SXDH ⇒ DDH

Fully-black-box reduction · standard model · folklore · security loss: none

Statement

If SXDH holds for an asymmetric pairing-group generator, then DDH is hard for the group generator that runs it and outputs $({\mathbb{G}}_1,g_1,p)$, with the same advantage: SXDH asserts DDH hardness in ${\mathbb{G}}_1$ by definition — folklore.