Embed Notice

@ignaloidas @lynne
Why?

I mean, it's obviously safe in Random Oracle Model, where the only way to learn anything about a hash function's output is to feed it the exact input that produces that output. So knowing some of the bits of the input gives you nothing.

But Random Oracles don't exist IRL, and there are cryptographic schemes that are secure in Random Oracle Model but insecure with any real hash function.

So what is SHA-3 then? A collision-resistant function?