The random oracle model seems to be criticized a lot as lacking practical relevance, making wrong predictions, being programmable, etc. However, I have never heard such criticism about the ideal cipher model even though the random oracle and the ideal cipher are equivalent. Therefore, the random oracle model and the ideal cipher model are equivalent. Why is one of them being heavily criticized while the other is not?

  • 4
    $\begingroup$ Perhaps because the ROM is more widely used than the ICM? Also because all criticism of the ROM also implicitly applies to the ICM and "everyone knows this"? $\endgroup$
    – SEJPM
    Commented Mar 18, 2020 at 14:16
  • $\begingroup$ "criticized a lot as lacking practical relevance" Huh? Practical relevance is the one thing the ROM certainly does not lack. $\endgroup$
    – Maeher
    Commented Mar 18, 2020 at 16:43
  • 1
    $\begingroup$ I think he meant "real world relevance" in the sense that a ROM proof does not provably imply "real world security guarantees". Other than that, I second SEJPM's comment. $\endgroup$ Commented Mar 18, 2020 at 23:10


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.