1. Discrete logarithm problem

Let $g$为 a known element of prime order $r$ in a group (with group operation written multiplicatively). Let $G=<g>$ be the group generated by $g$.

常用的group选择有：

• multiplicative group of a finite field;
• algebraic torus over a finite field;
• elliptic curve over a finite field;
• divisor class group of a curve over a finite field。

Discrete logarithm problem常用假设有：

• DLP: discrete logarithm problem。常用于Schnorr signatures, DSA signatures。
  已知 $h\in G$，找到 $x$使得 $h=g^x$。

• CDH: computational Diffie-Hellman problem。常用于 Diffie-Hellman key exchange and variants, Elgamal encryption and variants, BLS signatures and variants。
  已知 $g^a,g^b\in G$，计算 $g^{ab}$。

• SDH: static Diffie-Hellman problem。
  Fix $g,g^a\in G$. Given $h\in G$，计算 $h^a$。

• gap-CDH: Gap Diffie-Hellman problem。常用于 ECIES proof in the Random Oracle Model, Chaum undeniable signature。
  已知 $g^a,g^b\in G$，计算 $g^{ab}$，when the algorithm has access to an oracle which solves the DDH problem。

• DDH: decision Diffie-Hellman problem。常用于 Diffie-Hellman key exchange and variants, Elgamal encryption and variants.
  已知 $g^a,g^b,h\in G$，判断 $h=g^{ab}$是否成立？

• Strong-DDH: strong decision Diffie-Hellman problem
  已知 $g,g^a,g^b,g^{b^{-1}},h\in G$，判断 $h=g^{ab}$是否成立？

• sDDH: skewed decision Diffie-Hellman problem。
  Let $f$ 为任意的uninvertible function with domain $\mathbb{Z}_r$。已知 $f(a),g^b,h\in G$，判断 $h=g^{ab}$是否成立？

• PDDH: parallel decision Diffie-Hellman problem。
  已知 $g^{x_1},\cdots,g^{x_n},h_1,\cdots,h_n\in G$，判断 $h_1=g^{x_1x_2},\cdots,h_{n-1}=g^{x_{n-1}x_n},h_n=g^{x_nx_1}$是否成立？

• Square-DH: Square Diffie-Hellman problem. The best known algorithm for Square-DH is to actually solve the DLP.
  已知 $g^a\in G$，计算 $g^{a^2}$。

• l-DHI: l-Diffie-Hellman inversion problem. The best known algorithm for l-DHI is to actually solve the DHP.
  已知 $g^a,g^{a^2},\cdots,g^{a^l}\in G$，计算 $g^{1/a}$。

• l-DDHI: l-Decisional Diffie-Hellman inversion problem
  已知 $g^a,g^{a^2},\cdots,g^{a^l},v\in G$，判断 $v=g^{1/a}$是否成立？

• REPRESENTATION: Representation problem. The best known algorithm for REPRESENTATION is to solve the DLP.
  已知 $g_1,\cdots,g_k,h\in G$，找到 $a_1,\cdots,a_k$使得 $h=g_1^{a_1}\cdots g_k^{a_k}$成立。

• LRSW: LRSW Problem. The best known algorithm for LRSW is to solve the DLP.
  已知 $g,g^x,g^y$，已知 oracle $O$（输入为 $s$，其选择一个随机值 $a=g^z$，然后其输出为 $(a,a^{sy},a^{x+sxy})$），对于任意的 $t$（not one of the 输入 $s$）和 $b\neq 1$值 计算 $(t,b,b^{ty},b^{x+txy})$。

• Linear: Linear problem。The best known algorithm for Linear is to solve the DLP。
  已知 $g^a,g^{b},g^{ac},g^{bd}\in G$，计算 $g^{c+d}$。

• D-Linear1: Decision Linear problem (version 1)
  已知 $g^a,g^{b},g^{ac},g^{bd},v\in G$，判断 $v=g^{c+d}$是否成立？

• l-SDH: l-Strong Diffie-Hellman problem
  已知 $g^a,g^{a^2},\cdots,g^{a^l}\in G$，找到 $w\in F_q$并计算 $g^{1/(a+w)}$。

• c-DLSE: Discrete Logarithm with Short Exponents。The best known algorithm for the c-DLSE is to use the baby-step-giant-step or Pollard kangaroo algorithms for solving the DLP in a short interval. 常用于
  Gennaro pseudorandom generator。
  Let $G=\mathbb{Z}_p^*$ 其中 $p-1=2q$， $p,q$均为primes，let $c$为integer。已知 $g^x \mod p$ 且 $0\leq x\leq 2^c$，求解相应的 $x$值。

• CONF: (conference-key sharing scheme)。常用于Okamoto’s conference-key sharing scheme。
  已知 $g^a,g^b,g^{ab}\in G$，计算 $g^{b}$。

• 3PASS: 3-Pass Message Transmission Scheme。常用于Shamir’s 3-pass message transmission scheme。
  已知 $A,B,C\in G$，找到相应的 $s$使得 $A=s^a,B=s^b,C=s^{ab}$成立。

• LUCAS: Lucas Problem。
  已知 $p,z\in<V_t(m)>$，找到相应的 $x$，使得 $V_x(m)=z$成立。其中 $V_t(m)$的定义为： $V_0(m)=2,V_1(m)=m,V_t(m)=mV_{t-1}(m)-V_{t-2}(m)。$

• XLP: x-Logarithm Problem。
  对于Elliptic curve $E(\mathbb{F}_q)$上的任意一点 $P=(x,y)\in\mathbb{F}_q^2$，将 $x(P)=\bar{x}$ 表示为 $P$点$ X坐标的二进制表示。对任意的group element $g^a$， $x=x(g^a)$，是否能区分 $g^a$和 $g^x$？

• MDHP: Matching Diffie-Hellman Problem。常用于E-Cash。
  Let $g$ be a generator of group $G$ having order $q$，let $a_0,b_0,a_1,b_1\in\mathbb{Z}_q$ and $r\in_R\{0,1\}$。已知 $(g^{a_0},g^{a_0b_0},g^{a_1},g^{a_1b_1})$和 $(g^{b_r},g^{b_{1-r}})$，找到相应的 $r$。

• DDLP: Double Discrete Logarithm Problem。常用于Public verifiable secret sharing。
  Let $p,q$ 为素数且 $q=(p-1)/2$，设置 $G$为group of order $p$ with generator $g$， $h\in\mathbb{Z}_p^*$为an element of order $q$。已知 $g,h,a=g^{(h^x)}$，求解 $x$。

• rootDLP: Root of Discrete Logarithm Problem。常用于Camenisch and Stadler group signature scheme。
  已知group generator $g$, positive integer $e$ 和 $a\in G$，计算 $x$使得 $a=g^{(x^e)}$成立。

• n-M-DDH: Multiple Decision Diffie-Hellman Problem。常用于 Group key exchange。
  Let $n\geq 2$， $D=(g^{x_1},\cdots,g^{x_n},\{g^{x_ix_j}\}_{1\leq i< j\leq n})$ 其中 $x_1,\cdots,x_n\in\mathbb{Z}_r$为随机值； $D_{random}=(g_1,\cdots,g_n,\{g_{ij}\}_{1\leq i<j\leq n})$为a random tuple in $G$。很难区分 $D$和 $D_{random}$。

• l-HENSEL-DLP: l-Hensel Discrete Logarithm Problem。
  Let $G$为a subgroup or prime order $r$ in $\mathbb{Z}_p^*$，其中 $p$为a prime with polynomial binary length；Let $1<g<p$ be an integer满足 $g^r\equiv 1(\mod p^{l-1}),g^r\not\equiv 1\mod p^l)$，其中 $l>1且为整数$。已知 $g^x \mod p$， $x$为 $[1,r-1]$范围内的随机数，计算 $g^x \mod p^l$。

• DLP(Inn(G)): Discrete Logarithm Problem over Inner Automorphism Group。常用于MOR Public Key Cryptosystem。
  已知 $\phi,\phi^s\in Inn(G)$ for $s\in\mathbb{Z}$，求解 $s(\mod |\phi|)$。

• IE: Inverse Exponent。
  为l-DHI （l-Diffie-Hellman inversion problem） $l=1$的特例情况。

• TDH: The Twin Diffie-Hellman Assumption。
  Let $G$ 为 a cyclic group with generator $g$，and of prime order $q$。定义 $dh(X,Y)=Z$，其中 $X=g^x,Y=g^y,Z=g^{xy}$。定义twin DH function $2dh: G^3\rightarrow G^2\ (X_1,X_2,Y)\rightarrow (dh(X_1,Y),dh(X_2,Y))$。定义相应的twin DH predicate为： $2dhp(X_1,X_2,\hat{Y},\hat{Z}_1,\hat{Z}_2)=1\ iff\ 2dh(X_1,X_2,\hat{Y})=(\hat{Z}_1,\hat{Z}_2)$。
  twin DH assumption是指：已知random $X_1,X_2,Y\in G$，计算 $2dh(X_1,X_2,Y)$很难。
  strong twin DH assumption是指：已知 $X_1,X_2,Y\in G$ along with access to a decision oracle for the predicate $2dhp(X_1,X_2,\cdot,\cdot,\cdot)$ which on input $(\hat{Y},\hat{Z}_1,\hat{Z}_2)$ returns $2dhp(X_1,X_2,\hat{Y},\hat{Z}_1,\hat{Z}_2)$，计算 $2dh(X_1,X_2,Y)$很难。

• XTR-DL: XTR discrete logarithm problem。Most protocols based on DLP can be used with XTR.
  Let $Tr(g)$ 为an XTR representation of an element of the XTR subgroup of $\mathbb{F}_{p^6}^*$，已知 $t$，求解 $x$使得 $t=Tr(g^x)$成立。

• XTR-DH: XTR Diffie-Hellman problem。Most protocols based on DLP can be used with XTR.
  Let $Tr(g)$ 为an XTR representation of an element of the XTR subgroup of $\mathbb{F}_{p^6}^*$，已知 $t_1,t_2$，求解 $t_3$使得 $t_1=Tr(g^x),t_2=Tr(g^y),t_3=Tr(g^{xy})$成立。

• XTR-DHD: XTR decision Diffie-Hellman problem.Most protocols based on DLP can be used with XTR.
  Let $Tr(g)$ 为an XTR representation of an element of the XTR subgroup of $\mathbb{F}_{p^6}^*$，已知 $t_1=Tr(g^x),t_2=Tr(g^y),t_3$，判断 $t_3=Tr(g^{xy})$是否成立？

• CL-DLP: discrete logarithms in class groups of imaginary quadratic orders。常用于key exchange。
  为standard discrete logarithm problems in a class group of imaginary quadratic orders。

• TV-DDH: Tzeng Variant Decision Diffie-Hellman problem。常用于Conference key agreement.
  Let $p,q=2p+1$均为素数，let $G\subseteq \mathbb{F}_p^*$ 为subgroup of order $q$。 $h\in G$为 $[1,p-1]$内的整数， $h\mod q$为 $[0,q-1]$内整数。已知 $g_1,g_2\in G$ 且 $0\leq u_1,u_2<q$，取任意整数 $a$，判断 $u_1=g_1^a\mod q,u_2=g_2^a\mod q$是否成立？

• n-DHE: n-Diffie-Hellman Exponent problem。常用于 Broadcast encryption, accumulators.
  对于a group $G$ of prime order $q$，let $g_i=g^{\lambda^i},\lambda\leftarrow \mathbb{Z}_q$，已知 $\{g,g_1,g_2,\cdots,g_n,g_{n+2},\cdots,g_{2n}\}\in G^{2n}$，计算 $g_{n+1}。$

2. Factoring

• FACTORING: integer factorisation problem
• SQRT: square roots modulo a composite
• CHARACTERd: character problem
• MOVAd: character problem
• CYCLOFACTd: factorisation in Z[θ]
• FERMATd: factorisation in Z[θ]
• RSAP: RSA problem
• Strong-RSAP: strong RSA problem
• Difference-RSAP: Difference RSA problem
• Partial-DL-ZN2P: Partial Discrete Logarithm problem in Z∗n
• DDH-ZN2P: Decision Diffie-Hellman problem over Z∗n
• Lift-DH-ZN2P: Lift Diffie-Hellman problem over Z∗n
• EPHP: Election Privacy Homomorphism problem
• AERP: Approximate e-th root problem
• l-HENSEL-RSAP: l-Hensel RSA
• DSeRP: Decisional Small e-Residues in Z∗n2
• DS2eRP: Decisional Small 2e-Residues in Z∗n2
• DSmallRSAKP: Decisional Reciprocal RSA-Paillier in Z∗n2
• HRP: Higher Residuosity Problem
• ECSQRT: Square roots in elliptic curve groups over Z/nZ
• RFP: Root Finding Problem
• phiA: PHI-Assumption
• C-DRSA: Computational Dependent-RSA problem
• D-DRSA: Decisional Dependent-RSA problem
• E-DRSA: Extraction Dependent-RSA problem
• DCR: Decisional Composite Residuosity problem
• CRC: Composite Residuosity Class problem
• DCRC: Decisional Composite Residuosity Class problem
• GenBBS: generalised Blum-Blum-Shub assumption

3. Product groups

• co-CDH: co-Computational Diffie-Hellman Problem
• PG-CDH: Computational Diffie-Hellman Problem for Product Groups
• XDDH: External Decision Diffie-Hellman Problem
• D-Linear2: Decision Linear Problem (version 2)
• PG-DLIN: Decision Linear Problem for Product Groups
• FSDH: Flexible Square Diffie-Hellman Problem
• KSW1: Assumption 1 of Katz-Sahai-Waters

4. Pairings

2008年《Pairings for cryptographers》中指出，pairings over groups of known prime order 表示为：
$\hat{t}:G_1\times G_2\rightarrow G_T$
若其中 $G_1,G_2,G_T$都具有相同的prime order $l$，则可分为以下三大类：
1）Type 1： $G_1=G_2$；【通常使用supersingular curves，这些supersingular curves又分为两类：一类是over fields of characteristic 2 or 3 (with embedding degree 4 or 6 respectively)；另一类是over fields of large prime characteristic (with embedding degree 2)。】
2）Type 2： $G_1\neq G_2$，但是存在efficiently computable homomorphism $\phi:G_2\rightarrow G_1$；【通常使用ordinary curves，且the homomorphism from $G_2$ to $G_1$ is the trace map。】
3）Type3： $G_1\neq G_2$，且不存在efficiently computable homomorphism $\phi:G_2\rightarrow G_1$。【通常使用ordinary curves，且 $G_2$为the kernel of the trace map。】

若 $G_2$ 为non-cyclic group of order $l^2$，则可称为Type 4。

具体举例为：

• Type 1：
  
• Type 2：
  
• Type 3：
  

若 $\log_{g_1}a=\log_{g_2}b$，则表示为 $a\sim b$。
Pairing 相关假设有：【注意，有的assumption并不适于所有的pairing type。Certain assumptions are provably false w.r.t. certain group types.】

• BDHP: Bilinear Diffie-Hellman Problem。
  已知 $g_i^a,g_j^b和g_k^c$，计算 $\hat{t}(g_1,g_2)^{abc}$。
  其中 $i,j,k\in\{1,2\}$，对应有四种可能的组合 $(i,j,k)\in\{(1,1,1),(1,1,2),(1,2,2),(2,2,2)\}$，也可称为 $BDHP_{i,j,k}$。
  – 对于Type 1 pairing，以上四种组合是等价的。
  – 对于Type 2 pairing，具有 $BDHP_{2,2,2}\leq_P BDHP_{1,2,2}\leq_P BDHP_{1,1,2}\leq_P BDHP_{1,1,1}$。
  – 对于Type 3 pairing，这四种组合have no known reductions between them。

• DBDH: Decision Bilinear Diffie-Hellman Problem。常用于 Boneh-Franklin ID-based encryption scheme。
  已知 $g_i^a,g_j^b,g_k^c和\hat{t}(g_1,g_2)^{z}$，判断 $\hat{t}(g_1,g_2)^{abc}=\hat{t}(g_1,g_2)^{z}$是否成立。

• B-DLIN: Bilinear Decision-Linear Problem
  

• l-BDHI: l-Bilinear Diffie-Hellman Inversion Problem
  已知 $g_i^{a},g_i^{a^2},g_i^{a^3},\cdots,g_i^{a^l}$，计算 $\hat{t}(g_1,g_2)^{1/a}$。其中 $i\in\{1,2\}$。

• l-DBDHI: l-Bilinear Decision Diffie-Hellman Inversion Problem
  已知 $g_i^{a},g_i^{a^2},g_i^{a^3},\cdots,g_i^{a^l}$和 $v\in G_T$，判断 $v=\hat{t}(g_1,g_2)^{1/a}$是否成立？其中 $i\in\{1,2\}$。

• l-wBDHI: l-weak Bilinear Diffie-Hellman Inversion Problem。
  已知 $g_i^{a},g_i^{a^2},g_i^{a^3},\cdots,g_i^{a^l}$和 $g_j^b$，计算 $\hat{t}(g_1,g_2)^{a^{l+1}b}$。其中 $i\in\{1,2\}$。

• l-wDBDHI: l-weak Decisional Bilinear Diffie-Hellman Inversion Problem
  已知 $g_i^{a},g_i^{a^2},g_i^{a^3},\cdots,g_i^{a^l},g)j^b$和 $v\in G_T$，判断 $v=\hat{t}(g_1,g_2)^{a^{l+1}b}$是否成立？其中 $i\in\{1,2\}$。

• KSW2: Assumption 2 of Katz-Sahai-Waters。首次用于 the construction of a predicate encryption scheme supporting the inner product。（KATZ等人2008年论文《Predicate Encryption Supporting Disjunctions, Polynomial Equations, and Inner Products》）
  – 运行 $G(1^n)$来获取 $(p,q,r,G,G_T,\hat{t})$；
  – 设置 $N=pqr$，let $g_p,g_q,g_r$分别为 $G_p,G_q,G_r$的generators；
  – 选择随机数 $h\in G_p;Q_1,Q_2\in G_q;s,\gamma\in\mathbb{Z}_q$以及random bit $v$；
  – p.p.t. adversary $A$ 的输入有 $(N,G,G_T,\hat{t})$和 $g_p,g_q,g_r,h,g_p^s,h^sQ_1,g_p^{\gamma}Q_2,\hat{t}(g_p,h)^{\gamma}$，当 $v=0$时，再给 $A$ 输入 $\hat{t}(g_p,h)^{\gamma s}$；当 $v=1$时，给 $A$的输入为a random element of $G_T$。 $A$的输出为a bit $v'$，且其succeed if $v'=v$。

• MSEDH: Multi-sequence of Exponents Diffie-Hellman Assumption。用于 Delerabl´ee and Pointcheval dynamic threshold public-key encryption scheme。
  – Let $B=(p,G_1,G_2,G_T,\hat{t}(\cdot,\cdot))$为a bilinear map group system，let $l,m,t$为3个整数，let $g_0$为 $G_1$的generator， $h_0$为 $G_2$的generator。
  – 输入为2个random coprime polynomials $f$和 $g$，分别具有degree $l$和 $m$，分别具有pairwise distinct roots $x_1,\cdots,x_l$和 $y_1,\cdots,y_m$。同时有 $T\in G_T$以及如下的exponentiations 序列：
  
  判断 $T$是否与 $\hat{t}(g_0,h_0)^{k\cdot f(\gamma)}$相等或者与 $G_T$中的某随机元素相同？

• SXDH assumption: the SXDH assumption states that there are prime-order groups $(G_1, G_2, G_T )$ that admits a bilinear map $e : G_1 \times G_2 \rightarrow G_T$ such that the Decisional Diffie-Hellman (DDH) assumption holds in both $G_1$ and $G_2$. 首次在2005年论文《Correlation-Resistant Storage via Keyword-Searchable Encryption》中提出：
  
  而在 2019年论文《Proofs for Inner Pairing Products and Applications》中指出，SXDH assumption仅在Type 3 pairings 下成立，因此任何基于SXDH assumption的设计均对应应采用Type 3 pairing。

• DBP: double pairing assumption。在2016年论文《Structure-Preserving Signatures and Commitments to Group Elements》中提出。
  

5. Lattices

5.1 Main Lattice Problems

• SVPγp: (Approximate) Shortest vector problem
• CVPpγ: (Approximate) Closest vector problem
• GapSVPpγ: Decisional shortest vector problem
• GapCVPpγ: Decisional closest vector problem

5.2 Modular Lattice Problems

• SISp(n,m,q,β): Short integer solution problem
• ISISp(n,m,q,β): Inhomogeneous short integer solution problem
• LWE(n,q,φ): Learning with errors problem

5.3 Miscellaneous Lattice Problems

• USVPp(n,γ): Approximate unique shortest vector problem
• SBPp(n,γ): Approximate shortest basis problem
• SLPp(n,γ): Approximate shortest length problem
• SIVPp(n,γ): Approximate shortest independent vector problem
• hermiteSVP: Hermite shortest vector problem
• CRP: Covering radius problem

5.4 Ideal Lattice Problems

• Ideal-SVPf,pγ: (Approximate) Ideal shortest vector problem / Shortest polynomial problem
• Ideal-SISf,p q,m,β: Ideal small integer solution problem

6. Miscellaneous Problems

• KEA1: Knowledge of Exponent assumption。参见2004年论文《The Knowledge-of-Exponent Assumptions and 3-Round Zero-Knowledge Protocols》：
  背景知识为：Let $q$ be a prime such that $21+1$ is also prime, and let $g$ be a generator of the order $q$ subgroup of $Z_{2q+1}^*$。假设输入有 $q,g,g^a$，想要输出a pair $(C,Y), Y=C^a$。可实现的方式之一是pick some $c\in\mathbb{Z}_q$，设置 $C=g^c$，则有 $Y=(g^a)^c=C^a$成立。直观上来说，KEA1假设是指这是唯一的方式。对于任意的adversary能输出such a pair的，其肯定知道相应的 $c$值使得 $g^c=C$。在以下的正式定义中引入了extractor可返回相应的 $c$值：
  KEA1 (Knowledge of Exponent assumption) 的定义为： For any adversary $A$ that takes input $q,g,g^a$，返回 $(C,Y)$其中 $Y=C^a$，即意味着存在an extractor $A$，对于与adversary相同的输入，可返回 $c$值，使得 $g^c=C$。

• MQ: Multivariable Quadratic equations。多变量二次方程式。
  已知a system of $m$ quadratic polynomial equations in $n$ variables each, $\{y_1=p_1(x_1,\cdots,x_n),\cdots,y_m=p_m(x_1,\cdots,x_n)\}$，求解 $x\in\mathbb{F}^n$ 为 in general an NP-problem。

• CF: Given-weight codeword finding。常用于: McEliece public key cryptosystem (finding the shortest codeword).
  已知 $n\times k$ binary linear code $C$和相应的 $n\times (n-k)$ parity check matrix $H$，求解vector $\vec{x}$使得 $\vec{x}H=0$成立且 $x$ has weight $w$。

• ConjSP: Braid group conjugacy search problem。
  已知 $x,y\in B_n$，求解 $a\in B_n$使得 $a^{-1}xa=y$成立。

• GenConjSP: Generalised braid group conjugacy search problem。用于 Public-key cryptosystem due to Ko, Lee, Cheon, Han, Kang and Park。
  已知 $x,y\in B_n$，求解 $a\in B_m,m\leq n$使得 $a^{-1}xa=y$成立。

• ConjDecomP: Braid group conjugacy decomposition problem。
  已知 $x,y\in B_n$， $y=bxb^{-1}$ for some $b\in B_n$，求解 $a',a''\in B_m,m<n$使得 $a'xa''=y$成立。

• ConjDP: Braid group conjugacy decision problem。
  已知 $x,y\in B_n$，判断 $x$和 $y$是否conjugate？即是否存在 $a\in B_n$使得 $a^{-1}xa=y$成立？

• DHCP: Braid group decisional Diffie-Hellman-type conjugacy problem。常用于 Public-key cryptosystem, pseudorandom number generator, pseudorandom synthesizer。
  已知 $a,w_l^{-1}aw_l,w_u^{-1}aw_u$，判断 $x_u^{-1}x_l^{-1}ax_lx_u=w_u^{-1}w_l^{-1}aw_lw_u$是否成立？for $a\in B_n,x_l,w_l\in B_l$ and $x_u,w_u\in B_u$。

• ConjSearch: (multiple simlutaneous) Braid group conjugacy search problem。
  Let $B$ be a braid group, $\bar{g}=(g_1,\cdots,g_k)$ and $\bar{h}=(h_1,\cdots,h_k)$ be two tuples of elements of $B$。查找 $x\in B$使得 $\bar{h}=x^{-1}\bar{g}x$成立。

• SubConjSearch: subgroup restricted Braid group conjugacy search problem。常用于Anshel- Anshel- Goldfeld key exchange protocol (AAG)。
  Let $B$ be a braid group, and $A$ a subgroup of $B$ generated by some $\{a_1,\cdots,a_r\}$ and let $\bar{g}=(g_1,\cdots,g_k)$ and $\bar{h}=(h_1,\cdots,h_k)$ be two tuples of elements of $B$。查找 $x\in A$, as a word in $\{a_1,\cdots,a_r\}$，使得 $\bar{h}=x^{-1}\bar{g}x$成立。

• LINPOLY : A linear algebra problem on polynomials。
  Let $W$ be a linear space of dimension $\leq n$ consisting of quadratic forms in $n$ variables $X_1,\cdots,X_n$。已知 $V=\sum_{1\leq i\leq n}X_iW$，is it possible (and how) to uniquely determine $W$? For any subspace $L'$ of the linear space $L$ generated by $X_1,\cdots,X_n$。Let $(V:L')\leftarrow r\in K[X_1,\cdots,X_n]:rL'\subseteq V$ where $K$ is a finite field。
  猜想：For randomly chosen $W$, the probability $\rho$ that $(V:L)=W$ are very close to $1$, when $n>2$。

• HFE-DP: Hidden Field Equations Decomposition Problem。 It is the basis of the HFE crypto system.
  Let $F$ be a finite field of order $q$ and $S,T\in Aff^{-1}$ be two invertible, affine transformations over the vector space $F^n$。Denote $E:=GF(q^n)$ an extension field over $F$ and $\phi:F^n\rightarrow E$ the bijection between this extension field and the corresponding vector space. We have $\phi^{-1}(\phi(a))=a,\forall a \in F^n$。
  Now let $P(X):=\sum_{i,j<D,q^i+q^j<D}C_{i,j}X^{q^i+q^j}+\sum_{q^i<D}B_iX^{q^i}+A$ for finite field elements $C_{i,j},B_i,A\in E$ the inner polynomial. This gives the public key:
  $\mathcal{P}(x):=T\circ P\circ S(x)$
  or more precisely:
  $\mathcal{P}(x):=T\circ \phi^{-1}\circ P\circ \phi \circ S(x)$
  HFE Decomposition problem是指：已知公钥 $\mathcal{P}$，找到对应的私钥 $(S,P,T)$。

• HFE-SP: Hidden Field Equations Solving Problem。
  Let $F$ be a finite field of order $q$ and $S,T\in Aff^{-1}$ be two invertible, affine transformations over the vector space $F^n$。Denote $E:=GF(q^n)$ an extension field over $F$ and $\phi:F^n\rightarrow E$ the bijection between this extension field and the corresponding vector space. We have $\phi^{-1}(\phi(a))=a,\forall a \in F^n$。
  Now let $P(X):=\sum_{i,j<D,q^i+q^j<D}C_{i,j}X^{q^i+q^j}+\sum_{q^i<D}B_iX^{q^i}+A$ for finite field elements $C_{i,j},B_i,A\in E$ the inner polynomial. This gives the public key:
  $\mathcal{P}(x):=T\circ P\circ S(x)$
  or more precisely:
  $\mathcal{P}(x):=T\circ \phi^{-1}\circ P\circ \phi \circ S(x)$
  Hidden Field Equations Solving Problem是指：已知 $y\in F^n$，找到 $x\in F^n$使得 $y=\mathcal{P}(x)$成立。

• MKS: Multiplicative Knapsack。Naccache and Stern 用于构建 trapdoor one-way permutation。
  已知正整数 $p,c,n$以及a set $\{v_i\}\in\{1,\cdots,p-1\}^n$，找到a binary vector $x$使得 $c=\prod_{i=1}^{n}v_i^{x_i}$成立。

• BP: Balance Problem。常用于Incremental hashing。
  已知a group $G$和 a set $\{v_i\}\in G^n$，找到disjoint subsets $I,J$, not both empty，使得 $\bigodot_{i\in I}v_i=\bigodot_{j\in J}v_j$成立。

• AHA: Adaptive Hardness Assumptions.
  We consider adaptive strengthenings of standard general hardness assumptions, such as the existence of one-way functions and pseudorandom generators.
  – A collection of adaptive $1-1$ one-way functions is a family of $1-1$ functions $F_n=\{f_s:\{0,1\}^n\rightarrow \{0,1\}^n\}$ such that for every $s$, it is hard to invert $f_s(r)$ for a random $r$, even for an adversary that is granted access to an “inversion oracle” for $f_{s'}$ for ever $s'\neq s$. In other words, the function $f_s$ is one-way, even with access to an oracle that invert all the functions in the family。
  – A sf collection of adaptive pseudo-random generators is a family of $1-1$ functions $G_n=\{G_s:\{0,1\}^n\rightarrow \{0,1\}^n\}$ such that for every $s$, it is hard to invert $G_s$ is pseudo-random, even for an adversary that is granted access to an oracle whether given $y$ is in the range of $G_{s'}$ for $s'\neq s$.

• SPI: Sparse Polynomial Interpolation。常用于Identification scheme。参见2000年论文《AN IDENTIFICATION SCHEME BASED ON SPARSE POLYNOMIALS》
  已知 $A,a_0,\cdots,a_k,C_1,\cdots,C_k\in \mathbb{F}_q$，找到 a polynomial $f(x)\in\mathbb{F}[x]$ of degree at most $q-1$ 使得 $f(0)=A,f(a_0)=0,f(a_i)=C_i$ for $1\leq i\leq k$ and $f(x)-A$ has coefficients in $\{0,1\}$。

• SPP: Self-Power Problem。若该问题可破解，在可伪造EIGamal signature scheme中类型2和4的签名。
  已知prime $p$和 $c\equiv x^x\mod p$，求解 $x$。

• VDP: Vector Decomposition Problem。常用于AN IDENTIFICATION SCHEME BASED ON SPARSE POLYNOMIALS，AN IDENTIFICATION SCHEME BASED ON SPARSE POLYNOMIALS。
  已知a two-dimensional vector space $V$ over a finite field, with basis $e_1,e_2$，和 a vector $v$ in $V$。找到 a multiple $u$ of $e_1$ 使得 $v-u$ is a multiple of $e_2$。

• 2-DL: 2-generalized Discrete Logarithm Problem。
  已知a group $G$ of exponent $r$ and order $r^2$, with generators $P_1,P_2$, and an element $Q$ in $G$。找到 a pair of integers $(a,b)$ 使得 $Q=aP_1+bP_2$成立。

参考资料

[1] Can you give me a summary of cryptographic hardness assumptions?
[2] 2013年报告《Final Report on Main Computational Assumptions in Cryptography》
[3] European Network of Excellence in Cryptology II
[4] 2012年 Cryptographic Primitives and Hard Problems in Cryptography wiki
[5] 2015年论文《Cryptographic Assumptions: A Position Paper》