Can someone clearly outline the main difference between each of the three security models:

  1. random oracle model
  2. standard model
  3. selective model

This post What is the "Random Oracle Model" and why is it controversial? gives a very good description of the random oracle. According to what I have been reading, the standard model depends on some strong assumptions (for example DDH).

What I don't understand is how the selective model is different from both. And to what extent is it weak.

  • $\begingroup$ The standard model is (supposed to be) the real world. The random oracle model is an ideal world in which we have access to a random function of some sort. It is not immediately clear to me what the selective model is, but it sounds similar to the "selective identity model", in which we only consider adversaries that choose certain things without looking at certain other things (typically modelled as choosing one before getting the other). $\endgroup$
    – K.G.
    Feb 7, 2017 at 22:09

1 Answer 1

  • In the random oracle model, you assume the existence of random behaving function, which is at the control of the protocol designer-challenger- during the game played between the adversary and the challenger in case of game based definitions. Usually the challenger manipulates the random looking output at its will in order to 'inject' the challenge of a presumably difficult problem like DDH, CDH, etc. In the real world, the random oracle advocates conjecture that this can be instantiated with a collision resistant hash function and argue that if such function raises security problems then we just replace it but the model itself does not break. This is still questionable as researchers have manage to cancel security guarantees by exploiting the non-random-looking instantiation of such hash functions.
  • In the standard model, there is no assumption for the existence of such random looking function and the security of the scheme lies on the hardness of mathematical assumptions, usually at the cost of a less efficient protocol but without making any assumption about random functions.
  • Selective model cannot be compared with random oracle and standard model. It is like comparing apples with lemons. Selective model dictates the way an adversary is getting information from the challenger (paper). In the selective model the adversary somehow declares in advance the challenge is gonna get later in the protocol. That renders the model a bit weak. In contrast in the adaptive model this limitation does not exist.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.