Tag Info

There is no generic attack that works against all PRFs (for exactly the reasons you mentioned -- if the PRF is secure beyond the birthday bound, there's no attack). There is an attack on many of the specific PRF schemes that are used in practice, precisely because those specific ones are not secure beyond the birthday bound. These attacks involve taking ...