Some Protocols require one party to send $n$ random challenges (or random values) to another party. For communication efficiency purpose, one can pick a random key for a pseudorandom function, and send only the key to the other party, instead. Given the key and the function, the recipient can generate $n$ (pseudorandom) values locally.
In here (on page 5) it's stated that we cannot prove it in the standard model but can we can do it in random oracle model. However, in here (on page 12-13) it is said we can use block cipher in the counter mode to do that. So it's a bit confusing.
Question: Why cannot we use standard primitives and assumptions to construct a provably secure scheme described above?