Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
In this paper:
https://eprint.iacr.org/2011/272.pdf
the authors use peudorandom permutation in the protocols and proof rather than pseudorandom function. On page 31 (last two lines) they say:
"We also note that for the purposes of the simulation, we need to use a pseudorandom permutation rather than any pseudorandom function."
Question: Why can we use pseudorandom permutation in the simulation but we cannot use pseudorandom function?
I happened to be talking to one of the authors and asked about this. The short answer is: Eventually on page 34 they are considering a malicious adversary. The simulator has to extract the adversary's effective input but it only knows the messages sent by the adversary, which in this case are just the PRP outputs. The simulator knows the PRP key so it can invert the PRP to determine the adversary's effective input. A PRF wouldn't allow this, although a PRF is indeed enough for the semi-honest variant of the protocol starting on page 31.
