# Can any part of AES encrypted blocks be used as PRFed value?

Suppose we need a PRF whose output space is 255bit.

Then, what I can do with AES with 128-bit security is producing 2 AES blocks that are of 256-bit.

Then, I will remove the most significant bit of one block so that I have 255-bit output.

Is it secure if I remove the top-bit of the one block to make it 127-bit?

• AES is supposed to be a PRP. – kelalaka Mar 27 at 13:44
• What is the common practice to implement PRF of arbitrary length output? – user9414424 Mar 27 at 13:45
• Use a good Cryptographic hash function? – kelalaka Mar 27 at 13:46
• @kelalaka a PRP can als be used as a PRF (that's the infamous "PRP-PRF-Switching Lemma") – SEJPM Mar 27 at 13:53
• does my implementation work? – user9414424 Mar 27 at 13:56

This is the tricky part. To compose two PRFs - and AES is assumed to be a PRP which can be used as a PRF if you do less than ~$$2^{64}$$ invocations - you'll need to ensure that for all possible queries the inputs to both calls are unique. Standard ways to achieve this are to use two different, independent keys for the sub-PRFs or to prepend a unique value, e.g. a single fixed bit which is always 0 for the left and always 1 for the right one.
• @kelalaka hmm, I think $\mathbf{Adv}^{\text{PRF}}_{F}\geq \mathbf{Adv}^{\text{PRF}}_{F'}$ (with $F'$ being the truncated PRF) holds (because the truncated adversary naturally has a lower chance to win (?)) – SEJPM Mar 27 at 14:47