# Pseudo Random Function

The definition of pseudo randomness that leads to pseudo random function talks about indistingishability of a key-ed function and a random function.

i.e. The key-ed function family $\{F_k\}$ is PRF if $|Pr[D^{F_k}(1^n)=1] - Pr[D^{f}(1^n)=1]|$ is negligible for $k\leftarrow\mathcal{K}$ and $f\leftarrow\mathcal{F}$.

Informally the output of both the function $F_k$ and $f$ at polynomial many points follows same distribution. Since $f$ is a random choice of random function family, $\{f(x)\}$ is uniformly random.

So can I use output $F_k(x)$ as the key to same PRF in next iteration? i.e. say $k1=F_k(x)$ and I can compute $k2=F_{k1}(x)$. But will $\{F_{k1}\}$ still be a PRF?

• The pseudorandomness of $F^2_k(x) = F(F(k,x),x)$ (or in general of $F^{\mathrm{poly}(n)}_k(x)$) looks like something that could be proved with the hybrid method... It's probably not very useful, however. – fkraiem Aug 1 '15 at 12:43

Well, yes, but you cannot use the key $k_1$ for anything else because knowledge of $k_1$ would mean that an attacker can simply calculate $k_2$. If an attacker can find a direct relation between parts of the output then the function is of course not pseudo random anymore. So although it is possible it seems pretty useless to me.
Even if you would not directly use $k_1$ as output you would need to prove that you use it in such a way that security is not compromised. In general you should try to not reuse keys for different purposes.