# Is it OK to substitute a PRF for a random oracle?

Random oracles don't exist, but aren't PRFs essentially indistinguishable from them? So why can't we substitute pseudorandom functions wherever we use random oracles?

And if we can do this, why is there any controversy over substituting hash functions for random oracles, when we can instead use pseudorandom functions which do exist and are practically the same as random oracles?

• hash functions are considered PRFs and it's common practice to use PRF (= hash functions) as random oracles. Sample? OAEP. Security proof requires random oracles, which are "instantiated" as hash functions. – SEJPM Jun 3 '15 at 20:51
• PRFs are "essentially indistinguishable from them" to parties that don't know the key. $\hspace{1.26 in}$ – user991 Jun 3 '15 at 21:04

• In fact, there are "constructions that are secure with a Random Oracle, but not secure with any specific" efficiently-computable function, even if that function is not a PRF. $\;$ – user991 Jun 3 '15 at 21:02