Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

AES in CBC-MAC mode is proven to be good PRF . But is there any study done on other modes ? how good is ECB mode as PRF ?

share|improve this question
I can tell you for sure that in ECB it is NOT a PRF – Richie Frame Dec 14 '13 at 5:33
@RichieFrame you mean if ecb used as PRF for more than one block u mean ? because below answer says so – sashank Dec 14 '13 at 16:04
up vote 3 down vote accepted

In terms of the question in the title, the mode of operation has no effect at all on the pseudo randomness of the underlying block-cipher. If a block cipher is pseudo random then it is pseudo random, regardless of the mode it is embedded in -- with the caveat that if we differentiate between (weak) CPA-resistant pseudo randomness and (strong) CCA-resistant pseudo randomness, then certain modes may grant the attacker the ability to carry out CCA attacks on a 'weak' underlying block cipher and thus distinguish it from random. So CTR mode would be better in that sense than CBC, because the latter permits the attacker to access the decryption function of the block cipher whereas the former does not.

But you also ask a question about whether modes besides CBC-MAC (for prefix-free inputs) have been proven to be PRFs given the assumption that the underlying block cipher is a PRF. Most provably secure block-cipher-based MAC modes have been proven to be PRFs (since that is the easiest way to prove they are secure MACs). For example, PMAC (, and OMAC ( have been proven to be PRFs if the underlying block cipher is a PRF.

But modes of operation intended to encrypt data, such as CBC, OFB and CTR are not and cannot be PRFs for the very simple reason that they include nonces/IVs that are required to change each time the mode is used in order for the mode to be secure. So that means if you submit the exact same input twice you will get different answers -- which disqualifies them from being 'functions' in the first place. Fixing the IVs or including them as part of the input makes the modes trivially breakable and distinguishable from PRFs.

ECB doesn't have that problem, since there is no IV. But it is also trivially distinguishable from a PRF. Simply submit the message $A||B$, and then submit the message $A||C$, where $A, B, C \in \{0,1\}^{\ell}$ and $\ell$ is the block width of the underlying block cipher. If the Oracle is instantiating ECB then the first response will be $X||Y$ and the second will be $X||Z$ with probability 1 (where $X, Y, Z \in \{0,1\}^{\ell}$). The probability of such an occurrence for a PRF is enormously smaller.

However, it appears that provably secure deterministic modes of authenticated encryption like SIV, with a fixed IV, are indeed PRFs. See

share|improve this answer

Yes, of course other modes have been studied.

See this paper for one study, and that paper for another study.

The bottom line is that CFB, OFB and CTR modes are also good PRFs (assuming you use random IVs).

As for ECB mode, it is a good PRF if you limit it to inputs of precisely one block (128 bits for AES); it is not a good PRF if you are allowed to submit larger inputs.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.