# XDH assumption

The external Diffie–Hellman (XDH) assumption is a computational hardness assumption used in elliptic curve cryptography. The XDH assumption holds that there exist certain subgroups of elliptic curves which have useful properties for cryptography. Specifically, XDH implies the existence of two distinct groups $\langle {\mathbb {G} }_{1},{\mathbb {G} }_{2}\rangle$ with the following properties:
1. The discrete logarithm problem (DLP), the computational Diffie–Hellman problem (CDH), and the computational co-Diffie–Hellman problem are all intractable in ${\mathbb {G} }_{1}$ and ${\mathbb {G} }_{2}$ .
2. There exists an efficiently computable bilinear map (pairing) $e(\cdot ,\cdot ):{\mathbb {G} }_{1}\times {\mathbb {G} }_{2}\rightarrow {\mathbb {G} }_{T}$ .
3. The decisional Diffie–Hellman problem (DDH) is intractable in ${\mathbb {G} }_{1}$ .
The above formulation is referred to as asymmetric XDH. A stronger version of the assumption (symmetric XDH, or SXDH) holds if DDH is also intractable in ${\mathbb {G} }_{2}$ .