Questions tagged [pseudo-random-function]

A pseudo-random function (PRF) is a family of deterministic functions indexed by a parameter, such that a randomly selected instance is computationally indistinguishable from a uniformly random function with the same input and output spaces.

A pseudorandom function family is a finite set of deterministic functions that share the same given (finite) input and output spaces, indexed by a parameter which selects the exact function. Pseudorandomness is achieved if an instance of the family, obtained with a uniformly random selection of the index parameter, is computationally indistinguishable from a function selected at random and uniformly among the whole set of possible deterministic functions with the same input and output spaces.

PRF are most useful when they are efficiently computable. There is no theoretical guarantee that PRF can really exist, but many candidates are known, which cannot be distinguished from random functions with non-negligible probability by attackers with finite computing power. A common example is HMAC/SHA-256; the key is then the selection parameter, with a size large enough to thwart exhaustive search.

454 questions
41
votes
4 answers

What is difference between PRG, PRF, and PRP

Until what I have gotten is: A PRG is generator is a part of PRF that produces pseudo-random values for the function. PRF is semantically secure and has no worries of being invertible. Fine, then where is PRP used? What is PRP, where it comes to,…
32
votes
6 answers

What is the practical impact of using System.Random which is not cryptographically random?

I recently noticed a .NET software using PBKDF to derive an encryption key from a password string. This password string was dynamically generated using System.Random. Now, I know that System.Random is not really cryptographically random and should…
19
votes
3 answers

What is the difference between PRF and a Random Oracle?

What is the difference between Pseudo Random Functions and Random Oracles? Is the difference only about the domain of PRFs and Random Oracles, former having a fixed domain and latter can act on any input as long as it is well formatted? Having a…
Human
  • 301
  • 2
  • 5
16
votes
1 answer

Security of KDF1 and KDF2 (hash based KDF's)

It's still common to come across implementations of KDF1 and KDF2. Basically these are KDF's that simply derive multiple keys from the key seed and a counter: $K_i = \operatorname{KDF}(K_{master}, i) = \operatorname{H}(K_{master} | c)$ In this…
Maarten Bodewes
  • 96,351
  • 14
  • 169
  • 323
15
votes
3 answers

Expected entropy in $P(x)\oplus x$ for random $x$, where $P$ is a random permutation

Let $P$ be a random permutation of $n>1$ bits. Let $F$ be the function on the same domain $\{0,1\}^n$, defined by $F(x)=P(x)\oplus x$. When $P$ is a block cipher with key a message block, that's the Davies-Meyer construction of a one-way compression…
fgrieu
  • 149,326
  • 13
  • 324
  • 622
14
votes
1 answer

Is there a difference between PRF and a hash function?

Is there a difference between PRF and a hash function? For example: Creation of a secret key is using PRF and creating a secret key is using hash function.
user13342
  • 141
  • 1
  • 3
14
votes
5 answers

Does Grover's algorithm really threaten symmetric security proofs?

By Shannon's theorem of perfect security, if I give you a ciphertext 'LOUPL', you can do a brute-force attack and then you would find plaintexts like 'HELLO', 'APPLE', 'SPOON', but you can't distinguish the true plaintext from the fake one, unless…
13
votes
3 answers

How to construct a good PRF from a block cipher?

We want to explicitly construct a good (as tentatively defined below) Pseudo-Random Function $F$ with $b$-bit input and output, from (preferably just) one Pseudo-Random Permutation $E$ of $b$-bit, as instantiated in practice by TDEA for $b=64$ or…
fgrieu
  • 149,326
  • 13
  • 324
  • 622
13
votes
1 answer

Luby-Rackoff theorem confusion

The Luby-Rackoff theorem states that if a round function is a secure pseudorandom function (PRF) then 3 rounds are sufficient to make the block cipher a pseudorandom permutation (PRP). PRPs are invertible whereas PRFs are not. How come 3 rounds of a…
12
votes
2 answers

What is the sponge construction in simple terms?

I suggested to my client to use SHA3 instead of SHA2. I know that SHA3 is based on Keccak algorithm which won the NIST's competition. I want to explain the structure of sponge functions in very simple terms; does anybody have a simple explanation of…
Sam Claro
  • 121
  • 1
  • 3
12
votes
1 answer

Does IND-CPA imply PRF?

It is well-known that a pseudorandom function (PRF) can be used to build a CPA-secure symmetric cryptosystem. My question: is PRF necessary for this, i.e., can one show something like "If there exists an IND-CPA scheme then there exist PRF?"
12
votes
1 answer

Cryptographic security of PHP mt_rand() function using Mersenne Twister algo

At StackOverflow, this question has been asked. It uses additional random entropy and a hash method (among others) to try and create a cryptographically secure pseudo-random number generator for PHP. PHP seems to use a Mersenne Twister algorithm…
Maarten Bodewes
  • 96,351
  • 14
  • 169
  • 323
11
votes
2 answers

Is 512 bits a more secure hashing than 256 bits?

I know that 512 bit hashing is more secure, but I don't really know why. I hope someone can help me to better understand it in more detail.
Hinton Zsh
  • 361
  • 3
  • 10
11
votes
1 answer

Which compression functions are PRFs?

In a 2006 paper Bellare showed that HMAC remains secure even if collision resistance for MD5/SHA-1 is broken as long they are still PRFs. The Wikipedia article on cryptographic hash functions mentions that In practice, collision resistance is…
Elias
  • 4,933
  • 1
  • 16
  • 32
11
votes
0 answers

What might be assumed about a PRF if the key has been chosen?

The defining feature of a PRF $f:\{0,1\}^k\times\{0,1\}^s\mapsto\{0,1\}^*$ is that, if the first parameter is selected at random, it should be indistinguishable from a function $g:\{0,1\}^s\mapsto\{0,1\}^*$ selected at random. But what if the key…
Henrick Hellström
  • 10,556
  • 1
  • 32
  • 59
1
2 3
30 31