Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've seen that there is several kinds of PRF, and sometimes people speak about strong PRFs.

When proofs of a protocol or algorithm are given based on the assumption of the use of a PRF, are they speak implicitly about strong PRFs?

share|improve this question
Yes. ${}{}{}\;$ – Ricky Demer Nov 9 '13 at 9:52
Thank you both for the answer and edit of the question. – Dingo13 Nov 9 '13 at 14:23

I disagree with the @RickyDemer. The concept of a strong PRF has specific technical meaning and is distinct from a PRF. This can be verified, say, in the Katz-Lindell textbook or by searching for the terms and looking at the lecture notes and papers that turn up. An important case where this distinction comes up is with 3-round versus 4-round Feistel networks. It is also a common exercise to build a PRF that is not a strong PRF.

There is a little variation on usage, as some theoretical crypto papers will only say "PRF" when they mean "strong PRF", but the vast majority distinguish between the terms.

share|improve this answer
Thank you for your comment. So, what are the classical schemes that you know that relies on strong PRF ? For instance, does CTR mode rely on strong PRF ? weak PRF ? Thank you. – Dingo13 Jan 31 '14 at 19:35
Proving CPA/CCA/AE security of a blockcipher mode is usually done using only PRF - not strong, not weak. (Weak PRF has yet another technical meaning, so there is strong PRF, PRF, and weak PRF.) One place where strong PRFs (which we should be calling strong PRPs) are used is with disk encryption - see e.g. – David Cash Jan 31 '14 at 19:47
Thank you for your prompt reply. Are the properties of weak PRF, PRF and strong PRF inclusives ? In the following sense that a strong PRF has the properties of a PRF, and a PRF has the properties of a weak PRF ? – Dingo13 Jan 31 '14 at 20:12
Less theoretic crypto, like many NIST documents, including e.g. NIST SP 800-108 KBKDF use just term PRF, though usually they require strong PRF. – user4982 Jan 31 '14 at 20:15
Thanks @user4982 – Dingo13 Jan 31 '14 at 22:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.