Yes, in BPS, if $F$ is a block cipher, then $f$ is its block width, thus 128 for AES (for all key width variants). That's clear enough in the [paragraph][1] quoted in the question: > We denote by $f$ the number of output bits of the internal function $F$. <sub><sup>(...)</sup></sub> > If $F$ is a $f$-bit block cipher <sub><sup>(...)</sup></sub> > We denote by $F_K(x)$ the application of the block cipher $E$ with the key $K$ on the plaintext $x$ ($F_K(x)=E_K(x)$), <sub><sup>(...)</sup></sub> [1]: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/bps/bps-spec.pdf#page=3