random oracle model vs standard model vs selective model

Question

Can someone clearly outline the main difference between each of the three security models:

1. random oracle model
2. standard model
3. selective model

This post What is the "Random Oracle Model" and why is it controversial? gives a very good description of the random oracle. According to what I have been reading, the standard model depends on some strong assumptions (for example DDH).

What I don't understand is how the selective model is different from both. And to what extent is it weak.

Answer 1

• In the random oracle model, you assume the existence of random behaving function, which is at the control of the protocol designer-challenger- during the game played between the adversary and the challenger in case of game based definitions. Usually the challenger manipulates the random looking output at its will in order to 'inject' the challenge of a presumably difficult problem like DDH, CDH, etc. In the real world, the random oracle advocates conjecture that this can be instantiated with a collision resistant hash function and argue that if such function raises security problems then we just replace it but the model itself does not break. This is still questionable as researchers have manage to cancel security guarantees by exploiting the non-random-looking instantiation of such hash functions.
• In the standard model, there is no assumption for the existence of such random looking function and the security of the scheme lies on the hardness of mathematical assumptions, usually at the cost of a less efficient protocol but without making any assumption about random functions.
• Selective model cannot be compared with random oracle and standard model. It is like comparing apples with lemons. Selective model dictates the way an adversary is getting information from the challenger (paper). In the selective model the adversary somehow declares in advance the challenge is gonna get later in the protocol. That renders the model a bit weak. In contrast in the adaptive model this limitation does not exist.