# Are there any real protocols secure in the random oracle model that have been broken in practice?

Has any protocol ever been proven secure in the random oracle model and then broken in practice, despite the use of a good hash function in the actual implementation?

• The Davies-Meyer one way compression function is secure under the ideal cipher model (AFAIK), if that counts. AES, having significant weakness from related key attacks, would be comparatively weak when used with Davies-Meyer. – Daffy Feb 17 '16 at 9:18

Another, less convincing example is to generate a MAC by compute $SHA(K\|M)$ which is vulnerable to extension attacks, but is secure in the random-oracle model. This is less convincing since most people knew that this was vulnerable to extension attacks.