What is a security model, security assumption, and security guarantee?

Question

I often hear bitcoiners talk about

• security models
• security assumptions
• security guarantees

but I can't find definitions of these terms.

What do these terms mean and how do they relate to each other?

Answer 1

A security model defines the abilities of an attacker and also defines what it means to break the security. For example, security models for key exchange protocols often define a break to mean an adversary can distinguish the shared secret key derived in the exchange from a random other key. Such models then define powers the adversary can have such as compromising certain combinations of keys, etc. More complicated protocols have more complicated security models. A good security model is one which captures all the real attacks one might expect on the system.

In security and cryptography, nothing is ever certain. Hence the reliance on clearly defined assumptions. When defining security, we do so in the context of these assumptions - if an assumption turns out to be false, the security of the scheme may be broken. Assumptions usually say something like, "it is infeasible for anyone to do XYZ" (although obviously stated more formally). For example, a lot of cryptographic protocols rely on the assumption that the discrete logarithm problem is hard in large enough elliptic curve groups over prime fields. The assumptions are made with respect to the best known attacks / computing power / resources of adversaries in the real world.

I'm not as familiar with what a "security guarantee" is in a formal sense. From what I understand, it is just used to mean anything which is guaranteed to hold in a security model based on the assumptions made. For example, we have a security guarantee that you cannot recover a private key from a secp256k1 public key if the discrete logarithm is hard on that curve.