{Extract from email of Luca Trevisan (May 2009)] On page 481 you discuss the decision diffie hellman problem in footnote 58. You describe it as the problem of distinguishing g^x, g^y, g^z from g^x,g^y,g^{xy} where all operations are mod a prime p and g is a generator of the multiplicative group mod p This version of the problem is, however, efficiently solvable: it is possible to efficiently check whether a given integer is a quadratic residue mod p, if p is prime, and whereas g^z has probability 1/2 of being a quadratic residue, g^{xy} has probability 3/4. If, however, p= 2p'+1, with p' prime, then distinguishing g^x g^y g^z from g^x g^y g^{xy} mod p is plausibly hard, if g is a generator of the set of quadratic residues mod p (i.e., g = g'^2 here g is a generator of the multiplicative group mod p)