<p>A security model defines the abilities of an attacker and also defines what it means to break the security. For example, security models for key exchange protocols often define a break to mean an adversary can distinguish the shared secret key derived in the exchange from a random other key. Such models then define powers the adversary can have such as compromising certain combinations of keys, etc. More complicated protocols have more complicated security models. A good security model is one which captures all the real attacks one might expect on the system.</p>
<p>In security and cryptography, nothing is ever certain. Hence the reliance on clearly defined assumptions. When defining security, we do so in the context of these assumptions - if an assumption turns out to be false, the security of the scheme may be broken. Assumptions usually say something like, &quot;it is infeasible for anyone to do XYZ&quot; (although obviously stated more formally). For example, a lot of cryptographic protocols rely on the assumption that the discrete logarithm problem is hard in large enough elliptic curve groups over prime fields. The assumptions are made with respect to the best known attacks / computing power / resources of adversaries in the real world.</p>
<p>I'm not as familiar with what a &quot;security guarantee&quot; is in a formal sense. From what I understand, it is just used to mean anything which is guaranteed to hold in a security model based on the assumptions made. For example, we have a security guarantee that you cannot recover a private key from a secp256k1 public key if the discrete logarithm is hard on that curve.</p>

CC BY-SA 4.0
2022-02-11T11:45:33.357Z
Great, useful answer, thanks! An example of a security model for the moon may be "To break the security means to cut the moon in two", together with "The attacker has an axe".  A security assumption may be "there is no axe big enough to cut the moon in two". A security guarantee derived from this model and assumption is that the moon will not be cut in two. Did I get this right?
Kalle Rosenbaum
CC BY-SA 4.0
2022-02-11T13:22:07.167Z
Something like that, sure!
meshcollider
CC BY-SA 4.0
2022-02-11T10:00:08.677Z
2022-02-11T13:21:34.597Z
2022-02-11T13:21:34.597Z
meshcollider
<p>I often hear bitcoiners talk about</p>
<ul>
<li>security models</li>
<li>security assumptions</li>
<li>security guarantees</li>
</ul>
<p>but I can't find definitions of these terms.</p>
<p>What do these terms mean and how do they relate to each other?</p>

CC BY-SA 4.0
2022-02-11T08:49:48.223Z
Maybe better suited for https://security.stackexchange.com/ (if this wouldn't be a duplicate already). Although i guess we can have an answer explaining how those applies to Bitcoin specifically.
Antoine Poinsot
CC BY-SA 4.0
2022-02-11T09:08:19.290Z
@AntoinePoinsot yeah, there is one similar question there, https://security.stackexchange.com/questions/239211/threat-adversary-trust-security-model-what-is-the-difference but it's unanswered. And I ideally want this question answered with examples from a Bitcoin context.
Kalle Rosenbaum
<security><terminology>
What is a security model, security assumption, and security guarantee?
Kalle Rosenbaum
# What is a security model, security assumption, and security guarantee?

(Asked by: username_0 on 2022-02-11)

I often hear bitcoiners talk about

* security models
* security assumptions
* security guarantees

but I can't find definitions of these terms.

What do these terms mean and how do they relate to each other?

**Tags:** security, terminology

> **Comments:**
> **username_1**: Maybe better suited for https://security.stackexchange.com/ (if this wouldn't be a duplicate already). Although i guess we can have an answer explaining how those applies to Bitcoin specifically.  
> **username_0**: @username_1 yeah, there is one similar question there, https://security.stackexchange.com/questions/239211/threat-adversary-trust-security-model-what-is-the-difference but it's unanswered. And I ideally want this question answered with examples from a Bitcoin context.  

---

## 1 answers

### Answer by username_2 on 2022-02-11. Score: 2 | Accepted answer

A security model defines the abilities of an attacker and also defines what it means to break the security. For example, security models for key exchange protocols often define a break to mean an adversary can distinguish the shared secret key derived in the exchange from a random other key. Such models then define powers the adversary can have such as compromising certain combinations of keys, etc. More complicated protocols have more complicated security models. A good security model is one which captures all the real attacks one might expect on the system.

In security and cryptography, nothing is ever certain. Hence the reliance on clearly defined assumptions. When defining security, we do so in the context of these assumptions - if an assumption turns out to be false, the security of the scheme may be broken. Assumptions usually say something like, "it is infeasible for anyone to do XYZ" (although obviously stated more formally). For example, a lot of cryptographic protocols rely on the assumption that the discrete logarithm problem is hard in large enough elliptic curve groups over prime fields. The assumptions are made with respect to the best known attacks / computing power / resources of adversaries in the real world.

I'm not as familiar with what a "security guarantee" is in a formal sense. From what I understand, it is just used to mean anything which is guaranteed to hold in a security model based on the assumptions made. For example, we have a security guarantee that you cannot recover a private key from a secp256k1 public key if the discrete logarithm is hard on that curve.

> **Comments:**
> **username_0**: Great, useful answer, thanks! An example of a security model for the moon may be "To break the security means to cut the moon in two", together with "The attacker has an axe".  A security assumption may be "there is no axe big enough to cut the moon in two". A security guarantee derived from this model and assumption is that the moon will not be cut in two. Did I get this right?  
> **username_2**: Something like that, sure!  

---

