Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

This question already has an answer here:

I am new to Crypto field. Many papers are boasting of not using Random Oracle model. Instead, those prove security in Standard Model. I am surprised how do these models differ. Can anyone please clarify me? Does using Hash function mean that the paper makes use of Random Oracle?

share|improve this question

marked as duplicate by D.W., otus, e-sushi, archie, poncho Aug 29 at 16:00

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

What research have you done? There is lots written on this subject, both in textbooks and in Wikipedia, as well as on this site (try clicking on the random-oracle-model tag under your question to see other questions). I expect you to do a significant amount of research before asking, and to show us in your question what research you've done, and to use the research to frame a narrower question. There is little point in us repeating the information that is already widely available on the Internet. It looks like you haven't done that, so your question isn't a good fit for this site. –  D.W. Aug 28 at 20:02
possible duplicate of What is the “Random Oracle Model” and why is it controversial? –  D.W. Aug 28 at 20:02

1 Answer 1

The random oracle model is a heuristic that assumes the existence of a truly random function to which all parties involved in a protocol, good and bad alike, have access. Since in reality no such function exists, random oracles are instantiated with hash functions and one heuristically assumes that a hash function behaves good enough to be a replacement for random oracles. Random oracles are nice as they allow to prove protocols secure while they are still practically efficient.

Since there are theoretical results showing that there are protocols that are secure in the random oracle model but trivially insecure whenever the random oracle is instantiated with any hash function, standard model constructs, i.e., constructs that do not rely on random oracles, are nicer from a theoretical perspective. Standard model means that the protocols only rely on standard cryptographic assumptions (DDH, CDH...) in their proofs.

No, using hash functions does not mean that you are in the random oracle model - only if you model them as random oracles. If you rely for instance on the collision resistance of a hash function, you can be still in the standard model.

share|improve this answer
but proof in the random oracles model is easier than that in the standard model. Although there are some flaws with ROM, in a certain cases where a crptosystem is hard to prove in the standard model, then it's not a bad idea to switch to the ROM. At least, it's better than nothing. –  T.B Aug 29 at 2:22
Well, yes and no. The counterargument is that good crypto is about minimizing the assumptions you have to make. Assumptions are dangerous. –  pg1989 Aug 29 at 3:22
@Alex A proof being easier is no criteria. Ideally you have a tight reduction to some well studied assumption in the standard model. But yes thats not always possible and I agree that a proof in the ROM is better than no proof at all. In practice, there are various schemes used and also standardized that come with a security proof in the ROM. –  DrLecter Aug 29 at 6:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.