# Let F be a PRF, how to prove F3 is PRF?

Let $$\operatorname{F}$$ be a $$\operatorname{PRF}$$, how to prove $$\operatorname{F^3_{k_1,k_2}}(x) = \operatorname{F_{k_1}}(x) \oplus \operatorname{F_{k_2}}(x)$$ is aslo a $$\operatorname{PRF}$$?

• @Yehuda Lindell: I understand the point you make, and how it invalidates the answer's argument. But: what if $F_k$ is a PRF that ignores all of its input $k$, except its bit size (e.g. SHA-3 without considering initial state of round constants to be $k$, extended to variable-size output determined by the bit width of $k$)? Then $\operatorname{F^3_{k_1\mathbin\|k_2}}(x) = \operatorname{F_{k_1}}(x) \oplus \operatorname{F_{k_2}}(x)$ is always zero (for $k_1$ and $k_2$ of equal size), thus not a PRF. Is the definition of a PRF violated by my hypothetical PRF? – fgrieu Nov 5 '18 at 8:16