# What is the difference between a PRF and a PRF+?

What is the difference between a PRF and a PRF+? I am understanding them to mean the same thing, but I imagine that is because I don't understand their differences.

The IKE RFC defines a PRF as:

This pseudorandom function (PRF) takes as input a secret, a seed, and an identifying label and produces an output of arbitrary length.

The TLS 1.2 RFC defines a PRF as:

prf(key, msg) is the keyed pseudo-random function-- often a keyed hash function-- used to generate a deterministic output that appears pseudo-random.

The IKEv2 RFC defines a PRF as:

The PRF is used for the construction of keying material for all of the cryptographic algorithms used in both the IKE SA and the Child SAs.

The IKEv2 RFC defines a PRF+ as:

Since the amount of keying material needed may be greater than the size of the output of the PRF, the PRF is used iteratively. The term "prf+" describes a function that outputs a pseudorandom stream based on the inputs to a pseudorandom function called "prf".

IKEv2 uses the term PRF to refer to a negotiated keyed random-looking function (for example, possibly HMAC-SHA256). IKEv2 uses the term PRF+ to refer to a specific construction based on that underlying negotiated function, as defined in section 2.13:

prf+ is defined as:

prf+ (K,S) = T1 | T2 | T3 | T4 | ...

where:
T1 = prf (K, S | 0x01)
T2 = prf (K, T1 | S | 0x02)
T3 = prf (K, T2 | S | 0x03)
T4 = prf (K, T3 | S | 0x04)
...


The term PRF+ has no generally accepted meaning outside of IKEv2.

• Looks identical to HKDF-Expand. – CodesInChaos Jul 7 '15 at 6:24
• Hi Poncho, thanks for the answer. I am was nearly going to mark it as the right answer, but I'm still not sure I fully understand your answer. I don't suppose you could dumb it down just a bit, write it to a target audience that isn't as well versed in crypto or college math? – Eddie Jul 7 '15 at 13:20
• Also, a follow on question: Is it safe to understand IKEv2's definition of PRF+ and IKEv1/TLS's definition of PRF as to mean the same thing? Are both simply each individual protocol's strategy to create a arbitrary length output which is always identical if starting with identical inputs? – Eddie Jul 7 '15 at 13:20