Tagged Questions
1
vote
1answer
63 views
Is Guillou-Quisquater existentially unforgeable against adaptive message attack under a random oracle model?
First of all, the Guillou-Quisquater digital signature scheme is:
Note everything is $\bmod n$. Message is denoted by $m$.
Private key: $s$
Public key: Hash function $H$, $e$, ...
2
votes
1answer
143 views
Why are protocols often proven secure under the random oracle model instead of a hash assumption?
Is this true that whenever you design a protocol using a hash function, you must prove its security under the random oracle?
I mean, is it possible to devise a protocol $P$ using a function $H$, and ...
19
votes
1answer
1k views
What is the “Random Oracle Model” and why is it controversial?
What is the "Random Oracle Model"? Is it an "assumption" akin to the hardness of factoring and discrete log? Or something else?
And why do some researchers have a strong distrust of this model?
