# Pseudo Random Generator (PRG) not deterministic

Usually a Pseudo Random Generator is supposed to be IND-CPA secure.

But apparently, it is not in some cases such as the following:

• A PseudoRandom Generator $$G$$ has expansion factor $$n + 2$$.

• Encrypt $$m \space \in \{0,1\} ^ {n+2}$$

• Choose a random value $$v \leftarrow \{0,1\}^n$$

• Then send $$(v, G(v) \oplus m)$$

The question is why is it not IND-CPA secure and also not IND-EAV secure?

• Sorry, this is probably me, but doesn't have a PRG just have a single input: the seed? I presume we are talking about some stream cipher or PRF here? Otherwise, how can IND-CPA even apply? – Maarten Bodewes Sep 1 '19 at 12:18
• IND-CPA is a property of encryption schemes, not of PRGs. – fkraiem Sep 1 '19 at 23:11
• @MaartenBodewes Acronym mix-up? A PRG (which is different from a PRNG) uses a key and one other input. – Future Security Sep 3 '19 at 0:38
• OK, in that case Wikipedia on PRG seems way off. That might be just Wikipedia though. Alternatively, the cipher based on the PRG called $G$ may not be IND-CPA secure? In that case, what happens if $n=0$ or $n=1$? – Maarten Bodewes Sep 3 '19 at 1:39

a PRG is supposed to generate $$l(n)$$ "pseudo random" bits given $$n$$ "truly random" bits (sampled from the uniform distribution). If a PRG could generate random bits, it could just generate $$l(n)$$ truly random bits and return them as its output, disregarding its input.
I think the question describes an encryption scheme, using some pseudo-random generator $$G$$. The encryption works as follows: upon receiving a message $$m$$ a random vector $$v$$ is drawn and the ciphertext is $$c := (c1, c2) = (v, G(m) \oplus v)$$
Why is it not IND-EAV secure? well, the encryption doesn't even use a key. As $$G$$ is a "public" function, an adversary could simply recover $$m := G(c1) \oplus c2$$ and the scheme is broken.