DBDH ⇒ BDH

Fully-black-box reduction · standard model · folklore · security loss: none: a BDH solver with success ε gives a DBDH distinguisher with advantage ε − 1/q

Statement

If decisional BDH holds in a pairing group, then computational BDH holds in it: a solver that computes $e(g,g{)}^{abc}$ from $(g,g^a,g^b,g^c)$ distinguishes the DBDH tuple by comparing its output with the fifth element — folklore.