Sub-exponential SXDH ⇒ Sub-exponential DDH

Fully-black-box reduction · standard model · folklore · security loss: none

Statement

If SXDH is sub-exponentially hard for an asymmetric pairing-group generator, then DDH is sub-exponentially hard, with the same constant $\epsilon$, for the group generator that runs it and outputs $({\mathbb{G}}_1,g_1,p)$: sub-exponential SXDH bounds DDH advantage in ${\mathbb{G}}_1$ by definition — folklore.