Questions tagged [pseudo-random-function]

A pseudo-random function (PRF) is a family of deterministic functions indexed by a parameter, such that a randomly selected instance is computationally indistinguishable from a uniformly random function with the same input and output spaces.

Filter by
Sorted by
Tagged with
4
votes
2answers
959 views

Is pseudorandom function also a one-way function?

Can I assume this? Specifically, I want to know if the following two cases are valid. Suppose $prf_k(m)=c$ One-wayness: Only given $c$, we cannot reveal $m$. Without key $k$, even given $m$, cannot ...
1
vote
1answer
57 views

Deriving a Set of Seeds from a Seed

I need a set of seeds $S=\{s_1,..., s_n\}$, for pseudo-random function where seed $s_i$ is used to generate a set of pseudo-random values. Obviously I need to be able to regenerate the sets of pseudo-...
2
votes
1answer
52 views

Data Switching and Information Leakage

Hypothesis: Let $z,a$ be uniformly random elements of a field $\mathbb{F}_p$ where $p$ is a large prime number. Also, let $(-z)$ be additive inverse of $z$. I have a fixed secret value $x$. I mask it ...
2
votes
1answer
256 views

Modified version of a CPA-secure encryption scheme

The following encryption scheme: choose a random string $r \leftarrow \{0,1\}^n$ and compute the ciphertext $c= \thinspace <c_0, c_1>= \thinspace <r, F_k(r) \oplus m>$, assuming $F$ a PRF; ...
2
votes
1answer
162 views

Crypto-period for keys used in PRF

I am wondering about the crypto-period for keys used in pseudo-random functions. For example, let's say I am using HMAC-SHA256 with a secret key $K$. After how many computes do I have to update $K$?
4
votes
2answers
301 views

A periodic PRNG based on hash function?

I need a PRNG which provides 128 bytes numbers. Let's say that given a symmetric key $K$ and an internal state $s$ I use the PRF HMAC-SHA512 this way: The output is PRNG($K, s$) = HMAC-SHA512$_K$($s$...
3
votes
2answers
428 views

Does CTR mode yield a PRF?

Can the keystream generated by CTR mode be considered a pseudo-random function? I give more information. Assume $f$ is a PRF. We define a function which takes 2 inputs, the desired length, and an ...
1
vote
1answer
202 views

Random Function size

I am new to cryptography. I have question regarding the size of the set of random functions. I found the text from "Introduction to modern cryptography" by Katz and Lindell, in another thread which ...
2
votes
3answers
521 views

Let $F$ be a PRF, is the following $G(x)=F_{0…0}(x)∥F_{0…1}(x)|| … ||F_{1…1}(x)$ a PRG?

This exercise comes from Coursera's "Cryptography" course. Let $F$ be a PRF, is the following $G(x)=F_{0…0}(x)∥F_{0…1}(x)|| ... ||F_{1…1}(x)$ a PRG? $F$ is a PRF with $n$ bit key, input, and ...
5
votes
2answers
4k views

How to prove that a function is not pseudorandom?

I am currently enrolled in a cryptography course, which uses the book by Katz and Lindell. I'm struggling with the exercies which ask for proofs, like the following one: Let G(k) be a PRG with |k| ...
3
votes
0answers
69 views

Proving existence of an encryption scheme that has indistinghuishable multiple encryptions in the presence of an eavesdropper, but is not CPA-secure [duplicate]

I got stuck in trying to find a solution to the 3.7 exercise of the Katz-Lindell book. The exercise also assumes the existence of a pseudorandom function. The problem is that a multiple messages ...
2
votes
1answer
150 views

Does pseudorandom secret sharing require a central dealer?

I'm trying to figure out whether pseudorandom secret sharing (as described in this paper) requires a central dealer, i.e. one party who doles out keys to the other players and thus who would be able ...
-1
votes
1answer
160 views

Shuffleless PRNG function with non-repeating values?

I need a simple PRNG function of type: Integer = PRNG(n, maxval) as I would like to count from 0 to maxval, not in a linear manner, but in a pseudorandom manner where I still use every value, but ...
1
vote
2answers
147 views

Pseudorandom functions: how are functions stored?

I am wondering about the setup for testing if a function family is pseudorandom. We step into a room, and query the black box with $x$, which yields $f(x)$, etc... We don't know if $f$ is a random ...
3
votes
1answer
2k views

What is the difference between a PRF and a PRF+?

What is the difference between a PRF and a PRF+? I am understanding them to mean the same thing, but I imagine that is because I don't understand their differences. The IKE RFC defines a PRF as: ...
1
vote
1answer
119 views

The encryption scheme is secure?

I have a scheme and I don't know that this scheme is semantic security or not. Secret keys $\{s_1,s_2, x_1,x_2\}$ and public parameter $p$ (large prime number). Encryption E(m): $C_1 = s_1m + x_1k \...
2
votes
1answer
232 views

Pseudo Random Function

The definition of pseudo randomness that leads to pseudo random function talks about indistingishability of a key-ed function and a random function. i.e. The key-ed function family $\{F_k\}$ is PRF ...
2
votes
2answers
630 views

Cryptanalysis of Marvin32 compared to SipHash

So I am curious about the security analysis of Marvin32, the randomized hash algorithm used in .NET (to prevent hash-table DoS). I found the source code here: ...
3
votes
1answer
517 views

Is it OK to substitute a PRF for a random oracle?

Random oracles don't exist, but aren't PRFs essentially indistinguishable from them? So why can't we substitute pseudorandom functions wherever we use random oracles? And if we can do this, why is ...
0
votes
1answer
238 views

What is the difference between H(M) and H3(M, s, IDA)? [closed]

What is the difference between H(M) and H3(M, s, IDA)? I am aware of Hash function with a Message and a Key, but there are three parameters in: H3(M, s, IDA). Here M is the message, s is the key, ...
2
votes
1answer
168 views

Permuted vectors

Consider we have two vectors $v_1, v_2$ of size $n$, and each vector contains $n$ elements. We permute the vectors as: $\pi (k_1,v_1), \pi (k_2,v_2)$. Where $\pi (k_i,v)$ denotes a permutation of a ...
0
votes
1answer
204 views

Swap $x$ and $k$ in GGM construction

I'm studying the Goldreich-Goldwasser-Micali construction from pseudo-random generators to pseudo-random functions. In this specific construction, assume $G:\{0,1\}^n\rightarrow \{0,1\}^{2n}$ is a PRG,...
0
votes
1answer
104 views

Is $f\colon x\mapsto g(x+1)$ necessarily a pseudorandom function?

Let $l\in\mathbb N$ and suppose $$g\colon\;\{0,1\}^l\to\{0,1\}^l$$ is a pseudorandom function. Is $f$, defined as below, necessarily a pseudorandom function as well? $$f(x)=g((x+1)\bmod2^l)$$
2
votes
0answers
350 views

Pseudorandom Function Proof

Given a set of pseudorandom functions $F=\{f_s^i\}_i$ for each $s\leftarrow\{0,1\}^n$ generated at random; moreover each $f_s^i$ uses a specific PRG $G^i:\{0,1\}^n\to\{0,1\}^{2n}$, where: $G^i(s)=x_1\...
0
votes
0answers
130 views

Making PRFs out of PRGs

Is it possible that we take a $PRG$ $G(k)$ of stretch $n\cdot2^n$, and read its output as the table of a $PRF$ $F(K)$ with input and output size of $n$? Intuitively it sounds possible however I read ...
1
vote
2answers
887 views

Is Pseudo-Random Generator (PRG) in OpenSSL uniformly distributed?

I need to know can we use PRG of OpenSSL as a PRF?
1
vote
1answer
396 views

Pseudorandom function library [closed]

I'm wondering if there is any library supporting pseudo-random function, so I can specify the key length and output domain. Is it correct that I need to use a block cipher for this purpose? Any ...
1
vote
1answer
745 views

PRF based on the GGM construction

What's the differences between the concepts “pseudorandom generator” and “pseudorandom number generator”? In fact, I want to implement a pseudorandom function based on GGM's construction at http://...
1
vote
1answer
4k views

What is the difference between a hash function and a pseudorandom function? [duplicate]

Read the title. I've seen in RFCs that some MAC functions are called "pseudorandom functions". What are those? How are they different than hash functions? Why can't a hash function be used instead?
3
votes
0answers
102 views

Pollard's Rho - Restricting the random function to the exponents

Pollard's Rho is usually constructed using a function $f:G \rightarrow G$ which behaves 'random enough' in order to detect a collision with Floyd's cycle detection trick. It is easy enough to observe, ...
3
votes
4answers
2k views

Difference between Pseudorandom Function vs randomly chosen function

I am currently going through a course in cryptography. In this, I stumbled upon Pseudorandom Functions. I got a little idea of Pseudorandom Generators which map an input string (key) to an extended ...
5
votes
2answers
1k views

Proving the existence of a pseudorandom function

I've been reading the Introduction to Modern Cryptography book by Katz and Lindell as part of my own learning and have come across this exercise which I am not sure how to approach. The exercise is: (...
1
vote
0answers
580 views

Implementing a pseudo random function in practice

Can anyone point me to a C++ crypto library with an implementation of a pseudo random function (PRF)? I don't have much background in crypto theory, but I am in the middle of a graduate course ...
1
vote
1answer
423 views

INT_32_BE in PBKDF2

Trying to understand PBKDF2 in detail. It is clear that the password and the salt is given to the PRF (which is HMAC-SHA-1 in the specification). But what is the role of the INT_32_BE(i)? What does it ...
4
votes
1answer
608 views

CBC-MAC based on PRF

Why is the block cipher in the CBC-MAC taken to be a pseudo random permutation (PRP) and not a pseudo random function (PRF)? We don't need the bijective property of the PRP. So why go with it?
10
votes
1answer
5k views

Luby-Rackoff theorem confusion

The Luby-Rackoff theorem states that if a round function is a secure pseudorandom function (PRF) then 3 rounds are sufficient to make the block cipher a pseudorandom permutation (PRP). PRPs are ...
2
votes
1answer
424 views

CTR mode encryption using PRG

In CTR mode encryption, the encryption block is not required to be invertible. Thus, a PRF can be used instead of a PRP. However most of the implementations of CTR mode are based on AES which is a PRP....
2
votes
2answers
817 views

Skein or Keccak stream cipher construction

I am wondering if using Skein or the Keccak hash algorithm in this construction (as a stream cipher) is secure: $H$ = Keccak or Skein hash with a 256 bit output $K$ = The main 256 bit random key, pre-...
5
votes
1answer
163 views

Turning PRPs in PRGs with a counter

I am following the Coursera Cryptography I course and I have the following question, I am a bit perplexed by the statement, in week 2 lecture "What are block cyphers?" that a counter-mode PRF is a ...
2
votes
1answer
749 views

Is a keyed PRF a MAC?

I remember I read that a MAC can be considered as a PRF. Can a variable-length input keyed-PRF be considered as a MAC?
4
votes
1answer
173 views

Cryptographic pseudo-random generation of address subsets

Suppose I have devices which broadcast, on an insecure channel, 32-bit addresses. I want to make these devices untraceable - one way to do so is to allocate for each device a distinct subset of ...
2
votes
0answers
107 views

Special random distribution algorithm

I am implementing ring signatures as a part of an authorization system. Since the number of users could get high enough to make computation on end-user devices infeasible, I am thinking of "...
10
votes
1answer
3k views

Is there a difference between PRF and a hash function?

Is there a difference between PRF and a hash function? For example: Creation of a secret key is using PRF and creating a secret key is using hash function.
0
votes
1answer
486 views

How to implement a Cryptographic Pseudo Random Function

I need three pseudo random functions which all take a seed S (t-bits long). The functions should map from $d$ bits to $d$ bits $d$ bits to $1$ bit $d$ bits to $t$ bits $d$ is $10$ bits $t$ is $...
16
votes
1answer
4k views

Security of KDF1 and KDF2 (hash based KDF's)

It's still common to come across implementations of KDF1 and KDF2. Basically these are KDF's that simply derive multiple keys from the key seed and a counter: $K_i = \operatorname{KDF}(K_{master}, i) ...
1
vote
1answer
127 views

Exchanging Keyspace and Message space in PRF

Suppose there is a secure PRF $F: K \times X \to Y$. Then is $F': X \times K \to Y$, defined by $F'(x,k):=F(k,x)$, a secure PRF? In my opinion it should be because exchanging the keyspace with the ...
5
votes
2answers
723 views

What is the difference between PRF and a Random Oracle?

What is the difference between Pseudo Random Functions and Random Oracles? Is the difference only about the domain of PRFs and Random Oracles, former having a fixed domain and latter can act on any ...
4
votes
1answer
6k views

TLS Key Block calculation - What is a PRF?

In Section 6.3 of the RFC for TLS 1.2, it is written that the key_block is derived from the following formula: ...
1
vote
1answer
2k views

HKDF vs TLS PRF. Which of the one is better? [closed]

Which of the one (HKDF or TLS1.1+ PRF) is more secure and why?
10
votes
0answers
301 views

What might be assumed about a PRF if the key has been chosen?

The defining feature of a PRF $f:\{0,1\}^k\times\{0,1\}^s\mapsto\{0,1\}^*$ is that, if the first parameter is selected at random, it should be indistinguishable from a function $g:\{0,1\}^s\mapsto\{0,...