What is a q-type assumption?

Question

I've seen the term "$q$-type assumption" used in a few papers without a definition. A Google search doesn't seem to come up with anything useful either (except the same papers without a definition). Could someone elaborate on what they are and how they compare to static assumptions?

Are there some other typical "types" or classifications of assumptions that one should know of?

PS: There doesn't seem to be a tag named "assumptions." Something like that should exist, but I don't have enough points to add it.

Answer 1

The classic standard assumptions (such as DDH, CDH) are not parametrized and always have constant size (are static). Consequently, the assumption when used in a reductionist proof is independent of any system parameters or oracle queries and only related to the security parameter.

In contrast, non-static ($q$-type) assumptions as already mentioned by Travis are parametrized (and actually a family of assumptions). They may be used in a static way (e.g., as 2-DBDHI), but if a reductionists proof relies on the non-static version, e.g., $q$-DBDHI, then $q$ is usually related to the number of oracle queries an adversary makes. For instance, if you have a signature scheme where a $q$-type assumption is used, then $q$ usually corresponds to the number of signing oracle queries an adversary makes and then the reduction works (you may for instance look at "Short Signatures Without Random Oracles" from Dan Boneh and Xavier Boyen, who reduce the security of their scheme to the $q$-SDH assumption). Consequently, the more signing queries an adversary is allowed to do, the larger the problem instance and usually the stronger the required assumption gets (observe that for static assumptions this does not influence the assumption itself). As Travis has mentioned some $q$-type assumptions can be converted to static assumptions such as subgroup hiding (typically in composite order bilinear groups).

Another class of assumptions which are typically seen to be stronger than $q$-type assumptions are interactive assumptions. Here, the assumption itself involves some oracle. A classic example are one-more assumptions (one-more RSA inversion, one-more CDH, LRSW assumption), where having $n$ times access to a "helper" oracle that solves some hard tasks on one of the $n$ inputs each, the assumption states that it does not help to solve the task on $m>n$ inputs. Another classic example for this type of assumption are knowledge of exponent assumptions, where solving some hard tasks implies some oracle (extractor) that extracts some value that the solver is implicitly assumed to know in order to solve the hard task. Interactive assumptions are non-falsifiable (you may read this paper) and thus people usually try to avoid them.

Answer 2

After reading this paper, it looks like a $q$-type assumption is simply one which is parameterized over the value $q$. For instance, the $q$-DBDHI (Decisional Bilinear Diffie-Hellman Inversion) assumption is that, given $(g, g^x, g^{x^2}, \ldots, g^{x^q})$, it is difficult to compute $e(g,g)^{1/x}$, where $e$ is the pairing operation.

This produces a family of assumptions, for every value of $q$, where each of them may have different guarantees of security. Generally, as $q$ becomes larger the assumption is stronger and a scheme which requires it will be more vulnerable, but it does not have to scale in a predictable way like when using a standard security parameter. This is a pretty big disadvantage, but fortunately the above paper is able to reduce a number of popular $q$-type assumptions to the more standard subgroup hiding assumption which is not paramaterized.