4
$\begingroup$

In this paper and this the authors speak of a "standard model". What is the "standard model"? How does it differ from the "ideal model"? Why does the decision to use it or the "ideal model" impact the security bounds of their schemes?

$\endgroup$
6
$\begingroup$

In the standard model, the block cipher is modeled as a pseudorandom permutation (when using a random key). The adversary has oracle access to either the block cipher instantiated with a random key or a truly random permutation, and has to try to distinguish between them. In the ideal model, the block cipher is modeled as a family of truly random permutations; a different independent one for every different key. This is similar to the random oracle model, but even stronger (in some sense).

In what sense is it stronger? Well, it's stronger in the sense that there are functions that are random oracles but certainly not ideal ciphers. For one, a random oracle need not have the same domain and range. In addition, it can have collisions. In addition, they don't have two separate inputs (key and input). However, as an \emph{assumption} they are actually equivalent in that you can build an ideal cipher from a random oracle. This was proven (incorrectly initially, and then fixed). See the paper Equivalence of the Random Oracle Model and the Ideal Cipher Model, Revisited for this.

$\endgroup$
  • 1
    $\begingroup$ In what way is an ideal block-cipher a stronger assumption than ROM? $\endgroup$ – CodesInChaos Dec 5 '17 at 10:19
  • 1
    $\begingroup$ Edited to include your question. $\endgroup$ – Yehuda Lindell Dec 7 '17 at 6:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.