I would like to know the difference between the random oracle model and
the non-programmable random oracle model. What is the difference?
$\begingroup$
$\endgroup$
1
-
2$\begingroup$ What is it that you don't understand about it? Especially, what do you not understand from this answer? $\endgroup$– Maarten Bodewes ♦Jun 23, 2016 at 7:09
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
The main difference (from a cryptographic point of view) is whether the simulator is capable of choosing the answers to the oracle queries or not. In more detail, to prove the simulation-based security of a cryptographic construction in the random oracle model, the simulator is assumed to be able to choose answers for the queries that parties make to the random oracle. This property is referred to as programmability of the random oracle. In the context of non-interactive zero-knowledge (NIZK) proofs, for example, this makes the simulator able to create a convincing but fake proof. On the other hand, the non-programmable random oracle (NPRO) model restricts the simulator such that it can no longer choose the answers for the queries. Instead, the simulator is empowered by seeing all the query/answer pairs, made by the parties during the protocol. This restriction on the simulator (or more generally, the security reduction) makes the underlying proofs preferable, as they rely on fewer properties of the random oracle and so can be considered as a step toward getting rid of it.
$\begingroup$
$\endgroup$
When a random oracle is used in proof reductions, it is often programmable. I'm not sure what is your context but perhaps the following articles on different programmability modes can help: ftp://ftp.inf.ethz.ch/pub/crypto/publications/FLRSST10.pdf
