Parallel Random Oracle Model

• PROM is a parallel model that extends the Random Oracle Model by structuring computations into rounds with parallel oracle queries and explicit state tracking.
• It introduces precise resource measures such as cumulative memory cost and sustained space complexity to analyze memory-hard functions and sequential work proofs.
• PROM supports security analysis against high-parallel adversaries by linking dynamic pebbling techniques and adaptive oracle scheduling with sequential complexity.

The Parallel Random Oracle Model (PROM) is the usual Random Oracle Model (ROM) enriched with a parallel cost model: algorithms run in rounds; in each round they may issue a batch of oracle queries in parallel; cost is measured in terms of the number of rounds, the total number of oracle queries, and, crucially for memory-hard functions, memory usage per round and its aggregation over time (Blocki et al., 9 Aug 2025). In this formulation, PROM is not merely a notation for “many queries at once.” It is a precise execution model with explicit state, trace semantics, and resource measures, and it has become a central framework for analyzing resistance to highly parallel adversaries such as ASICs and GPUs, for studying proofs of sequential work, and for extending compressed-oracle techniques to parallel-query quantum settings (Blocki et al., 9 Aug 2025, Sur, 2022, Chung et al., 2020).

1. Formal execution semantics

In the PROM formulation used for memory-hardness, a PROM algorithm $A$ has oracle access to a random oracle $H : \{0,1\}^* \to \{0,1\}^w$, is deterministic without loss of generality, and operates in rounds (Blocki et al., 9 Aug 2025). At round $i$, its state is

$\sigma_i = (T_i, q_{i+1}),$

where $T_i$ is the internal state of the machine and $q_{i+1} = [q_1,\dots,q_{\ell_i}]$ is the batch of $\ell_i$ oracle queries to send in parallel at the end of the round. Starting from an initial state $\sigma_0$ encoding the input $X$, the machine performs arbitrary local computation, outputs $(T_i,q_i)$, receives the parallel oracle answers $H : \{0,1\}^* \to \{0,1\}^w$0, and moves to the next configuration $H : \{0,1\}^* \to \{0,1\}^w$1. If at round $H : \{0,1\}^* \to \{0,1\}^w$2 the batch $H : \{0,1\}^* \to \{0,1\}^w$3, the algorithm halts, and the trace is

$H : \{0,1\}^* \to \{0,1\}^w$4

Parallelism is unconstrained in the sense that $H : \{0,1\}^* \to \{0,1\}^w$5 can be large, but only the round count matters for time (Blocki et al., 9 Aug 2025).

This round-based view matches the way PROM is used in proofs of sequential work. In that setting, a prover or adversary may use polynomially many processors and make many random-oracle queries in parallel per round, but sequential time is still counted in rounds (Sur, 2022). The same resource perspective appears in the parallel-query quantum random oracle model, where a $H : \{0,1\}^* \to \{0,1\}^w$6-parallel, $H : \{0,1\}^* \to \{0,1\}^w$7-query algorithm makes at most $H : \{0,1\}^* \to \{0,1\}^w$8 rounds with up to $H : \{0,1\}^* \to \{0,1\}^w$9 inputs per round, for total $i$0 oracle calls (Chung et al., 2020). PROM in this broad sense therefore isolates depth, or sequential dependency, from aggregate query volume.

A related but distinct line of work studies adaptivity of oracle scheduling. One paper does not explicitly mention PROM by name, but formalizes oracle algorithms with multiple oracles $i$1 and distinguishes adaptive scheduling of oracle indices from static scheduling in which the order of oracle types is fixed in advance (Don et al., 2022). There, “static” means non-adaptive in the choice of oracle, not in the choice of query input: inputs can still be chosen adaptively from previous answers (Don et al., 2022). This distinction is highly relevant to PROM-style analyses that reason about round structure or fixed windows of oracle activity.

2. Resource measures: rounds, cumulative memory, and sustained space

PROM differs from classical ROM analysis because it explicitly tracks per-round memory. In the memory-hardness formulation, memory usage at round $i$2 is $i$3, the bit-length of the entire state (Blocki et al., 9 Aug 2025). The two main cost measures are cumulative memory complexity (CMC),

$i$4

and $i$5-sustained space complexity (SSC),

$i$6

Restricted versions on an interval $i$7 are defined analogously (Blocki et al., 9 Aug 2025).

The parameter $i$8 is both the output length of the random oracle and the word size, so storing one node label costs $i$9 bits (Blocki et al., 9 Aug 2025). For memory-hard functions, the sustained-space viewpoint is especially important: informally, strong sustained-space hardness means that any correct PROM algorithm must keep $\sigma_i = (T_i, q_{i+1}),$0 node labels, hence $\sigma_i = (T_i, q_{i+1}),$1 bits, in memory for $\sigma_i = (T_i, q_{i+1}),$2 rounds on each evaluation (Blocki et al., 9 Aug 2025).

CMC and SSC are related but not interchangeable. If a trace has $\sigma_i = (T_i, q_{i+1}),$3-SSC equal to $\sigma_i = (T_i, q_{i+1}),$4, then

$\sigma_i = (T_i, q_{i+1}),$5

Thus high SSC implies high CMC, but not conversely (Blocki et al., 9 Aug 2025). The standard example is Scrypt: the paper states that Scrypt has maximal CMC $\sigma_i = (T_i, q_{i+1}),$6 but admits space–time tradeoffs with low sustained space (Blocki et al., 9 Aug 2025). In other words, a function may force a large total memory-time product without forcing the adversary to lock up a large amount of memory continuously.

In proof-of-sequential-work applications, the same emphasis on rounds appears, but the primary resource is sequential depth rather than memory. A key lemma states that with at most $\sigma_i = (T_i, q_{i+1}),$7 rounds of queries to $\sigma_i = (T_i, q_{i+1}),$8, where in each round one can make arbitrary many parallel queries, the probability of obtaining an $\sigma_i = (T_i, q_{i+1}),$9-sequence $T_i$0 is bounded by

$T_i$1

where $T_i$2 is the number of queries and $T_i$3 their total length (Sur, 2022). This is a PROM-style sequentiality statement: arbitrary parallelism within a round does not remove the need for $T_i$4 sequential rounds.

3. Relation to ROM, PRAM, pebbling, and adaptivity

The contrast between ROM and PROM is structural. In classical ROM analysis one usually counts total queries and overall running time on a sequential machine. PROM instead allows parallel oracle queries per round, measures rounds rather than CPU operations, and explicitly tracks memory usage per round (Blocki et al., 9 Aug 2025). One paper describes the model as PRAM-like: PROM resembles a unit-cost PRAM with free intra-round computation and paid oracle calls; it is a black-box model where the only “hard” operations are calls to $T_i$5 (Blocki et al., 9 Aug 2025).

For static graph-based memory-hard functions, PROM CMC and SSC are tightly linked to parallel black pebbling of the underlying DAG; the 2025 memory-hardness paper summarizes earlier work as showing that one can extract a legal pebbling from any PROM algorithm, and vice versa, up to constants (Blocki et al., 9 Aug 2025). For dynamic graphs, however, such a clean reduction was not known. Prior work used a dynamic pebbling game as a heuristic proxy without a formal PROM justification, and the paper emphasizes that this gap matters because there can be a separation between static pebbling of the ex-post DAG and the true cost of evaluating the dynamic function in PROM (Blocki et al., 9 Aug 2025).

This separation is illustrated with Scrypt. The ex-post static graphs $T_i$6 have low static cumulative pebbling cost $T_i$7, even though any dynamic pebbling strategy has CMC $T_i$8 (Blocki et al., 9 Aug 2025). The paper uses this to argue that static pebbling of $T_i$9 does not capture the true PROM cost for a dynamic function (Blocki et al., 9 Aug 2025). PROM is therefore presented as the “real” model in which an MHF’s resistance to highly parallel adversaries should be judged, while dynamic pebbling remains a combinatorial abstraction (Blocki et al., 9 Aug 2025).

A separate issue is adaptivity across multiple oracles. The adaptive-to-static compiler of (Don et al., 2022) shows that any adaptive $q_{i+1} = [q_1,\dots,q_{\ell_i}]$0-query multi-oracle algorithm can be transformed into a static $q_{i+1} = [q_1,\dots,q_{\ell_i}]$1-query oracle algorithm, functionally equivalent for all stateless instantiations of the oracles. The blow-up is controlled for each oracle individually: if the original algorithm makes at most $q_{i+1} = [q_1,\dots,q_{\ell_i}]$2 queries to oracle $q_{i+1} = [q_1,\dots,q_{\ell_i}]$3, the compiled one makes at most $q_{i+1} = [q_1,\dots,q_{\ell_i}]$4 queries to $q_{i+1} = [q_1,\dots,q_{\ell_i}]$5 (Don et al., 2022). This result does not define PROM, but it is directly relevant to PROM-style proofs that require fixed windows or schedules of oracle activity.

4. PROM and memory-hard functions

The most detailed contemporary PROM treatment in the supplied literature concerns memory-hard functions. A static DAG $q_{i+1} = [q_1,\dots,q_{\ell_i}]$6 together with a random oracle $q_{i+1} = [q_1,\dots,q_{\ell_i}]$7 defines an iMHF by

$q_{i+1} = [q_1,\dots,q_{\ell_i}]$8

for node $q_{i+1} = [q_1,\dots,q_{\ell_i}]$9 with parents $\ell_i$0, and output $\ell_i$1 (Blocki et al., 9 Aug 2025). A dMHF has data-dependent edges and is modeled by a dynamic graph $\ell_i$2, a distribution over DAGs that depend on the input $\ell_i$3 and oracle $\ell_i$4; the ex-post facto DAG for fixed $\ell_i$5 is $\ell_i$6 (Blocki et al., 9 Aug 2025).

The paper studies a standard dynamic construction $\ell_i$7. Starting from a static DAG $\ell_i$8, it appends a line graph on $\ell_i$9 nodes and adds a dynamic incoming edge $\sigma_0$0 to each line node $\sigma_0$1, where $\sigma_0$2 is chosen uniformly from $\sigma_0$3 using randomness derived from the previous label (Blocki et al., 9 Aug 2025). Scrypt’s dynamic graph is identified as $\sigma_0$4, where $\sigma_0$5 is the line graph on $\sigma_0$6 nodes (Blocki et al., 9 Aug 2025).

The key graph properties are fractional depth-robustness and ancestral robustness. The former says that after deleting any set $\sigma_0$7 of at most $\sigma_0$8 nodes, there are still at least $\sigma_0$9 nodes of depth at least $X$0 in $X$1; the latter says that after deleting any set $X$2 of at most $X$3 nodes, there are still at least $X$4 nodes whose induced ancestor subgraph in $X$5 has cumulative pebbling cost at least $X$6 (Blocki et al., 9 Aug 2025). Using these properties, the paper proves a generic PROM SSC/CMC trade-off for any dMHF of the form $X$7: either the evaluator sustains $X$8 space for $X$9 steps, or

$(T_i,q_i)$0

(Blocki et al., 9 Aug 2025).

The specific construction EGSample is introduced as a practical dMHF that does not rely on expensive combinatorial constructions like the earlier Blocki–Holman design (Blocki et al., 9 Aug 2025). EGSample is built from a constant-indegree DAG on $(T_i,q_i)$1 nodes that is both fractionally depth-robust and ancestrally robust with suitable parameters (Blocki et al., 9 Aug 2025). Instantiating the generic PROM theorem yields the stated tradeoff for DEGS, the dynamic version of EGSample: for suitable constants and $(T_i,q_i)$2, any PROM algorithm computing the function either sustains $(T_i,q_i)$3 bits of memory for $(T_i,q_i)$4 rounds or incurs cumulative memory cost

$(T_i,q_i)$5

formally $(T_i,q_i)$6 with slack absorbed into the choice of parameters (Blocki et al., 9 Aug 2025). The abstract summarizes this as: any PROM algorithm evaluating the MHF either “locks up $(T_i,q_i)$7 blocks of memory for $(T_i,q_i)$8 steps” or incurs cumulative memory cost at least $(T_i,q_i)$9 (Blocki et al., 9 Aug 2025).

A central controversy addressed by this work is the status of dynamic pebbling. The paper proves a generic dynamic-pebbling tradeoff and, separately, a direct PROM tradeoff using the same graph properties, but it does not claim that every dynamic pebbling corresponds to a PROM algorithm or vice versa (Blocki et al., 9 Aug 2025). The significance is methodological: the security argument is grounded in PROM rather than in an unproven dynamic-pebbling reduction.

5. Parallel random oracles in proofs of sequential work and quantum models

PROM-style reasoning is also explicit in proofs of sequential work. One paper models a parallel adversary $H : \{0,1\}^* \to \{0,1\}^w$00, where $H : \{0,1\}^* \to \{0,1\}^w$01 performs preprocessing and $H : \{0,1\}^* \to \{0,1\}^w$02 runs in parallel time $H : \{0,1\}^* \to \{0,1\}^w$03 on at most $H : \{0,1\}^* \to \{0,1\}^w$04 processors (Sur, 2022). This is described as exactly the standard PROM-type model: unbounded query fan-out in each round, subject to a polynomial bound, with the number of rounds as the sequential resource (Sur, 2022). The same paper proposes a proof-of-sequential-work whose verifier uses only a single query to the random oracle for each random challenge (Sur, 2022). The result is noteworthy because earlier PoSWs required $H : \{0,1\}^* \to \{0,1\}^w$05 oracle queries per challenge, and the reduction to one round was only possible if the verifier owned $H : \{0,1\}^* \to \{0,1\}^w$06 parallelism (Sur, 2022).

The parallel-query quantum random oracle model is the quantum analogue of PROM. In that setting, a query round allows $H : \{0,1\}^* \to \{0,1\}^w$07 quantum queries in parallel, and over $H : \{0,1\}^* \to \{0,1\}^w$08 rounds the total number of oracle calls is $H : \{0,1\}^* \to \{0,1\}^w$09 (Chung et al., 2020). The compressed-oracle technique is extended to this model, and the paper proves quantum query-complexity bounds for parallel Grover, parallel BHT collision search, and, most directly relevant to sequentiality, the hardness of finding a $H : \{0,1\}^* \to \{0,1\}^w$10-chain with fewer than $H : \{0,1\}^* \to \{0,1\}^w$11 parallel queries (Chung et al., 2020). For chain finding in the simple case $H : \{0,1\}^* \to \{0,1\}^w$12, the success probability of any $H : \{0,1\}^* \to \{0,1\}^w$13-parallel, $H : \{0,1\}^* \to \{0,1\}^w$14-round quantum algorithm to output a $H : \{0,1\}^* \to \{0,1\}^w$15-chain is bounded by

$H : \{0,1\}^* \to \{0,1\}^w$16

(Chung et al., 2020). This is then used to prove that Simple PoSW remains secure against quantum attacks (Chung et al., 2020).

The multi-oracle compiler of (Don et al., 2022) complements these developments by showing how adaptive oracle scheduling can be staticized with only a factor-$H : \{0,1\}^* \to \{0,1\}^w$17 blow-up in per-oracle queries. In applications involving a hash oracle and a second oracle, the paper states that one may assume a static schedule “taking a factor-2 blow-up in the query complexity into account” (Don et al., 2022). This is conceptually close to PROM proofs that partition an adversary’s activity into fixed windows or rounds.

6. Scope, limitations, and open directions

PROM is an idealized black-box model. It treats the hash function as the main resource and tracks memory usage over rounds, which is particularly relevant for parallel adversaries (Blocki et al., 9 Aug 2025). One paper places PROM between idealized black-box models and hardware-aware “full cost” models, noting that I/O or external-memory models focus on bandwidth and cache effects that are often orthogonal to PROM’s focus on oracle-based time and space (Blocki et al., 9 Aug 2025). A plausible implication is that PROM is best understood as a deliberately stylized cost model rather than a complete hardware model.

The current literature also makes its limitations explicit. For dynamic memory-hard functions, there is still no general cost-preserving reduction from dynamic pebbling to PROM algorithms; the recent work sidesteps this by analyzing PROM directly for a rich class of constructions (Blocki et al., 9 Aug 2025). For EGSample/DEGS, the PROM cumulative-memory lower bound is $H : \{0,1\}^* \to \{0,1\}^w$18, not the $H : \{0,1\}^* \to \{0,1\}^w$19 bound achieved heuristically in dynamic pebbling, so tightening that gap remains open (Blocki et al., 9 Aug 2025). The same paper identifies improving the concrete efficiency of fractionally depth-robust and ancestrally robust graphs, and establishing more systematic design principles for dMHFs with provable PROM SSC/CMC lower bounds, as future directions (Blocki et al., 9 Aug 2025).

In the quantum setting, the parallel-query QROM extends PROM-style reasoning to superposition access, but the applicability of the general framework depends on whether the relevant transitions can be recognized by local properties with small classical measures (Chung et al., 2020). This suggests that some PROM lower bounds lift cleanly to quantum parallel query models, whereas others may require new techniques.

Taken together, these developments define PROM not as a single theorem but as a family of closely related oracle models centered on round complexity, parallel query batches, and explicit resource accounting. In its most developed form, PROM is the model in which resistance to highly parallel evaluation is formalized for memory-hard functions (Blocki et al., 9 Aug 2025). In adjacent areas, it provides the natural language for sequentiality lower bounds in proofs of sequential work (Sur, 2022), for staticization of oracle schedules in multi-oracle proofs (Don et al., 2022), and for parallel-query generalizations of compressed-oracle techniques in the quantum random oracle model (Chung et al., 2020).