10
$\begingroup$

Has any protocol ever been proven secure in the random oracle model and then broken in practice, despite the use of a good hash function in the actual implementation?

Improve this question
$\endgroup$
1
  • 1
    $\begingroup$ The Davies-Meyer one way compression function is secure under the ideal cipher model (AFAIK), if that counts. AES, having significant weakness from related key attacks, would be comparatively weak when used with Davies-Meyer. $\endgroup$
    – Daffy
    Feb 17, 2016 at 9:18

1 Answer 1

Reset to default
11
$\begingroup$

The one real example out there is RMAC. This was proposed in this NIST standard, and was shown to be broken for some instantiations in practice in the paper Analysis of RMAC by Knudsen and Kohno. The construction is proven secure in the random-oracle model in the paper: On the Security of Randomized CBC–MAC Beyond the Birthday Paradox Limit: A New Construction from FSE 2002. (Although, when instantiating with a block cipher it's more like the ideal cipher model.)

Another, less convincing example is to generate a MAC by compute $SHA(K\|M)$ which is vulnerable to extension attacks, but is secure in the random-oracle model. This is less convincing since most people knew that this was vulnerable to extension attacks.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.