Generic Group Model (GGM)

Status	Problem	Tags
	dv-SNARG, One Group Element Numbered Conjecture 1.3 of the source. Its own theorems achieve one group element plus \(O(\tau)\) bits, and (with a random oracle) one group element, one hash output and about \(2\tau\) bits; the conjecture halves the additive term to \(\tau + o(\tau)\) and asks for no random oracle. 4 open	Generic Group Model Proof Size Lower Bounds Snarksggmcharacterization
	Four-party NIKE, quadratic, Maurer’s model Open. Achieved in Shoup’s generic group model by the source paper (Construction 9, Theorem 10); in Maurer’s model the paper’s own \(O(n^2)\) attack sets a ceiling that a construction would meet exactly, and nothing is known about reaching it. 5 open	Generic Group Model Non Interactive Key Exchangeggmseparation
	Quadratic attack on 3-NIKE, Shoup’s model Open in Shoup’s model. Settled by the source paper in Maurer’s model for every \(K\) at least \(3\), including imperfect correctness; its own three-party Shoup construction achieves only an \(n^{1.5}\) gap, so the truth for three parties lies somewhere between \(n^{1.5}\) and \(n^2\). 5 open	Generic Group Model Non Interactive Key Exchangeggmlower-bound
	r-round DLOG tradeoff Open for every intermediate \(r\): the \(r=1\) endpoint is the source’s own theorem and \(r=T\) is Corrigan-Gibbs–Kogan, with nothing proved in between. The source conjectures the interpolating formula and says a matching attack exists at every \(r\), so the missing half is the lower bound. 6 open	Adaptivity Discrete Logarithm Generic Group Model Time Space Tradeoffsggmtight-bound
	No round-optimal pairing-free blind signature Open for a polynomial query budget. The impossibility is proved when \(\mathsf{User}_2\) and \(\mathsf{Verify}\) together make \(O(\log\lambda)\) random-oracle queries, including when oracle outputs contain group elements; the superpolynomial message space hypothesis is retained. 5 open	Black Box Separations Blind Signatures Generic Group Model Signature Schemesggmimpossibilityadaptation (ai)
	Non-adaptive DDH bound Open, and asserted rather than asked: the source proves \(1/2+\tilde{O}(T^2/N+\sqrt{ST/N})\), states twice that it conjectures this is not tight for DDH, and names \(1/2+\tilde{O}(T^2/N+ST/N)\) as the right answer. The same theorem’s square-DDH bound is sharp, with a matching attack, which is what makes the DDH case a question rather than a suspicion. 6 open	Adaptivity Discrete Logarithm Generic Group Model Time Space Tradeoffsggmtight-boundadaptation (ai)