Generalized Diffie-Hellman Modulo a Composite is not Weaker than Factoring

The Diie-Hellman key-exchange protocol may naturally be extended to k > 2 parties. This gives rise to the generalized Diie-Hellman assumption (GDH-Assumption). Naor and Reingold have recently shown an eecient construction of pseudo-random functions and reduced the security of their construction to the GDH-Assumption. In this note, we prove that breaking this assumption modulo a composite would imply an eecient algorithm for factorization. Therefore, the security of both the key-exchange protocol and the pseudo-random functions can be reduced to factoring.