# May I use Random Oracle for Inversed Look-up?

Consider there is a protocol in real world calling a random oracle $\mathcal{H}$ for a priavte input $k$. Then in the ideal world, after the calling of $r \leftarrow \mathcal{H}(k)$ by a honest party, can the simulator extract $k$ from $r$, if the behavior of $\mathcal{H}$ is as follows:

• When $k$ is new, record $(k, r \leftarrow_R \{0,1\}^\lambda)$ in the inner storage and then return $r$;
• When $k$ has been asked (by checking the inner storage), return the corresponding $r$.

I envisage to extract $k$ from $r$ also by checking the inner storage, but is it a correct usage of random oracle?

In your example you must be sure that the simulation does something reasonable when the adversary outputs a value $r$ that is not the result of any call to the oracle.