I've seen that there is several kinds of PRF, and sometimes people speak about strong PRFs.
When proofs of a protocol or algorithm are given based on the assumption of the use of a PRF, are they speak implicitly about strong PRFs?
$\begingroup$
$\endgroup$
1
-
3$\begingroup$ Yes. ${}{}{}\;$ $\endgroup$– user991Commented Nov 9, 2013 at 9:52
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
4
I disagree with the @RickyDemer. The concept of a strong PRF has specific technical meaning and is distinct from a PRF. This can be verified, say, in the Katz-Lindell textbook or by searching for the terms and looking at the lecture notes and papers that turn up. An important case where this distinction comes up is with 3-round versus 4-round Feistel networks. It is also a common exercise to build a PRF that is not a strong PRF.
There is a little variation on usage, as some theoretical crypto papers will only say "PRF" when they mean "strong PRF", but the vast majority distinguish between the terms.
-
$\begingroup$ Thank you for your comment. So, what are the classical schemes that you know that relies on strong PRF ? For instance, does CTR mode rely on strong PRF ? weak PRF ? Thank you. $\endgroup$– Dingo13Commented Jan 31, 2014 at 19:35
-
$\begingroup$ Proving CPA/CCA/AE security of a blockcipher mode is usually done using only PRF - not strong, not weak. (Weak PRF has yet another technical meaning, so there is strong PRF, PRF, and weak PRF.) One place where strong PRFs (which we should be calling strong PRPs) are used is with disk encryption - see e.g. en.wikipedia.org/wiki/Disk_encryption_theory. $\endgroup$ Commented Jan 31, 2014 at 19:47
-
$\begingroup$ Thank you for your prompt reply. Are the properties of weak PRF, PRF and strong PRF inclusives ? In the following sense that a strong PRF has the properties of a PRF, and a PRF has the properties of a weak PRF ? $\endgroup$– Dingo13Commented Jan 31, 2014 at 20:12
-
$\begingroup$ Less theoretic crypto, like many NIST documents, including e.g. NIST SP 800-108 KBKDF use just term PRF, though usually they require strong PRF. $\endgroup$– user4982Commented Jan 31, 2014 at 20:15