Instantiating the Hash-Then-Evaluate Paradigm: Strengthening PRFs, PCFs, and OPRFs
Chris Brzuska, Geoffroy Couteau, Christoph Egger, Pihla Karanko, Pierre Meyer · Lecture notes in computer science · 2024
We instantiate the hash-then-evaluate paradigm for pseudorandom functions (PRFs), $$\textsf{PRF}(k,x):=\textsf{wPRF}(k,\textsf{RO}(x))$$ , which builds a PRF $$\textsf{PRF}$$ from a weak PRF $$\textsf{wPRF}$$ via a public pre-processing random oracle $$\textsf{RO}$$ . In applications to secure multiparty computation (MPC), only the low-complexity $$\textsf{wPRF}$$ performs secret-depending operations. Our construction replaces $$\textsf{RO}$$ by $$f(k_\textsf{H},\textsf{elf}(x))$$ , where f is a non-adaptive PRF and the key $$k_\textsf{H}$$ is public and thus known to the distinguishing adversary. We show that, perhaps surprisingly, several existing weak PRF candidates are plausibly also secure when their inputs are generated by $$f(k_\textsf{H},\textsf{elf}(.))$$ . Firstly, analogous cryptanalysis applies (because pseudorandomness of f implies good statistical properties) and/or secondly an attack against the weak PRF with such pseudorandom inputs generated by f would imply surprising results such as key agreement from the hardness of the high-noise version of the Learning Parity with Noise (LPN) when implementing both $$\textsf{wPRF}$$ and f from this assumption. Our simple transformation of replacing $$\textsf{RO}(\cdot )$$ public pre-processing by $$f(k_\textsf{H},\textsf{elf}(x))$$ public pre-processing applies to the entire family of PRF-style functions. Specifically, we obtain results for oblivious PRFs, which are a core building block for password-based authenticated key exchange (PAKE) and private set intersection (PSI) protocols, and we also obtain results for pseudorandom correlation functions (PCF), which are a key tool for silent oblivious transfer (OT) extension.