# security in the standard model → random oracle model?

Can a protocol proved secure in the standard model be considered secure in the random oracle model?

-

As correctly pointed out by Ricky Demer it is not necessarily true. However, this implication does not hold for very specific cases. In the case of random oracle gates the existence of the RO changes the functionality of the "scheme", since with RO there are RO-Gates and without there aren't.

In most cases the existence of the RO does not affect the functionality of the scheme, meaning that with and without RO you have the exact same functionality. In these cases this implication holds I think. The ROM, in comparison to the standard model, provides you with an additional oracle that realizes a truly random function, i.e. a function where the input and output are absolutely unrelated. If you have proven something secure in the standard model, then you didn't need this additional oracle. The exact same proof will so to speak also hold in the ROM but will not use the oracle.

Even though an adversary might use the RO too, I don't see how this would help him if it doesn't affect the functionality of the scheme, since in this case the scheme and the proof are completely unrelated to the RO.

-

Not necessarily.

For example, if there is a public-coin collision-resistant hash family then there is
a (statistical) zero-knowledge argument system (with negligible soundness error)
for NP that uses a constant number of rounds and has a public-coin verifier.
However, in the random oracle model, constant-round public-coin computational zero-knowledge argument systems (with negligible soundness error) only exist for easy problems.

The point is that the simulator must commit to the adversary's code and then give a universal argument about what that code outputs on a given input. $\:$ Such arguments can't handle random oracle gates.

Also, I have not seen any proof that a random oracle does not significantly increase the
power of (fully) non-uniform adversaries, even against non-interactive hardness assumptions.

-
Thanks for your answer. I've not really understood. –  Dingo13 Apr 12 at 7:37