Constructions of PRF (Pseudo Random Function)The Goldreich-Goldwasser-Micali Construction with bad PRGSSecurity of KDF1 and KDF2 (hash based KDF's)Implementing a pseudo random function in practiceCryptanalysis of Marvin32 compared to SipHashPseudo Random FunctionWhy is this function pseudo random (PRF)?Decentralized consent over a random numberExistence of PRF $implies$ existence of PRGDoes a distinguisher for an PRF based on a hash make the hash function insecure?Can we convert a pseudorandom function (PRF) to an Oblivious PRF (OPRF) through an Oblivious Transfer (OT) protocol?

Overlay of two functions leaves gaps

Is it idiomatic to construct against `this`

can anyone help me with this awful query plan?

How to prevent z-fighting in OpenSCAD?

What happens to Mjolnir (Thor's hammer) at the end of Endgame?

How to have a sharp product image?

Which big number is bigger?

bldc motor, esc and battery draw, nominal vs peak

Does a large simulator bay have standard public address announcements?

Why did some of my point & shoot film photos come back with one third light white or orange?

A ​Note ​on ​N!

Are there physical dangers to preparing a prepared piano?

Pulling the rope with one hand is as heavy as with two hands?

How would 10 generations of living underground change the human body?

What are the steps to solving this definite integral?

Minor Revision with suggestion of an alternative proof by reviewer

What does the integral of a function times a function of a random variable represent, conceptually?

Rivers without rain

How much cash can I safely carry into the USA and avoid civil forfeiture?

What's the polite way to say "I need to urinate"?

"You've called the wrong number" or "You called the wrong number"

Mistake in years of experience in resume?

How do I reattach a shelf to the wall when it ripped out of the wall?

How to pronounce 'c++' in Spanish



Constructions of PRF (Pseudo Random Function)


The Goldreich-Goldwasser-Micali Construction with bad PRGSSecurity of KDF1 and KDF2 (hash based KDF's)Implementing a pseudo random function in practiceCryptanalysis of Marvin32 compared to SipHashPseudo Random FunctionWhy is this function pseudo random (PRF)?Decentralized consent over a random numberExistence of PRF $implies$ existence of PRGDoes a distinguisher for an PRF based on a hash make the hash function insecure?Can we convert a pseudorandom function (PRF) to an Oblivious PRF (OPRF) through an Oblivious Transfer (OT) protocol?













2












$begingroup$


I was taught only GGM based PRF construction in class. It's very inefficient. I am just curious about various PRF constructions from standard assumptions. Please provide a few PRF constructions from various assumptions.






pseudo-random-generator pseudo-random-function







share|improve this question









$endgroup$











  • $begingroup$
    Well, one standard assumption is that the SHA-256 compression function is a PRF, from which we can conclude that HMAC-SHA256 is a PRF (and a reasonably efficient one at that), but maybe you meant to restrict the domain of ‘standard assumptions’?
    $endgroup$
    – Squeamish Ossifrage
    3 hours ago
















2












$begingroup$


I was taught only GGM based PRF construction in class. It's very inefficient. I am just curious about various PRF constructions from standard assumptions. Please provide a few PRF constructions from various assumptions.






pseudo-random-generator pseudo-random-function







share|improve this question









$endgroup$











  • $begingroup$
    Well, one standard assumption is that the SHA-256 compression function is a PRF, from which we can conclude that HMAC-SHA256 is a PRF (and a reasonably efficient one at that), but maybe you meant to restrict the domain of ‘standard assumptions’?
    $endgroup$
    – Squeamish Ossifrage
    3 hours ago














2












2








2





$begingroup$


I was taught only GGM based PRF construction in class. It's very inefficient. I am just curious about various PRF constructions from standard assumptions. Please provide a few PRF constructions from various assumptions.






pseudo-random-generator pseudo-random-function







share|improve this question









$endgroup$




I was taught only GGM based PRF construction in class. It's very inefficient. I am just curious about various PRF constructions from standard assumptions. Please provide a few PRF constructions from various assumptions.






pseudo-random-generator pseudo-random-function




pseudo-random-generator pseudo-random-function






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked 4 hours ago









satyasatya

441317




441317











  • $begingroup$
    Well, one standard assumption is that the SHA-256 compression function is a PRF, from which we can conclude that HMAC-SHA256 is a PRF (and a reasonably efficient one at that), but maybe you meant to restrict the domain of ‘standard assumptions’?
    $endgroup$
    – Squeamish Ossifrage
    3 hours ago

















  • $begingroup$
    Well, one standard assumption is that the SHA-256 compression function is a PRF, from which we can conclude that HMAC-SHA256 is a PRF (and a reasonably efficient one at that), but maybe you meant to restrict the domain of ‘standard assumptions’?
    $endgroup$
    – Squeamish Ossifrage
    3 hours ago
















$begingroup$
Well, one standard assumption is that the SHA-256 compression function is a PRF, from which we can conclude that HMAC-SHA256 is a PRF (and a reasonably efficient one at that), but maybe you meant to restrict the domain of ‘standard assumptions’?
$endgroup$
– Squeamish Ossifrage
3 hours ago





$begingroup$
Well, one standard assumption is that the SHA-256 compression function is a PRF, from which we can conclude that HMAC-SHA256 is a PRF (and a reasonably efficient one at that), but maybe you meant to restrict the domain of ‘standard assumptions’?
$endgroup$
– Squeamish Ossifrage
3 hours ago











1 Answer
1






active

oldest

votes


















4












$begingroup$

The most common efficient PRFs from specific assumptions are:



The Naor-Reingold PRF, which is based on the decision Diffie-Hellman assumption (DDH), and



The BPR PRF, which is based on the learning with error assumption (LWE).



Perhaps slightly less well-known is the NRR PRF, which is based on the hardness of factoring.






share|improve this answer









$endgroup$













    Your Answer








    StackExchange.ready(function()
    var channelOptions =
    tags: "".split(" "),
    id: "281"
    ;
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function()
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled)
    StackExchange.using("snippets", function()
    createEditor();
    );

    else
    createEditor();

    );

    function createEditor()
    StackExchange.prepareEditor(
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: false,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: null,
    bindNavPrevention: true,
    postfix: "",
    imageUploader:
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    ,
    noCode: true, onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    );



    );













    draft saved

    draft discarded


















    StackExchange.ready(
    function ()
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f70083%2fconstructions-of-prf-pseudo-random-function%23new-answer', 'question_page');

    );

    Post as a guest















    Required, but never shown

























    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    4












    $begingroup$

    The most common efficient PRFs from specific assumptions are:



    The Naor-Reingold PRF, which is based on the decision Diffie-Hellman assumption (DDH), and



    The BPR PRF, which is based on the learning with error assumption (LWE).



    Perhaps slightly less well-known is the NRR PRF, which is based on the hardness of factoring.






    share|improve this answer









    $endgroup$

















      4












      $begingroup$

      The most common efficient PRFs from specific assumptions are:



      The Naor-Reingold PRF, which is based on the decision Diffie-Hellman assumption (DDH), and



      The BPR PRF, which is based on the learning with error assumption (LWE).



      Perhaps slightly less well-known is the NRR PRF, which is based on the hardness of factoring.






      share|improve this answer









      $endgroup$















        4












        4








        4





        $begingroup$

        The most common efficient PRFs from specific assumptions are:



        The Naor-Reingold PRF, which is based on the decision Diffie-Hellman assumption (DDH), and



        The BPR PRF, which is based on the learning with error assumption (LWE).



        Perhaps slightly less well-known is the NRR PRF, which is based on the hardness of factoring.






        share|improve this answer









        $endgroup$



        The most common efficient PRFs from specific assumptions are:



        The Naor-Reingold PRF, which is based on the decision Diffie-Hellman assumption (DDH), and



        The BPR PRF, which is based on the learning with error assumption (LWE).



        Perhaps slightly less well-known is the NRR PRF, which is based on the hardness of factoring.







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered 4 hours ago









        Geoffroy CouteauGeoffroy Couteau

        9,29011834




        9,29011834



























            draft saved

            draft discarded
















































            Thanks for contributing an answer to Cryptography Stack Exchange!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid …


            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.

            Use MathJax to format equations. MathJax reference.


            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function ()
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f70083%2fconstructions-of-prf-pseudo-random-function%23new-answer', 'question_page');

            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            -

            Popular posts from this blog

            The Calvary Singular or Plural The 2019 Stack Overflow Developer Survey Results Are InAre collective nouns always plural, or are certain ones singular?Is “audience” singular or plural?“Wasn't” vs. “weren't” in a vernacular sentence“My last couple of years” — singular or plural?Is 'rest' singular or plural?Is “all but one” singular or plural?Whether to use the singular or plural form of basis?Singular and Plural for numbersIs there a plural form of teeth?performance: plural vs singular?singular or plural nouns?Singular and Plural

            Image
            How to type a long/em dash `—` Did Scotland spend $250,000 for the slogan "Welcome to Scotland"? Worn-tile Scrabble Can we generate random numbers using irrational numbers like π and e? Geography at the pixel level For what reasons would an animal species NOT cross a *horizontal* land bridge? A female thief is not sold to make restitution -- so what happens instead? What is this sharp, curved notch on my knife for? Why does the nucleus not repel itself? What do I do when my TA workload is more than expected? How do I free up internal storage if I don't have any apps downloaded? How come people say “Would of”? Can there be female White Walkers? Cooking pasta in a water boiler If I score a critical hit on an 18 or higher, what are my chances of getting a critical hit if I roll 3d20? Is it ok to offer lower paid work as a trial period before negotiating for a full-time job? Can an undergraduate be advised by a professor who is very far...
            Read more

            How does one intimidate enemies without having the capacity for violence?Ideas for how aliens would approach this fight?How to convey the scale of my humanoid without science or units?How does the “space drive” conserve momentum?Planet Vanishes - How does this affect the orbiting starships?How does a community of a Universe Simulator have the same language as its creator?How would US Presidential elections be affected if voters could choose the state their vote for President was counted in?How Does One Ensures the Immortality of Their ConsciousnessHow do I retain national independence while also having a one world government?How can Ganymede have an Earth-like gravity without us having realized it?How would one make a lion mount for a fantasy world?

            Image
            Emailing HOD to enhance faculty application Forgetting the musical notes while performing in concert Why do I get two different answers for this counting problem? Watching something be written to a file live with tail What defenses are there against being summoned by the Gate spell? Why do bosons tend to occupy the same state? I'm flying to France today and my passport expires in less than 2 months Is the Joker left-handed? How to prevent "they're falling in love" trope Why is it a bad idea to hire a hitman to eliminate most corrupt politicians? I Accidentally Deleted a Stock Terminal Theme What reasons are there for a Capitalist to oppose a 100% inheritance tax? Twin primes whose sum is a cube Can I ask the recruiters in my resume to put the reason why I am rejected? Could gravitational lensing be used to protect a spaceship from a laser? Do I have a twin with permutated remainders? How do I write bicross product symbols in latex? If...
            Read more

            Output visual diagram of pictureASCII-art logic gate diagramBooks on a ShelfDetermine the Dimensions of a Rotated RectangleDraw a Houndstooth PatternDraw and label an ASCII hexagonal gridGolf me an ASCII AlphabetASCII Jigsaw PuzzleOutput a pretty boxASCII-Art Venn DiagramASCII Exact Cover with Rectangles

            Image
            Turning a hard to access nut? Magento 2: Make category field required in product form in backend Are hand made posters acceptable in Academia? How do researchers send unsolicited emails asking for feedback on their works? Why is indicated airspeed rather than ground speed used during the takeoff roll? Perfect 4th is dissonant? If I cast the Enlarge/Reduce spell on an arrow, what weapon could it count as? What is it called when someone votes for an option that's not their first choice? Is it okay for a cleric of life to use spells like Animate Dead and/or Contagion? Would mining huge amounts of resources on the Moon change its orbit? Creating points with attributes from coordinates in ArcPy Box half filled color Asserting that Atheism and Theism are both faith based positions Why is "la Gestapo" feminine? Recursively updating the MLE as new observations stream in Why didn't Voldemort know what Grindelwald looked like? Print last inputted...
            Read more