When proving a Crypto scheme security under random oracle model, is the random oracle always controlled by the challenger?
What if the Hash is only used by the adversary?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
As @xagawa mentioned in his comment, it depends on what you mean by "controled".
In the case of using a programmable random oracle, yes, the reduction (in particular the simulation of the challenger of the real game) decides about what to return as answer to an oracle query. Thereby, the reduction has to guarantee that the "programmed" answers are consistent (identical answers to identical queries) and that the distribution of the answers are uniformly random to the adversary.
Such reductions are the ones typically used for reductionists proofs in the ROM, as it nicely allows the reduction to embed a problem instance into the adversaries queries to make the reduction work.
Typically, the random oracle is also observable, i.e., besides the programmability, the reduction "sees" all oracle queries and thus knows how much queries the adversary has made to the random oracle.
There are also works investigating non-observable reductions, where the random oracle is external to the adversary and the reduction. But they still can provide some means of programmability as the reduction can decide on the turing-machine that is used for the external oracle. In the linked paper you find some results for non-observable but programmable random oracles and also some examples for reductions in the ROM that also work if the observability is removed.
There is also the possibiltiy to have reductions in the ROM which are non-programmable and non-observable, but this enormously reduces the power that the ROM provides you in reductionists proofs.
Firstly, I should clarify: I am just referring to the standard definition of a random oracle. There are other scenario's (better discussed in DrL's answer), but these tend to be explicitly referred to. That is, if you have a standard 'random oracle', this answer should hold. On the other hand, if you have a different type of oracle, this won't hold.
A random oracle is an oracle that, when presented with a bitstring $x$, returns a bitstring $y$ that is either randomly generated (if $x$ is new) or the same as it returned last time $x$ was queried.
It is not controlled by either party, but in most games both parties are allowed to query it. Because of the way it generates it's output, the two parties do not learn anything about what the other has asked the oracle (unless your game explicitly tells them).