When is the Random Oracle model (not) necessary? Hash functions are often used in cryptographic schemes and protocols, and that doesn't necessarily mean that their proofs are on the Random Oracle model. That leads to the following question: What is the "turning point" in which the use of a hash function requires a proof on the Random Oracle model?


Is it when the proofs require observability and/or programmability
of the random oracle?
Is it when it is essential to guarantee a random output?
Is it related to the usual characteristics of cryptographic hash functions (i.e., pre-image resistance, second pre-image resistance, collision resistance)? If so, how?
A hash's security in the Random Oracle Model implies its collision-resistance, first-preimage resistance, and second-preimage resistance. In addition, security in the ROM implies that the hash's output is indistinguishable from random for an adversary without knowledge of the input, and that the hash is resistant to length-extension attack, neither of which is implied by collision-resistance, first-preimage resistance, or second-preimage resistance. So when randomness or length-extension matters, a hash secure in the ROM is useful in practice, and therefore in formal proofs.

Rigorous formal proofs of protocols often are easier with a hash secure in the ROM than with some weaker hypothesis. I pass at characterizing exactly when the ROM is indispensable, and if that's related to observability and/or programmability of the random oracle.