If I proved a scheme's security under GDH assumption, in real-life, if this DDH oracle does exist, then it's good, but what about other side ? In real-life, if this DDH oracle doesn't exist, then what's the meaning of proving?
One might imagine that the object of a security proof is to know that if someone breaks your system, that means they have (essentially) found a way to do some computation that you couldn't do before. Sort of a consolation prize.
However, it is better to consider it as a statement of beliefs and consequences of those beliefs. We believe factoring is hard. If a practical attacker against a cryptosystem leads to easy factoring, we must believe that such a practical attacker cannot exist. We must believe that our cryptosystem is secure.
And from this point of view Gap Diffie-Hellman makes sense. We do not believe that CDH reduces to DDH, ergo we must also believe that cryptosystems based on GDH are sound.
|show 1 more comment|