Explanation of protocol secure under random oracle but insecure with any hash fuction It is known that there is a protocol that is secure in the random oracle model, but where any real hash function makes the protocol insecure.  The proof is constructive, but I could not understand the protocol in question.

Could someone explain the protocol in language that is easier for a programmer to understand?
I believe the "simple" examples are of the form

adversary can send honest party arbitrarily-long messages

messages sent by honest parties in that context all start with 0

when an honest party receives a message in that context that

starts with 1, if the rest of that message encodes a circuit then:

The honest party evaluates that circuit and the oracle at a secret value.

If the outputs are equal then the honest party does something obviously insecure.

.



This paper shows that even Fiat-Shamir can fail.