Security of Diffie-Hellman with multiplication for secret derivation? Today I saw this question again which presents an unusual variant of the Diffie-Hellman key exchange. Having thought about it for a while I could find out how functionally works, but have essentially little cue whether it actuappy provides security.

My question is now:
Does the below stated Diffie-Hellman-like key exchange protocol enjoy similar security properties as normal Diffie-Hellman?



First the variables: Let $(\mathbb G,g,q)$ be a multiplicatively-written group where the discrete logarithm problem is hard with prime order $q$ and generator $g$. Let $a,b,x,y \stackrel{$}{\gets} \{0,\ldots,q-1\}$ be sampled uniformly at random. Let $A=g^a, B=g^b$. Let $a,x$ only be known to Alice and $b,y$ only be known to Bob. Let $a,b$ be static and $x,y$ be ephemeral across multiple sessions. Let $K=g^{x+y}$ be the shared secret, which can be computed by both parties after the exchange. Now define the following messages (the letters on the left denote Alice and Bob):
\begin{align}
A\to B&amp;:B^x=g^{bx}\\
B\to A&amp;:A^y=g^{ay}\\
\end{align}

If you are questioning functional correctness at this point note that Alice can trivially compute $g^x$, knowing $x$, and can compute $g^y$ as $(A^y)^{a^{-1}\bmod q}$, yielding $K=g^x\cdot g^y$. The computation for Bob goes analogous.
This problem (in the computational sense) is equivalent to the CDH problem [1].
This problem can be summarized as &quot;given $g, A, A^y, B, B^x$, compute $g^x \cdot g^y$
Given a CDH oracle, we can solve this with two queries; we get the inputs $g, A, A^y, B, B^x$, and we give the CDH oracle the values $B, B^x, g$, and it'll give us the value $g^x$; we do the same to get $g^y$, and a simple multiplication gives us $g^x \cdot g^y$
Conversely, given an oracle that solves this problem, we can solve the CDH problem; we get the inputs $C, C^x, D$, we select an arbitrary $E, y$ values, and give the oracle the tuple $D, E, E^y, C, C^x$; it'll return the value $D^x \cdot D^y$.  We then multiply that by $D^{-y}$, and that gives us the answer to the CDH problem $D^x$

Now, addressing the decisional problem would appear to be trickier; it's easy enough to show how to solve the DDH problem with an oracle that solves the decisional version of this problem; however, I don't see an obvious way to use a DDH oracle to solve this problem.

[1]: Note: for the CDH problem, I won't be using the usual formulation &quot;given $g, g^x, g^y$, return $g^{xy}$, instead, I'll be using the equivalent &quot;given $g, g^x, h$ return $h^x$.  That formulation would appear to be make the proof a bit cleaner...