Constructions of PRF (Pseudo Random Function)The Goldreich-Goldwasser-Micali Construction with bad PRGSSecurity of KDF1 and KDF2 (hash based KDF's)Implementing a pseudo random function in practiceCryptanalysis of Marvin32 compared to SipHashPseudo Random FunctionWhy is this function pseudo random (PRF)?Decentralized consent over a random numberExistence of PRF $implies$ existence of PRGDoes a distinguisher for an PRF based on a hash make the hash function insecure?Can we convert a pseudorandom function (PRF) to an Oblivious PRF (OPRF) through an Oblivious Transfer (OT) protocol?
Checks user level and limit the data before saving it to mongoDB
Can't get 5V 3A DC constant
Dynamic SOQL query relationship with field visibility for Users
A Note on N!
What happens to Mjolnir (Thor's hammer) at the end of Endgame?
How to limit Drive Letters Windows assigns to new removable USB drives
Was there a shared-world project before "Thieves World"?
How to fry ground beef so it is well-browned
Why was the Spitfire's elliptical wing almost uncopied by other aircraft of World War 2?
Like totally amazing interchangeable sister outfits II: The Revenge
Why didn't the Space Shuttle bounce back into space as many times as possible so as to lose a lot of kinetic energy up there?
As an international instructor, should I openly talk about my accent?
'It addicted me, with one taste.' Can 'addict' be used transitively?
"Whatever a Russian does, they end up making the Kalashnikov gun"? Are there any similar proverbs in English?
Check if a string is entirely made of the same substring
Minor Revision with suggestion of an alternative proof by reviewer
How can I get this effect? Please see the attached image
How to pronounce 'c++' in Spanish
Initiative: Do I lose my attack/action if my target moves or dies before my turn in combat?
How come there are so many candidates for the 2020 Democratic party presidential nomination?
Coordinate my way to the name of the (video) game
Pre-plastic human skin alternative
What is the optimal strategy for the Dictionary Game?
What term is being referred to with "reflected-sound-of-underground-spirits"?
Constructions of PRF (Pseudo Random Function)
The Goldreich-Goldwasser-Micali Construction with bad PRGSSecurity of KDF1 and KDF2 (hash based KDF's)Implementing a pseudo random function in practiceCryptanalysis of Marvin32 compared to SipHashPseudo Random FunctionWhy is this function pseudo random (PRF)?Decentralized consent over a random numberExistence of PRF $implies$ existence of PRGDoes a distinguisher for an PRF based on a hash make the hash function insecure?Can we convert a pseudorandom function (PRF) to an Oblivious PRF (OPRF) through an Oblivious Transfer (OT) protocol?
$begingroup$
I was taught only GGM based PRF construction in class. It's very inefficient. I am just curious about various PRF constructions from standard assumptions. Please provide a few PRF constructions from various assumptions.
pseudo-random-generator pseudo-random-function
asked 4 hours ago
satyasatya
441317
$endgroup$
add a comment |
$begingroup$
I was taught only GGM based PRF construction in class. It's very inefficient. I am just curious about various PRF constructions from standard assumptions. Please provide a few PRF constructions from various assumptions.
pseudo-random-generator pseudo-random-function
asked 4 hours ago
satyasatya
441317
$endgroup$
$begingroup$
Well, one standard assumption is that the SHA-256 compression function is a PRF, from which we can conclude that HMAC-SHA256 is a PRF (and a reasonably efficient one at that), but maybe you meant to restrict the domain of ‘standard assumptions’?
$endgroup$
– Squeamish Ossifrage
3 hours ago
add a comment |
$begingroup$
I was taught only GGM based PRF construction in class. It's very inefficient. I am just curious about various PRF constructions from standard assumptions. Please provide a few PRF constructions from various assumptions.
pseudo-random-generator pseudo-random-function
asked 4 hours ago
satyasatya
441317
$endgroup$
I was taught only GGM based PRF construction in class. It's very inefficient. I am just curious about various PRF constructions from standard assumptions. Please provide a few PRF constructions from various assumptions.
pseudo-random-generator pseudo-random-function
pseudo-random-generator pseudo-random-function
asked 4 hours ago
satyasatya
441317
asked 4 hours ago
satyasatya
441317
asked 4 hours ago
satyasatya
441317
asked 4 hours ago
satyasatya
441317
asked 4 hours ago
satyasatya
441317
441317
$begingroup$
Well, one standard assumption is that the SHA-256 compression function is a PRF, from which we can conclude that HMAC-SHA256 is a PRF (and a reasonably efficient one at that), but maybe you meant to restrict the domain of ‘standard assumptions’?
$endgroup$
– Squeamish Ossifrage
3 hours ago
add a comment |
$begingroup$
Well, one standard assumption is that the SHA-256 compression function is a PRF, from which we can conclude that HMAC-SHA256 is a PRF (and a reasonably efficient one at that), but maybe you meant to restrict the domain of ‘standard assumptions’?
$endgroup$
– Squeamish Ossifrage
3 hours ago
$begingroup$
Well, one standard assumption is that the SHA-256 compression function is a PRF, from which we can conclude that HMAC-SHA256 is a PRF (and a reasonably efficient one at that), but maybe you meant to restrict the domain of ‘standard assumptions’?
$endgroup$
– Squeamish Ossifrage
3 hours ago
$begingroup$
Well, one standard assumption is that the SHA-256 compression function is a PRF, from which we can conclude that HMAC-SHA256 is a PRF (and a reasonably efficient one at that), but maybe you meant to restrict the domain of ‘standard assumptions’?
$endgroup$
– Squeamish Ossifrage
3 hours ago
add a comment |
1 Answer
1
active
oldest
votes
$begingroup$
The most common efficient PRFs from specific assumptions are:
The Naor-Reingold PRF, which is based on the decision Diffie-Hellman assumption (DDH), and
The BPR PRF, which is based on the learning with error assumption (LWE).
Perhaps slightly less well-known is the NRR PRF, which is based on the hardness of factoring.
answered 3 hours ago
Geoffroy CouteauGeoffroy Couteau
9,29011834
$endgroup$
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "281"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f70083%2fconstructions-of-prf-pseudo-random-function%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
$begingroup$
The most common efficient PRFs from specific assumptions are:
The Naor-Reingold PRF, which is based on the decision Diffie-Hellman assumption (DDH), and
The BPR PRF, which is based on the learning with error assumption (LWE).
Perhaps slightly less well-known is the NRR PRF, which is based on the hardness of factoring.
answered 3 hours ago
Geoffroy CouteauGeoffroy Couteau
9,29011834
$endgroup$
add a comment |
$begingroup$
The most common efficient PRFs from specific assumptions are:
The Naor-Reingold PRF, which is based on the decision Diffie-Hellman assumption (DDH), and
The BPR PRF, which is based on the learning with error assumption (LWE).
Perhaps slightly less well-known is the NRR PRF, which is based on the hardness of factoring.
answered 3 hours ago
Geoffroy CouteauGeoffroy Couteau
9,29011834
$endgroup$
add a comment |
$begingroup$
The most common efficient PRFs from specific assumptions are:
The Naor-Reingold PRF, which is based on the decision Diffie-Hellman assumption (DDH), and
The BPR PRF, which is based on the learning with error assumption (LWE).
Perhaps slightly less well-known is the NRR PRF, which is based on the hardness of factoring.
answered 3 hours ago
Geoffroy CouteauGeoffroy Couteau
9,29011834
$endgroup$
The most common efficient PRFs from specific assumptions are:
The Naor-Reingold PRF, which is based on the decision Diffie-Hellman assumption (DDH), and
The BPR PRF, which is based on the learning with error assumption (LWE).
Perhaps slightly less well-known is the NRR PRF, which is based on the hardness of factoring.
answered 3 hours ago
Geoffroy CouteauGeoffroy Couteau
9,29011834
answered 3 hours ago
Geoffroy CouteauGeoffroy Couteau
9,29011834
answered 3 hours ago
Geoffroy CouteauGeoffroy Couteau
9,29011834
answered 3 hours ago
Geoffroy CouteauGeoffroy Couteau
9,29011834
9,29011834
add a comment |
add a comment |
Thanks for contributing an answer to Cryptography Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
Use MathJax to format equations. MathJax reference.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f70083%2fconstructions-of-prf-pseudo-random-function%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
$begingroup$
Well, one standard assumption is that the SHA-256 compression function is a PRF, from which we can conclude that HMAC-SHA256 is a PRF (and a reasonably efficient one at that), but maybe you meant to restrict the domain of ‘standard assumptions’?
$endgroup$
– Squeamish Ossifrage
3 hours ago