{Extract from email of Luca Trevisan (May 2009)]
On page 481 you discuss the decision diffie hellman problem
in footnote 58. You describe it as the problem of distinguishing
g^x, g^y, g^z from g^x,g^y,g^{xy}
where all operations are mod a prime p and g is a generator
of the multiplicative group mod p
This version of the problem is, however, efficiently solvable:
it is possible to efficiently check whether a given integer
is a quadratic residue mod p, if p is prime,
and whereas g^z has probability 1/2 of being
a quadratic residue, g^{xy} has probability 3/4.
If, however, p= 2p'+1, with p' prime, then distinguishing
g^x g^y g^z from g^x g^y g^{xy}
mod p is plausibly hard, if g is a generator
of the set of quadratic residues mod p
(i.e., g = g'^2 here g is a generator of the multiplicative group mod p)