Some Protocols require one party to send $n$ random challenges (or random values) to another party. For communication efficiency purpose, one can pick a random key for a pseudorandom function, and send only the key to the other party, instead. Given the key and the function, the recipient can generate $n$ (pseudorandom) values locally.

In here (on page 5) it's stated that we cannot prove it in the standard model but can we can do it in random oracle model. However, in here (on page 12-13) it is said we can use block cipher in the counter mode to do that. So it's a bit confusing.

Question: Why cannot we use standard primitives and assumptions to construct a provably secure scheme described above?

  • The outputs of a prf are indistinguishable from random if you do not know the key. Do you see the issue? – Maeher Oct 17 at 15:06

It depends very much on what you require from the random values that are sent. If they need to be random (pseudorandom) then sending the key is a problem. However, if you just need unpredictability, then this may be enough. Bottom line, there is no one answer. It depends on the protocol and requirements, and often is only apparent when doing a formal security proof.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.