In this paper and this the authors speak of a "standard model". What is the "standard model"? How does it differ from the "ideal model"? Why does the decision to use it or the "ideal model" impact the security bounds of their schemes?
$\begingroup$
$\endgroup$
0
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
In the standard model, the block cipher is modeled as a pseudorandom permutation (when using a random key). The adversary has oracle access to either the block cipher instantiated with a random key or a truly random permutation, and has to try to distinguish between them. In the ideal model, the block cipher is modeled as a family of truly random permutations; a different independent one for every different key. This is similar to the random oracle model, but even stronger (in some sense).
In what sense is it stronger? Well, it's stronger in the sense that there are functions that are random oracles but certainly not ideal ciphers. For one, a random oracle need not have the same domain and range. In addition, it can have collisions. In addition, they don't have two separate inputs (key and input). However, as an \emph{assumption} they are actually equivalent in that you can build an ideal cipher from a random oracle. This was proven (incorrectly initially, and then fixed). See the paper Equivalence of the Random Oracle Model and the Ideal Cipher Model, Revisited for this.
answered Dec 5, 2017 at 6:52
-
1$\begingroup$ In what way is an ideal block-cipher a stronger assumption than ROM? $\endgroup$ Commented Dec 5, 2017 at 10:19
-
1$\begingroup$ Edited to include your question. $\endgroup$ Commented Dec 7, 2017 at 6:32