# Are there any real protocols secure in the random oracle model that have been broken in practice?

Has any protocol ever been proven secure in the random oracle model and then broken in practice, despite the use of a good hash function in the actual implementation?

• The Davies-Meyer one way compression function is secure under the ideal cipher model (AFAIK), if that counts. AES, having significant weakness from related key attacks, would be comparatively weak when used with Davies-Meyer. Feb 17 '16 at 9:18

The one real example out there is RMAC. This was proposed in this NIST standard, and was shown to be broken for some instantiations in practice in the paper Analysis of RMAC by Knudsen and Kohno. The construction is proven secure in the random-oracle model in the paper: On the Security of Randomized CBC–MAC Beyond the Birthday Paradox Limit: A New Construction from FSE 2002. (Although, when instantiating with a block cipher it's more like the ideal cipher model.)

Another, less convincing example is to generate a MAC by compute $SHA(K\|M)$ which is vulnerable to extension attacks, but is secure in the random-oracle model. This is less convincing since most people knew that this was vulnerable to extension attacks.