Decision Linear assumption

The Decision Linear (DLIN) assumption is a computational hardness assumption used in elliptic curve cryptography. In particular, the DLIN assumption is useful in settings where the decisional Diffie–Hellman assumption does not hold (as is often the case in pairing-based cryptography). The Decision Linear assumption was introduced by Boneh, Boyen, and Shacham.^[1]

Informally the DLIN assumption states that given ${\displaystyle (f,\,g,\,f^{x},\,g^{y})}$, with ${\displaystyle f,\,g}$ random group elements and ${\displaystyle x,\,y}$ random exponents, it is hard to distinguish ${\displaystyle (h,\,h^{x+y})}$ (for random $h$) from ${\displaystyle (h,\,h')}$ (for independently random ${\displaystyle h,\,h'}$).

References

1. Dan Boneh, Xavier Boyen, Hovav Shacham: Short Group Signatures. CRYPTO 2004: 41–55