Has any protocol ever been proven secure in the random oracle model and then broken in practice, despite the use of a good hash function in the actual implementation?

  • 1
    $\begingroup$ The Davies-Meyer one way compression function is secure under the ideal cipher model (AFAIK), if that counts. AES, having significant weakness from related key attacks, would be comparatively weak when used with Davies-Meyer. $\endgroup$
    – Daffy
    Commented Feb 17, 2016 at 9:18

1 Answer 1


The one real example out there is RMAC. This was proposed in this NIST standard, and was shown to be broken for some instantiations in practice in the paper Analysis of RMAC by Knudsen and Kohno. The construction is proven secure in the random-oracle model in the paper: On the Security of Randomized CBC–MAC Beyond the Birthday Paradox Limit: A New Construction from FSE 2002. (Although, when instantiating with a block cipher it's more like the ideal cipher model.)

Another, less convincing example is to generate a MAC by compute $SHA(K\|M)$ which is vulnerable to extension attacks, but is secure in the random-oracle model. This is less convincing since most people knew that this was vulnerable to extension attacks.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.