Minimizing the use of random oracles in authenticated encryption schemes

A cryptographic scheme is “provably secure” if an attack on the scheme implies an attack on the underlying primitives it employs. A cryptographic scheme is “provably secure in the random-oracle model” if it uses a cryptographic hash function F and is provably secure when F is modeled by a public random function. Demonstrating that a crypto graphic scheme is provably secure in the random-oracle model engenders much assurance in the scheme's correctness. But there may remain some lingering fear that the concrete hash function which instantiates the random oracle differs from a random function in some significant way. So it is good to limit reliance on random oracles. Here we describe two encryption schemes which use their random oracles in a rather limited way. The schemes achieve semantic security and plaintext awareness under specified assumptions. One scheme uses the RSA primitive; another uses Diffie-Hellman. In either case messages longer than the modulus length can be safely and directly encrypted without relying on the hash functions modeled as random-oracles to be good for private-key encryption.