^2}^{\ast }$
  已知正整数$n=pq$，其中$p,q$为素数，已知整数 $e>2$ 使得 $gcd(e,n(p-1)(q-1))=1$，是否能区分 $D_0=\{c=r^{e}mod{n}^2|r{\in }_R{\mathbb{Z}}_n\}$ distribution 和 $D_1=\{c{\in }_R{\mathbb{Z}}_{n^2}\}$ distribution。
  常用于Semantically secure public key encryption from Paillier-related assumptions。

• DS2eRP: Decisional Small 2e-Residues in ${\mathbb{Z}}_{n^2}^{\ast }$
  已知正整数$n=pq$，其中$p,q$为素数，$p=q=3mod4$，已知整数$e$ 使得 $gcd(e,n(p-1)(q-1))=1$且$|n|/2<3<|n|$，是否能区分 $D_0=\{c=r^{2e}mod{n}^2|r{\in }_{R}Q{R}_n\}$ distribution 和 $D_1=\{c{\in }_{R}Q{R}_{n^2}\}$ distribution。
  常用于Semantically secure public key encryption mixing Paillier and Rabin functions。

• DSmallRSAKP: Decisional Reciprocal RSA-Paillier in ${\mathbb{Z}}_{n^2}^{\ast }$
  已知正整数$n=pq$，其中$p,q$为素数，已知an element $\alpha$使得 $(\alpha /p)=(\alpha /q)=-1$，已知整数$e$使得$|n|/2<e<|n|$，是否能区分 $D_0=\{(n,e,\alpha ,c)|c=(r+\frac{\alpha }{r}{)}^{e}mod{n}^2,r{\in }_R{\mathbb{Z}}_{n}s.t.(r/n)=1,(\alpha /rmodn)>r\}$ distribution 和 $D_1=\{(n,e,\alpha ,c)|c=(r+\frac{\alpha }{r}{)}^{e}mod{n}^2,r{\in }_R{\mathbb{Z}}_{n^2}\}$ distribution。
  常用于Semantically secure public key encryption from Paillier-related assumptions。

• HRP: Higher Residuosity Problem

• ECSQRT: Square roots in elliptic curve groups over Z/nZ

• RFP: Root Finding Problem

• phiA: PHI-Assumption

• C-DRSA: Computational Dependent-RSA problem

• D-DRSA: Decisional Dependent-RSA problem

• E-DRSA: Extraction Dependent-RSA problem

• DCR: Decisional Composite Residuosity problem

• CRC: Composite Residuosity Class problem

• DCRC: Decisional Composite Residuosity Class problem

• GenBBS: generalised Blum-Blum-Shub assumption

3. Product groups

• co-CDH: co-Computational Diffie-Hellman Problem
• PG-CDH: Computational Diffie-Hellman Problem for Product Groups
• XDDH: External Decision Diffie-Hellman Problem
• D-Linear2: Decision Linear Problem (version 2)
• PG-DLIN: Decision Linear Problem for Product Groups
• FSDH: Flexible Square Diffie-Hellman Problem
• KSW1: Assumption 1 of Katz-Sahai-Waters

4. Pairings

2008年《Pairings for cryptographers》中指出，pairings over groups of known prime order 表示为：
$$\hat{t}:G_1\times G_2\to G_T$$
若其中 $G_1,G_2,G_T$都具有相同的prime order $l$，则可分为以下三大类：
1）Type 1：$G_1=G_2$；【通常使用supersingular curves，这些supersingular curves又分为两类：一类是over fields of characteristic 2 or 3 (with embedding degree 4 or 6 respectively)；另一类是over fields of large prime characteristic (with embedding degree 2)。】
2）Type 2：$G_1\ne G_2$，但是存在efficiently computable homomorphism $\varphi :G_2\to G_1$；【通常使用ordinary curves，且the homomorphism from $G_2$ to $G_1$ is the trace map。】
3）Type3：$G_1\ne G_2$，且不存在efficiently computable homomorphism $\varphi :G_2\to G_1$。【通常使用ordinary curves，且$G_2$为the kernel of the trace map。】

若$G_2$ 为non-cyclic group of order $l^2$，则可称为Type 4。

具体举例为：

• Type 1：
  
• Type 2：
  
• Type 3：
  

若${\log }_{g_1}a={\log }_{g_2}b$，则表示为$a\sim b$。
Pairing 相关假设有：【注意，有的assumption并不适于所有的pairing type。Certain assumptions are provably false w.r.t. certain group types.】

• BDHP: Bilinear Diffie-Hellman Problem。
  已知$g_i^a,g_j^b和g_k^c$，计算$\hat{t}(g_1,g_2{)}^{abc}$。
  其中$i,j,k\in \{1,2\}$，对应有四种可能的组合$(i,j,k)\in \{(1,1,1),(1,1,2),(1,2,2),(2,2,2)\}$，也可称为$BDH{P}_{i,j,k}$。
  – 对于Type 1 pairing，以上四种组合是等价的。
  – 对于Type 2 pairing，具有$BDH{P}_{2,2,2}{\le }_{P}BDH{P}_{1,2,2}{\le }_{P}BDH{P}_{1,1,2}{\le }_{P}BDH{P}_{1,1,1}$。
  – 对于Type 3 pairing，这四种组合have no known reductions between them。

• DBDH: Decision Bilinear Diffie-Hellman Problem。常用于 Boneh-Franklin ID-based encryption scheme。
  已知$g_i^a,g_j^b,g_k^c和\hat{t}(g_1,g_2{)}^z$，判断$\hat{t}(g_1,g_2{)}^{abc}=\hat{t}(g_1,g_2{)}^z$是否成立。

• B-DLIN: Bilinear Decision-Linear Problem
  

• l-BDHI: l-Bilinear Diffie-Hellman Inversion Problem
  已知$g_i^a,g_i^{a^2},g_i^{a^3},\cdots ,g_i^{a^l}$，计算$\hat{t}(g_1,g_2{)}^{1/a}$。其中$i\in \{1,2\}$。

• l-DBDHI: l-Bilinear Decision Diffie-Hellman Inversion Problem
  已知$g_i^a,g_i^{a^2},g_i^{a^3},\cdots ,g_i^{a^l}$和$v\in G_T$，判断$v=\hat{t}(g_1,g_2{)}^{1/a}$是否成立？其中$i\in \{1,2\}$。

• l-wBDHI: l-weak Bilinear Diffie-Hellman Inversion Problem。
  已知$g_i^a,g_i^{a^2},g_i^{a^3},\cdots ,g_i^{a^l}$和$g_j^b$，计算$\hat{t}(g_1,g_2{)}^{a^{l+1}b}$。其中$i\in \{1,2\}$。

• l-wDBDHI: l-weak Decisional Bilinear Diffie-Hellman Inversion Problem
  已知$g_i^a,g_i^{a^2},g_i^{a^3},\cdots ,g_i^{a^l},g)j^b$和$v\in G_T$，判断$v=\hat{t}(g_1,g_2{)}^{a^{l+1}b}$是否成立？其中$i\in \{1,2\}$。

• KSW2: Assumption 2 of Katz-Sahai-Waters。首次用于 the construction of a predicate encryption scheme supporting the inner product。（KATZ等人2008年论文《Predicate Encryption Supporting Disjunctions, Polynomial Equations, and Inner Products》）
  – 运行$G(1^n)$来获取$(p,q,r,G,G_T,\hat{t})$；
  – 设置$N=pqr$，let $g_p,g_q,g_r$分别为$G_p,G_q,G_r$的generators；
  – 选择随机数$h\in G_p;Q_1,Q_2\in G_q;s,\gamma \in {\mathbb{Z}}_q$以及random bit $v$；
  – p.p.t. adversary $A$ 的输入有$(N,G,G_T,\hat{t})$和$g_p,g_q,g_r,h,g_p^s,h^s{Q}_1,g_p^{\gamma }{Q}_2,\hat{t}(g_p,h{)}^{\gamma }$，当$v=0$时，再给$A$ 输入$\hat{t}(g_p,h{)}^{\gamma s}$；当$v=1$时，给$A$的输入为a random element of $G_T$。$A$的输出为a bit $v^{\prime }$，且其succeed if $v^{\prime }=v$。

• MSEDH: Multi-sequence of Exponents Diffie-Hellman Assumption。用于 Delerabl´ee and Pointcheval dynamic threshold public-key encryption scheme。
  – Let $B=(p,G_1,G_2,G_T,\hat{t}(\cdot ,\cdot ))$为a bilinear map group system，let $l,m,t$为3个整数，let $g_0$为$G_1$的generator，$h_0$为$G_2$的generator。
  – 输入为2个random coprime polynomials $f$和$g$，分别具有degree $l$和$m$，分别具有pairwise distinct roots $x_1,\cdots ,x_l$和$y_1,\cdots ,y_m$。同时有$T\in G_T$以及如下的exponentiations 序列：
  
  判断$T$是否与$\hat{t}(g_0,h_0{)}^{k\cdot f(\gamma )}$相等或者与$G_T$中的某随机元素相同？

• SXDH assumption: the SXDH assumption states that there are prime-order groups $(G_1,G_2,G_T)$ that admits a bilinear map $e:G_1\times G_2\to G_T$ such that the Decisional Diffie-Hellman (DDH) assumption holds in both $G_1$ and $G_2$. 首次在2005年论文《Correlation-Resistant Storage via Keyword-Searchable Encryption》中提出：
  
  而在 2019年论文《Proofs for Inner Pairing Products and Applications》中指出，SXDH assumption仅在Type 3 pairings 下成立，因此任何基于SXDH assumption的设计均对应应采用Type 3 pairing。

• DBP: double pairing assumption。在2016年论文《Structure-Preserving Signatures and Commitments to Group Elements》中提出。
  

5. Lattices

5.1 Main Lattice Problems

• SVPγp: (Approximate) Shortest vector problem
• CVPpγ: (Approximate) Closest vector problem
• GapSVPpγ: Decisional shortest vector problem
• GapCVPpγ: Decisional closest vector problem

5.2 Modular Lattice Problems

• SISp(n,m,q,β): Short integer solution problem
• ISISp(n,m,q,β): Inhomogeneous short integer solution problem
• LWE(n,q,φ): Learning with errors problem

5.3 Miscellaneous Lattice Problems

• USVPp(n,γ): Approximate unique shortest vector problem
• SBPp(n,γ): Approximate shortest basis problem
• SLPp(n,γ): Approximate shortest length problem
• SIVPp(n,γ): Approximate shortest independent vector problem
• hermiteSVP: Hermite shortest vector problem
• CRP: Covering radius problem

5.4 Ideal Lattice Problems

• Ideal-SVPf,pγ: (Approximate) Ideal shortest vector problem / Shortest polynomial problem
• Ideal-SISf,p q,m,β: Ideal small integer solution problem

6. Miscellaneous Problems

• KEA1: Knowledge of Exponent assumption。参见2004年论文《The Knowledge-of-Exponent Assumptions and 3-Round Zero-Knowledge Protocols》：
  背景知识为：Let $q$ be a prime such that $2q+1$ is also prime, and let $g$ be a generator of the order $q$ subgroup of $Z_{2q+1}^{\ast }$。假设输入有$q,g,g^a$，想要输出a pair $(C,Y),Y=C^a$。可实现的方式之一是pick some $c\in {\mathbb{Z}}_q$，设置$C=g^c$，则有$Y=(g^a{)}^c=C^a$成立。直观上来说，KEA1假设是指这是唯一的方式。对于任意的adversary能输出such a pair的，其肯定知道相应的$c$值使得$g^c=C$。在以下的正式定义中引入了extractor可返回相应的$c$值：
  KEA1 (Knowledge of Exponent assumption) 的定义为： For any adversary $A$ that takes input $q,g,g^a$，返回$(C,Y)$其中$Y=C^a$，即意味着存在an extractor $A$，对于与adversary相同的输入，可返回$c$值，使得$g^c=C$。

• MQ: Multivariable Quadratic equations。多变量二次方程式。
  已知a system of $m$ quadratic polynomial equations in $n$ variables each, $\{y_1=p_1(x_1,\cdots ,x_n),\cdots ,y_m=p_m(x_1,\cdots ,x_n)\}$，求解$x\in {\mathbb{F}}^n$ 为 in general an NP-problem。

• CF: Given-weight codeword finding。常用于: McEliece public key cryptosystem (finding the shortest codeword).
  已知$n\times k$ binary linear code $C$和相应的$n\times (n-k)$ parity check matrix $H$，求解vector $x$使得$xH=0$成立且 $x$ has weight $w$。

• ConjSP: Braid group conjugacy search problem。
  已知$x,y\in B_n$，求解$a\in B_n$使得$a^{-1}xa=y$成立。

• GenConjSP: Generalised braid group conjugacy search problem。用于 Public-key cryptosystem due to Ko, Lee, Cheon, Han, Kang and Park。
  已知$x,y\in B_n$，求解$a\in B_m,m\le n$使得$a^{-1}xa=y$成立。

• ConjDecomP: Braid group conjugacy decomposition problem。
  已知$x,y\in B_n$，$y=bx{b}^{-1}$ for some $b\in B_n$，求解$a^{\prime },a^{\prime \prime }\in B_m,m<n$使得$a^{\prime }x{a}^{\prime \prime }=y$成立。

• ConjDP: Braid group conjugacy decision problem。
  已知$x,y\in B_n$，判断$x$和$y$是否conjugate？即是否存在$a\in B_n$使得$a^{-1}xa=y$成立？

• DHCP: Braid group decisional Diffie-Hellman-type conjugacy problem。常用于 Public-key cryptosystem, pseudorandom number generator, pseudorandom synthesizer。
  已知$a,w_l^{-1}a{w}_l,w_u^{-1}a{w}_u$，判断$x_u^{-1}{x}_l^{-1}a{x}_l{x}_u=w_u^{-1}{w}_l^{-1}a{w}_l{w}_u$是否成立？for $a\in B_n,x_l,w_l\in B_l$ and $x_u,w_u\in B_u$。

• ConjSearch: (multiple simlutaneous) Braid group conjugacy search problem。
  Let $B$ be a braid group, $\bar{g}=(g_1,\cdots ,g_k)$ and $\bar{h}=(h_1,\cdots ,h_k)$ be two tuples of elements of $B$。查找$x\in B$使得$\bar{h}=x^{-1}\bar{g}x$成立。

• SubConjSearch: subgroup restricted Braid group conjugacy search problem。常用于Anshel- Anshel- Goldfeld key exchange protocol (AAG)。
  Let $B$ be a braid group, and $A$ a subgroup of $B$ generated by some $\{a_1,\cdots ,a_r\}$ and let $\bar{g}=(g_1,\cdots ,g_k)$ and $\bar{h}=(h_1,\cdots ,h_k)$ be two tuples of elements of $B$。查找$x\in A$, as a word in $\{a_1,\cdots ,a_r\}$，使得$\bar{h}=x^{-1}\bar{g}x$成立。

• LINPOLY : A linear algebra problem on polynomials。
  Let $W$ be a linear space of dimension $\le n$ consisting of quadratic forms in $n$ variables $X_1,\cdots ,X_n$。已知$V={\sum }_{1\le i\le n}{X}_{i}W$，is it possible (and how) to uniquely determine $W$? For any subspace $L^{\prime }$ of the linear space $L$ generated by $X_1,\cdots ,X_n$。Let $(V:L^{\prime })\leftarrow r\in K[X_1,\cdots ,X_n]:r{L}^{\prime }\subseteq V$ where $K$ is a finite field。
  猜想：For randomly chosen $W$, the probability $\rho$ that $(V:L)=W$ are very close to $1$, when $n>2$。

• HFE-DP: Hidden Field Equations Decomposition Problem。 It is the basis of the HFE crypto system.
  Let $F$ be a finite field of order $q$ and $S,T\in Af{f}^{-1}$ be two invertible, affine transformations over the vector space $F^n$。Denote $E:=GF(q^n)$ an extension field over $F$ and $\varphi :F^n\to E$ the bijection between this extension field and the corresponding vector space. We have ${\varphi }^{-1}(\varphi (a))=a,\forall a\in F^n$。
  Now let $P(X):={\sum }_{i,j<D,q^i+q^j<D}{C}_{i,j}{X}^{q^i+q^j}+{\sum }_{q^i<D}{B}_i{X}^{q^i}+A$ for finite field elements $C_{i,j},B_i,A\in E$ the inner polynomial. This gives the public key:
  $\mathcal{P}(x):=T\circ P\circ S(x)$
  or more precisely:
  $\mathcal{P}(x):=T\circ {\varphi }^{-1}\circ P\circ \varphi \circ S(x)$
  HFE Decomposition problem是指：已知公钥$\mathcal{P}$，找到对应的私钥$(S,P,T)$。

• HFE-SP: Hidden Field Equations Solving Problem。
  Let $F$ be a finite field of order $q$ and $S,T\in Af{f}^{-1}$ be two invertible, affine transformations over the vector space $F^n$。Denote $E:=GF(q^n)$ an extension field over $F$ and $\varphi :F^n\to E$ the bijection between this extension field and the corresponding vector space. We have ${\varphi }^{-1}(\varphi (a))=a,\forall a\in F^n$。
  Now let $P(X):={\sum }_{i,j<D,q^i+q^j<D}{C}_{i,j}{X}^{q^i+q^j}+{\sum }_{q^i<D}{B}_i{X}^{q^i}+A$ for finite field elements $C_{i,j},B_i,A\in E$ the inner polynomial. This gives the public key:
  $\mathcal{P}(x):=T\circ P\circ S(x)$
  or more precisely:
  $\mathcal{P}(x):=T\circ {\varphi }^{-1}\circ P\circ \varphi \circ S(x)$
  Hidden Field Equations Solving Problem是指：已知$y\in F^n$，找到$x\in F^n$使得$y=\mathcal{P}(x)$成立。

• MKS: Multiplicative Knapsack。Naccache and Stern 用于构建 trapdoor one-way permutation。
  已知正整数$p,c,n$以及a set $\{v_i\}\in \{1,\cdots ,p-1{\}}^n$，找到a binary vector $x$使得$c={\prod }_{i=1}^n{v}_i^{x_i}$成立。

• BP: Balance Problem。常用于Incremental hashing。
  已知a group $G$和 a set $\{v_i\}\in G^n$，找到disjoint subsets $I,J$, not both empty，使得${⨀}_{i\in I}{v}_i={⨀}_{j\in J}{v}_j$成立。

• AHA: Adaptive Hardness Assumptions.
  We consider adaptive strengthenings of standard general hardness assumptions, such as the existence of one-way functions and pseudorandom generators.
  – A collection of adaptive $1-1$ one-way functions is a family of $1-1$ functions $F_n=\{f_s:\{0,1{\}}^n\to \{0,1{\}}^n\}$ such that for every $s$, it is hard to invert $f_s(r)$ for a random $r$, even for an adversary that is granted access to an “inversion oracle” for $f_{s^{\prime }}$ for ever $s^{\prime }\ne s$. In other words, the function $f_s$ is one-way, even with access to an oracle that invert all the functions in the family。
  – A sf collection of adaptive pseudo-random generators is a family of $1-1$ functions $G_n=\{G_s:\{0,1{\}}^n\to \{0,1{\}}^n\}$ such that for every $s$, it is hard to invert $G_s$ is pseudo-random, even for an adversary that is granted access to an oracle whether given $y$ is in the range of $G_{s^{\prime }}$ for $s^{\prime }\ne s$.

• SPI: Sparse Polynomial Interpolation。常用于Identification scheme。参见2000年论文《AN IDENTIFICATION SCHEME BASED ON SPARSE POLYNOMIALS》
  已知$A,a_0,\cdots ,a_k,C_1,\cdots ,C_k\in {\mathbb{F}}_q$，找到 a polynomial $f(x)\in \mathbb{F}[x]$ of degree at most $q-1$ 使得 $f(0)=A,f(a_0)=0,f(a_i)=C_i$ for $1\le i\le k$ and $f(x)-A$ has coefficients in $\{0,1\}$。

• SPP: Self-Power Problem。若该问题可破解，在可伪造EIGamal signature scheme中类型2和4的签名。
  已知prime $p$和$c\equiv x^x\mathrm{m}\mathrm{o}\mathrm{d}p$，求解$x$。

• VDP: Vector Decomposition Problem。常用于AN IDENTIFICATION SCHEME BASED ON SPARSE POLYNOMIALS，AN IDENTIFICATION SCHEME BASED ON SPARSE POLYNOMIALS。
  已知a two-dimensional vector space $V$ over a finite field, with basis $e_1,e_2$，和 a vector $v$ in $V$。找到 a multiple $u$ of $e_1$ 使得 $v-u$ is a multiple of $e_2$。

• 2-DL: 2-generalized Discrete Logarithm Problem。
  已知a group $G$ of exponent $r$ and order $r^2$, with generators $P_1,P_2$, and an element $Q$ in $G$。找到 a pair of integers $(a,b)$ 使得$Q=a{P}_1+b{P}_2$成立。

参考资料

[1] Can you give me a summary of cryptographic hardness assumptions?
[2] 2013年报告《Final Report on Main Computational Assumptions in Cryptography》
[3] European Network of Excellence in Cryptology II
[4] 2012年 Cryptographic Primitives and Hard Problems in Cryptography wiki
[5] 2015年论文《Cryptographic Assumptions: A Position Paper》