DDH ⇒ PRF (Naor–Reingold)

DDH implies a PRF, by the Naor–Reingold construction.

Construction

Migrated verbatim from PRF § Other results:

PRF from DDH: the Naor-Reingold construction maps $(x_1,\dots ,x_n)\in \{0,1{\}}^n$ to $g^{a_0\cdot a_1^{x_1}\cdots a_n^{x_n}}$ and is secure under DDH — NR97

Notes

The same reduction is stated from the other end at DDH § Known Results.