Does there exist a group where

  1. computing $g^x$ from $g^{a^{x}}$ is easy,
  2. computing $g^{a^{x}}$ from $x$ and $g^{a}$ is hard, and
  3. computing $x$ from $g^a$ and $g^{a^x}$ is hard.

Intuitively I would say no? Because 3. is almost a pretty standard discrete log problem for most groups, whereas 1. is an unusual, almost contradictory property. I think 2. is also usually hard for most groups? But is there a proof that no such group can exist?



You must log in to answer this question.