I am new to Crypto field. Many papers are boasting of not using Random Oracle model. Instead, those prove security in Standard Model. I am surprised how do these models differ. Can anyone please clarify me? Does using Hash function mean that the paper makes use of Random Oracle?
$\begingroup$
$\endgroup$
2
-
1$\begingroup$ What research have you done? There is lots written on this subject, both in textbooks and in Wikipedia, as well as on this site (try clicking on the random-oracle-model tag under your question to see other questions). I expect you to do a significant amount of research before asking, and to show us in your question what research you've done, and to use the research to frame a narrower question. There is little point in us repeating the information that is already widely available on the Internet. It looks like you haven't done that, so your question isn't a good fit for this site. $\endgroup$– D.W.Aug 28, 2014 at 20:02
-
$\begingroup$ possible duplicate of What is the “Random Oracle Model” and why is it controversial? $\endgroup$– D.W.Aug 28, 2014 at 20:02
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
5
The random oracle model is a heuristic that assumes the existence of a truly random function to which all parties involved in a protocol, good and bad alike, have access. Since in reality no such function exists, random oracles are instantiated with hash functions and one heuristically assumes that a hash function behaves good enough to be a replacement for random oracles. Random oracles are nice as they allow to prove protocols secure while they are still practically efficient.
Since there are theoretical results showing that there are protocols that are secure in the random oracle model but trivially insecure whenever the random oracle is instantiated with any hash function, standard model constructs, i.e., constructs that do not rely on random oracles, are nicer from a theoretical perspective. Standard model means that the protocols only rely on standard cryptographic assumptions (DDH, CDH...) in their proofs.
No, using hash functions does not mean that you are in the random oracle model - only if you model them as random oracles. If you rely for instance on the collision resistance of a hash function, you can be still in the standard model.
-
1$\begingroup$ but proof in the random oracles model is easier than that in the standard model. Although there are some flaws with ROM, in a certain cases where a crptosystem is hard to prove in the standard model, then it's not a bad idea to switch to the ROM. At least, it's better than nothing. $\endgroup$– T.BAug 29, 2014 at 2:22
-
2$\begingroup$ Well, yes and no. The counterargument is that good crypto is about minimizing the assumptions you have to make. Assumptions are dangerous. $\endgroup$– pg1989Aug 29, 2014 at 3:22
-
$\begingroup$ @Alex A proof being easier is no criteria. Ideally you have a tight reduction to some well studied assumption in the standard model. But yes thats not always possible and I agree that a proof in the ROM is better than no proof at all. In practice, there are various schemes used and also standardized that come with a security proof in the ROM. $\endgroup$– DrLecterAug 29, 2014 at 6:51
-
$\begingroup$ Then why just we do not substitute the hash function of the protocol with a random value in order to enjoy security in the standard model? I thought that random oracle means that you manipulate the output of the random oracle in order to build your reductionist proof. If you do not need that manipulation in the proof then we are in the standard model. Is that the case? $\endgroup$– curiousDec 19, 2016 at 20:08
-
$\begingroup$ @curious The assumption that a shared function of the appropriate domain (typically {0,1}^* -> {0,1}^n) is chosen uniformly at random at the beginning of the protocol is equivalent to the random oracle model. $\endgroup$– dionyzizApr 8, 2018 at 16:17