1
$\begingroup$

I've seen that there is several kinds of PRF, and sometimes people speak about strong PRFs.

When proofs of a protocol or algorithm are given based on the assumption of the use of a PRF, are they speak implicitly about strong PRFs?

$\endgroup$
  • 3
    $\begingroup$ Yes. ${}{}{}\;$ $\endgroup$ – user991 Nov 9 '13 at 9:52
2
$\begingroup$

I disagree with the @RickyDemer. The concept of a strong PRF has specific technical meaning and is distinct from a PRF. This can be verified, say, in the Katz-Lindell textbook or by searching for the terms and looking at the lecture notes and papers that turn up. An important case where this distinction comes up is with 3-round versus 4-round Feistel networks. It is also a common exercise to build a PRF that is not a strong PRF.

There is a little variation on usage, as some theoretical crypto papers will only say "PRF" when they mean "strong PRF", but the vast majority distinguish between the terms.

$\endgroup$
  • $\begingroup$ Thank you for your comment. So, what are the classical schemes that you know that relies on strong PRF ? For instance, does CTR mode rely on strong PRF ? weak PRF ? Thank you. $\endgroup$ – Dingo13 Jan 31 '14 at 19:35
  • $\begingroup$ Proving CPA/CCA/AE security of a blockcipher mode is usually done using only PRF - not strong, not weak. (Weak PRF has yet another technical meaning, so there is strong PRF, PRF, and weak PRF.) One place where strong PRFs (which we should be calling strong PRPs) are used is with disk encryption - see e.g. en.wikipedia.org/wiki/Disk_encryption_theory. $\endgroup$ – David Cash Jan 31 '14 at 19:47
  • $\begingroup$ Thank you for your prompt reply. Are the properties of weak PRF, PRF and strong PRF inclusives ? In the following sense that a strong PRF has the properties of a PRF, and a PRF has the properties of a weak PRF ? $\endgroup$ – Dingo13 Jan 31 '14 at 20:12
  • $\begingroup$ Less theoretic crypto, like many NIST documents, including e.g. NIST SP 800-108 KBKDF use just term PRF, though usually they require strong PRF. $\endgroup$ – user4982 Jan 31 '14 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.