# Can we use a PRF as a PRP?

Leaving aside the problem of how to compute the inverse of a PRF F, may we use it also as a PRP?

The reciprocal of this statement is true, see for instance Katz and Lindell, Proposition 3.27, when the input length of F is sufficiently large. However, in practice to build a PRP from a PRF people use a Feistel network. This would address the problem of making the PRF invertible.

Leaving aside the invertibility I guess the same proof for PRP $$\implies$$ PRF is useful here. Am I right?

• – kelalaka Nov 28 '18 at 10:41
• @kelalaka I already read it. My quesion is not really adressed there – Rodrigo Nov 28 '18 at 10:50
• Didn't you answer your own question by mentioning Feistel networks? – forest Nov 28 '18 at 11:00
• @forest no, because they solve the problem of invertibility, but I say: "leaaving aside the problem of how to compute the inverse of a PRF"... – Rodrigo Nov 28 '18 at 11:09
• @Javier They don't solve the problem of invertibility, they just use a non-invertible PRF to construct an invertible PRP. From Wikipedia, "One advantage of the Feistel model compared to a substitution–permutation network is that the round function $\operatorname{F}$ does not have to be invertible." – forest Nov 28 '18 at 11:11