Question: Is there some provably secure hash function to prime numbers?  

Say, a function $H: \{0, 1\}^\* \rightarrow \{e: e \in \{0, 1\}^\lambda \land e$ is prime$\}$  

I'm asking because there are some constructions to be used only on prime numbers (for example [CL02](http://groups.csail.mit.edu/cis/pubs/lysyanskaya/cl02a.pdf) Strong-RSA Dynamic Accumulators).

Answer: 
You could use the hash value as seed for a deterministic CSPRNG and then use a prime number generator also used for RSA key pair generation. Note that the size of the prime number must be relatively high (1536 bits for 128 bits of security, e.g. for an RSA key of 3072 bits).

[The usual caveats of deterministic RSA key pair generation apply](https://crypto.stackexchange.com/q/24514/1172). For instance, the algorithms must remain the same, otherwise a different prime value is calculated for the same hash value.

Generally the method of generating the prime value is available separately in math or crypto libraries that come with the runtime. For instance, Java has the `BigInteger(int bitLength, int certainty, Random rnd)` constructor.

Beware that the time it takes to find a prime is unknown in advance. The generation may take a long time (and in the case of Java may also take a ridiculous number of bytes from the DRBG - just tested this).
I think what makes this difficult is the definition of "secure." Clearly $H(m)=2$ always outputs a prime number, but it is not considered secure.

For it to be "secure," one would expect every prime number to have an equal probability of being chosen, given a random input. Since you can enumerate the prime numbers below a certain value, the problem is isomorphic to a "normal" hash which generates an integer from 0..$\pi(2^\lambda)$ where $\pi$ is a function which counts the number of primes up to a certain value. If you can demonstrate that your normal hash generates unpredictable results with a uniform distribution, then your proof is complete.

However, finding a function for the first $\pi(2^\lambda)$ primes is tricky, especially if $\lambda$ is large.

Potentially of interest is a [paper](https://pdfs.semanticscholar.org/1528/72f15e69e5a1a29e4657c7eb398be2fb97e6.pdf) by Jones, Sato, Wada, and Weins from 1976. In it, they produced a fascinating polynomial of degree 25 in 26 variables which yields a prime number, 1, or a negative number for all non-negative integers. Interestingly, it also generates *every* prime number, so it is guaranteed to contain all $\pi(2^\lambda)$ primes you want.

Of course, that is a 26 variable function, and it makes no guarantees about repeating prime numbers in a non-uniform distribution. But you could in theory find a loop through these numbers which generates every prime number you want. If you could do some massaging to get it into the form of a cyclic group, you could rapidly index through it and generate such numbers efficiently.

However, I do believe that, even if creating such a cyclic group is possible, it would likely require an amount of initial effort proportional to $\pi(2^\lambda)$ at the least. The result might be nice and compact, but generating it would be abysmal.

Generating prime numbers by an equation is fascinatingly difficult. While there is, in theory, a polynomial time solution to your problem, it's not clear how to efficiently determine what that is.