Hash functions are often used in cryptographic schemes and protocols, and that doesn't necessarily mean that their proofs are on the Random Oracle model. That leads to the following question: What is the "turning point" in which the use of a hash function requires a proof on the Random Oracle model?
- Is it when the proofs require observability and/or programmability of the random oracle?
- Is it when it is essential to guarantee a random output?
- Is it related to the usual characteristics of cryptographic hash functions (i.e., pre-image resistance, second pre-image resistance, collision resistance)? If so, how?