In this paper:
the authors use peudorandom permutation in the protocols and proof rather than pseudorandom function. On page 31 (last two lines) they say:
"We also note that for the purposes of the simulation, we need to use a pseudorandom permutation rather than any pseudorandom function."
Question: Why can we use pseudorandom permutation in the simulation but we cannot use pseudorandom function?