Bridging the gap between security proofs and "real-world" security I've been studying cryptography for a little while. I understand fairly well the nuts and bolts of security proofs, but I'm having trouble reconciling the formal statements of security in these proofs with their practical "meaning" for a real system. Is there an intuitive way to reason about the "real-world" security of some cryptosystem based only on a formal proof of security against a constructed adversary?
As suggested in the comments, this question does seem broad and an answer would probably fill hundreds of journals. Nonetheless, the introduction to Katz &amp; Lindell's Introduction to Modern Cryptography provides a nice starting point from a (largely) accepted perspective. Starting from a similar perspective, I'd say a provable security proof of some statement -- e.g., scheme S satisfies property P -- asserts nothing about the real-word beyond what is derivable about the real-world from the statement. This is incredibly limiting when you dig deeper, because many provable security proofs assert nothing about the real-world. That said, at least we can agree that the proven statement holds, rather than nothing at all.