Question: If I prove a protocol secure in the plain model (i.e., without any prerequisites or setup before running the protocol, setups like a common reference string distributed among all parties) using nonstandard hardness assumptions (like bilinear oracle Diffie-Hellman) has any advantage over a protocol which uses a setup before running but its hardness relies on a standard hardness assumption (like discrete logarithm)?  If there is a tradeoff, can you point me how to maintain this tradeoff?I must note that the nonstandard hardness does not give you enough measure to compare the complexity of the protocol using it with other protocols.
Is the model in which a protocol is proven secure more important than type of hardness from which the algorithm gains its strength
cc.complexity theory;cr.crypto security
Let me rephrase the question: Which one is preferred?Proving a protocol secure in the standard model, based on non-standard assumptionsProving a protocol secure in non-standard models (like CRS), based on standard assumptions.The short answer is: It depends!Details follow. Assume that you can prove a protocol secure in the CRS model using standard assumptions. In addition, assume that you can implement the CRS model in the standard model without significant overhead, and using only standard assumptions. Then, the second approach is preferable. (Here, significant depends on the application.)On the other hand, assume that you cannot implement the CRS model in the standard model easily ,i.e. either the overhead is too high, or the protocol setting is that you cannot implement the CRS without resorting to non-standard assumptions (For instance: You don't have access to some trusted 3rd party, etc.) In such cases, it seems that the first approach is preferable.Side note: I must add that both approaches are highly valuable in theory, regardless of the real-world application.