# Why a pseudorandom permutation is used in a simulation based proof but pseudorandom function is not?

In this paper:

https://eprint.iacr.org/2011/272.pdf

the authors use peudorandom permutation in the protocols and proof rather than pseudorandom function. On page 31 (last two lines) they say:

"We also note that for the purposes of the simulation, we need to use a pseudorandom permutation rather than any pseudorandom function."

Question: Why can we use pseudorandom permutation in the simulation but we cannot use pseudorandom function?

• I only read the abstract, but my guess is that the reason is $\hspace{2.35 in}$ "Pseudorandom functions usually have collisions.". ​ ​
– user991
Sep 7, 2016 at 22:15