Introdusert av Victor Shoup i [EC:Shoup97 - Lower bounds for discrete logarithms and related problems](https://link.springer.com/content/pdf/10.1007/3-540-69053-0_18.pdf). En variant ble introdusert av Ueli Maurer i [IMACC:Maurer05 - Abstract models of computation in cryptography](https://link.springer.com/chapter/10.1007/11586821_1). (Har også "the more commonly used extension thereof, which Zhandry calls type-safe model" – Auerbach et al.) Fra [C:Zhandry22 - To label, or not to label (in generic groups)](https://eprint.iacr.org/2022/226.pdf): > There are two distinct wide-spread versions of generic groups, Shoup’s and Maurer’s, the main difference being whether or not group elements are given explicit labels. The two models are often treated as equivalent. I dette arbeidet viste Mark Zhandry at denne antatte ekvivalensen er falsk, og at Shoup sin variant er sterkere. Se også: [[Algebraic Group Model]] ### GGM med pre-prosessering Auerbach et al. påpeker i [TCC:AueHofPas23 - Generic-group lower bounds viea reductions between geometric-search problems: With and without preprocessing](https://eprint.iacr.org/2023/808) at én av tingene Maurer sin modell feiler å fange er pre-prosessering, som de derfor studerer i Shoup sin modell. (Men de studerer ikke MI-gapCDH med pre-prosessering, noe som leder til et gap for å komme til [[Multi-Instance Secure Public-Key Encryption]] – det er dette gapet vi ønsker å tette i [[Multi-Instance Security and Preprocessing]]!) #### The Auxiliary Input Generic Group Model (AI-GGM) Auerbach et al.: > In the AI-GGM, the adversary is able to perform unbounded preprocessing on the whole labeling function to generate an advice string of bounded size before receiving the problem instance. #### The Bit-Fixing Generic Group Model (BF-GGM) Auerbach et al.: > In the preprocessing phase of the BF-GGM, (the adversary) is able to choose labels of a bounded number of group elements, but does not have access to the remainder of the labeling function. ([C:CorDodGuo18 - Non-Uniform Bounds in the Random-Permutation, Ideal-Cipher, and Generic-Group Models](https://eprint.iacr.org/2018/226)) show that, under certain conditions, bounds in the BF-GGM, which is typically easier to work with, also hold in the AI-GGM.