Explanation of protocol secure under random oracle but insecure with any hash fuction
I believe the "simple" examples are of the form

adversary can send honest party arbitrarily-long messages

messages sent by honest parties in that context all start with 0

when an honest party receives a message in that context that

starts with 1, if the rest of that message encodes a circuit then:

The honest party evaluates that circuit and the oracle at a secret value.

If the outputs are equal then the honest party does something obviously insecure.

.



This paper shows that even Fiat-Shamir can fail.