A PRF can be used both to generate a key stream for use in a stream cipher, and to construct a MAC to authenticate. The two can then be combined e.g. in a generic encrypt-then-MAC construction to create an authenticated stream cipher, using the same PRF for both (with independent keys). Is this actually done in any real-world authenticated encryption scheme? I see constructions like Salsa20/ChaCha20 stream ciphers combined with Poly1305 (a secure MAC, but not a PRF). Presumably you could combine ChaCha20 with Blake2, which is based on the same round function internally, but even here there are differences in the PRF (as I understand it). Are there any real-world cases where exactly the same PRF is used for both? If not, is there a reason why not?
One similar real-world construction I can think of is CCM mode where the same block cipher (e.g. AES) is used both in CBC-MAC and then in CTR mode. This provides some code size advantages as the same code can be used for both operations (and you only need the encrypt direction of AES too). Presumably similar arguments could be made for an authenticated stream cipher that used the same PRF for both key stream generation and MAC.
