Proven security for protocol

[Al-Kindi-0]

Addresses #204
This PR adds the ability to compute the proven security of the protocol given a set of parameters. It uses Habock and some additional observations and correction made by @benediamond (Ulvetanna).
One annoying thing is related to the repeated use of the min function. This leads to a potential loss of up to 2 bits of soundness. It is possible to avoid this by adding some extra logic to compare the exponents but I am still looking for something easier.

[irakliyk]

Looks great! Thank you! I left a few small comments inline. We can merge once they are addressed.

Also, I'm curious, for some common sets of parameters, how do results given by this new approximation differ from the previous method?

[Al-Kindi-0]

For fib-small:

1. -q 38 -b 16 -g 20 -e 2:
   Before: Proof security: 118 bits (83 proven)
   Now: Proof security: 118 bits (82 proven)
2. -q 38 -b 32 -g 20 -e 2:
   Before: Proof security: 118 bits (79 proven)
   Now: Proof security: 118 bits (78 proven)

As expected the difference is minimal and is largely due to the repeated use of the min operation.

[hecmas]

Maybe a little bit out of the context, but there is some "degradation" in computing the security level for composite/recursive protocols. If $\epsilon_1$ is the error for the "outer" proving system and $\epsilon_2$ is the error for the "inner" proving system, one can easily prove that $\epsilon_1 + \epsilon_2$ (sum of negligible terms is negligible) is the error for the composite/recursive system.
Assuming a sufficiently large number of recursive steps, one can achieve the degradation of the original security level by some bits. E.g., say $\epsilon_1 = \epsilon_2 = \frac{1}{2^{128}}$, then a one-depth recursive system has $\epsilon_1 + \epsilon_2 = \frac{1}{2^{127}}$ soundness error (127-bit security level) even tho the original systems had 128-bit security level.

Since it is very easy, probably it's a good idea to have the formula as well for the composite/recursive system.

[irakliyk]

Looks good! Thank you! I left a couple of non-blocking comments inline.

[irakliyk]

Maybe a little bit out of the context, but there is some "degradation" in computing the security level for composite/recursive protocols. If $\epsilon_1$ is the error for the "outer" proving system and $\epsilon_2$ is the error for the "inner" proving system, one can easily prove that $\epsilon_1 + \epsilon_2$ (sum of negligible terms is negligible) is the error for the composite/recursive system.
Assuming a sufficiently large number of recursive steps, one can achieve the degradation of the original security level by some bits. E.g., say $\epsilon_1 = \epsilon_2 = \frac{1}{2^{128}}$, then a one-depth recursive system has $\epsilon_1 + \epsilon_2 = \frac{1}{2^{127}}$ soundness error (127-bit security level) even tho the original systems had 128-bit security level.

Since it is very easy, probably it's a good idea to have the formula as well for the composite/recursive system.

Interesting! Would we need to estimate the depth of recursion for this?

In general, I'm thinking that maybe we should create a separate issue to address any remaining improvements we can make to security estimation.

[hecmas]

Interesting! Would we need to estimate the depth of recursion for this?

If you want to be as accurate as possible in your security estimations, then I would say yes!

All of the concerns regarding the security of the recursive/composite proof system are very good explained in this video from Dan Boneh.