Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Random oracles don't exist, but aren't PRFs essentially indistinguishable from them? So why can't we substitute pseudorandom functions wherever we use random oracles?
And if we can do this, why is there any controversy over substituting hash functions for random oracles, when we can instead use pseudorandom functions which do exist and are practically the same as random oracles?
Yes, when we're instantiating some crypto primitive that says 'insert Random Oracle here', we will in practice insert a PRF.
Now, you ask, why is that even slightly controversal? Well, there are known constructions that are secure with a Random Oracle, but not secure with any specific PRF, see this paper for an example. This has been taken by some as proof that the Random Oracle model ought not be trusted at all (as proof within that model need not apply in the real world).
On the other side of the argument, other people have pointed out that these constructions are highly artificial, and that attempts to avoid the Random Oracle model has resulted in worse security at times; see this paper to see this argument spelled out.
