# is a MAC defined by a pseudo random generator secure?

Let $G:\{0,1\}^*\rightarrow\{0,1\}^*$ be a length doubling PRG, and let $\Pi=(Gen,Mac,Vrfy)$ be the following MAC scheme:

$Gen$ on input $1^n$ uniformly samples and outputs $k\leftarrow \{0,1\}^n$.

$Mac$ on input $k\in\{0,1\}^n$ and message $m\in \{0,1\}^n$ outputs $t=G(k||m)$.

$Vrfy$ on input $k\in\{0,1\}^n$, message $m\in \{0,1\}^n$ and a tag $t\in \{0,1\} ^{4n}$outputs 1 if $t=G(k||m)$ and outputs 0 otherwirse.

Is $\Pi$ necessarily a secure MAC scheme?

• what kind of secure? – dandavis Apr 9 '17 at 4:11
• ...and what security definition for PRG are you using? – Elias Apr 9 '17 at 19:34
• Adding to @Elias' point, what jumps out to me is that PRG definitions generally stipulate that the output to is secure if the input is sampled uniformly at random from the whole domain. – Luis Casillas May 2 '17 at 22:54