# What is the impact of different modes on pseudo randomness of AES?

AES in CBC-MAC mode is proven to be good PRF . But is there any study done on other modes ? how good is ECB mode as PRF ?

-
I can tell you for sure that in ECB it is NOT a PRF –  Richie Frame Dec 14 '13 at 5:33
@RichieFrame you mean if ecb used as PRF for more than one block u mean ? because below answer says so –  sashank Dec 14 '13 at 16:04

In terms of the question in the title, the mode of operation has no effect at all on the pseudo randomness of the underlying block-cipher. If a block cipher is pseudo random then it is pseudo random, regardless of the mode it is embedded in -- with the caveat that if we differentiate between (weak) CPA-resistant pseudo randomness and (strong) CCA-resistant pseudo randomness, then certain modes may grant the attacker the ability to carry out CCA attacks on a 'weak' underlying block cipher and thus distinguish it from random. So CTR mode would be better in that sense than CBC, because the latter permits the attacker to access the decryption function of the block cipher whereas the former does not.

But you also ask a question about whether modes besides CBC-MAC (for prefix-free inputs) have been proven to be PRFs given the assumption that the underlying block cipher is a PRF. Most provably secure block-cipher-based MAC modes have been proven to be PRFs (since that is the easiest way to prove they are secure MACs). For example, PMAC (http://www.cs.ucdavis.edu/~rogaway/ocb/pmac.pdf), and OMAC (http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/omac/omac-spec.pdf) have been proven to be PRFs if the underlying block cipher is a PRF.

But modes of operation intended to encrypt data, such as CBC, OFB and CTR are not and cannot be PRFs for the very simple reason that they include nonces/IVs that are required to change each time the mode is used in order for the mode to be secure. So that means if you submit the exact same input twice you will get different answers -- which disqualifies them from being 'functions' in the first place. Fixing the IVs or including them as part of the input makes the modes trivially breakable and distinguishable from PRFs.

ECB doesn't have that problem, since there is no IV. But it is also trivially distinguishable from a PRF. Simply submit the message $A||B$, and then submit the message $A||C$, where $A, B, C \in \{0,1\}^{\ell}$ and $\ell$ is the block width of the underlying block cipher. If the Oracle is instantiating ECB then the first response will be $X||Y$ and the second will be $X||Z$ with probability 1 (where $X, Y, Z \in \{0,1\}^{\ell}$). The probability of such an occurrence for a PRF is enormously smaller.

However, it appears that provably secure deterministic modes of authenticated encryption like SIV, with a fixed IV, are indeed PRFs. See http://eprint.iacr.org/2006/221.pdf.

-