Can a protocol proved secure in the standard model be considered secure in the random oracle model?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
As correctly pointed out by Ricky Demer it is not necessarily true. However, this implication does not hold for very specific cases. In the case of random oracle gates the existence of the RO changes the functionality of the "scheme", since with RO there are RO-Gates and without there aren't.
In most cases the existence of the RO does not affect the functionality of the scheme, meaning that with and without RO you have the exact same functionality. In these cases this implication holds I think. The ROM, in comparison to the standard model, provides you with an additional oracle that realizes a truly random function, i.e. a function where the input and output are absolutely unrelated. If you have proven something secure in the standard model, then you didn't need this additional oracle. The exact same proof will so to speak also hold in the ROM but will not use the oracle.
Even though an adversary might use the RO too, I don't see how this would help him if it doesn't affect the functionality of the scheme, since in this case the scheme and the proof are completely unrelated to the RO.
For example, if there is a public-coin collision-resistant hash family then there is
The point is that the simulator must commit to the adversary's code and then give a universal argument about what that code outputs on a given input. $\:$ Such arguments can't handle random oracle gates.
Also, I have not seen any proof that a random oracle does not significantly increase the