Question: Is there some provably secure hash function to prime numbers?  

Say, a function $H: \{0, 1\}^\* \rightarrow \{e: e \in \{0, 1\}^\lambda \land e$ is prime$\}$  

I'm asking because there are some constructions to be used only on prime numbers (for example [CL02](http://groups.csail.mit.edu/cis/pubs/lysyanskaya/cl02a.pdf) Strong-RSA Dynamic Accumulators).

Answer: 
I think what makes this difficult is the definition of "secure." Clearly $H(m)=2$ always outputs a prime number, but it is not considered secure.

For it to be "secure," one would expect every prime number to have an equal probability of being chosen, given a random input. Since you can enumerate the prime numbers below a certain value, the problem is isomorphic to a "normal" hash which generates an integer from 0..$\pi(2^\lambda)$ where $\pi$ is a function which counts the number of primes up to a certain value. If you can demonstrate that your normal hash generates unpredictable results with a uniform distribution, then your proof is complete.

However, finding a function for the first $\pi(2^\lambda)$ primes is tricky, especially if $\lambda$ is large.

Potentially of interest is a [paper](https://pdfs.semanticscholar.org/1528/72f15e69e5a1a29e4657c7eb398be2fb97e6.pdf) by Jones, Sato, Wada, and Weins from 1976. In it, they produced a fascinating polynomial of degree 25 in 26 variables which yields a prime number, 1, or a negative number for all non-negative integers. Interestingly, it also generates *every* prime number, so it is guaranteed to contain all $\pi(2^\lambda)$ primes you want.

Of course, that is a 26 variable function, and it makes no guarantees about repeating prime numbers in a non-uniform distribution. But you could in theory find a loop through these numbers which generates every prime number you want. If you could do some massaging to get it into the form of a cyclic group, you could rapidly index through it and generate such numbers efficiently.

However, I do believe that, even if creating such a cyclic group is possible, it would likely require an amount of initial effort proportional to $\pi(2^\lambda)$ at the least. The result might be nice and compact, but generating it would be abysmal.

Generating prime numbers by an equation is fascinatingly difficult. While there is, in theory, a polynomial time solution to your problem, it's not clear how to efficiently determine what that is.
Relatively prime polynomials are as good as prime numbers sometimes\*.
In such a case, $(1 + ex) \in Z[X]$ are prime for just different $e$ produced with the hash function (collision resistance).

[\*] Set equality testing is an obvious example: just compare two products of polynomials accumulating set elements. Efficient polynomial equality test is crucial, resulting in a nice proof of having a solution to specific sudoku puzzle.
Polynomial graph representation and isomorphism testing is another example.