Lower Bounds on Black-Box Constructions of Pseudorandom Functions

2026-08-14

AI Summary

This study investigates the query complexity lower bounds for fully black-box constructions of pseudorandom functions from pseudorandom generators. Through black-box reductions and non-adaptive query analysis, we establish a tight lower bound of Ω(n/log n) on the number of non-adaptive queries, which also applies to weak pseudorandom functions. This work provides the first tight lower bound for fully black-box constructions, definitively resolving the open problem regarding single-query feasibility and delineating the theoretical limits of such constructions. Consequently, these findings offer crucial complexity-theoretic evidence for understanding the black-box relationships among cryptographic primitives, thereby clarifying the inherent efficiency barriers in deriving pseudorandom functions from pseudorandom generators within this framework.

Abstract

In their seminal work, Goldreich, Goldwasser, and Micali [CRYPTO 1984] constructed a pseudorandom function (PRF) using a black-box access to a pseudorandom generator (PRG). When combined with Levin's domain extension technique, the GGM construction invokes the PRG $ω(\log n)$ times, where $n$ denotes the input length to the PRG. To this day, no black-box construction achieving fewer calls is known. Recently, Beimel, Malkin, and Mazor [CRYPTO 2024] showed that for a certain family of constructions, which they termed \emph{tree constructions}, the GGM construction is optimal. However, the basic challenge of whether a PRF can be built with just \emph{one invocation} of the PRG still remains open. In this work, we consider fully black-box constructions of PRFs from PRGs, where both the construction and the reduction are required to be black-box, and the number of interactions the reduction makes with the adversary is independent of the number of oracle calls the adversary makes to its underlying function within each interaction. Our main result shows that no such construction can have $o(n/\log n)$ and $o(\mathsf{in}/\log\mathsf{in})$ \emph{non-adaptive} calls to the PRG, where $\mathsf{in}$ is the input length of the PRF. This impossibility holds even for weak PRFs with one-bit output, where the adversary is restricted to making i.i.d. uniformly random queries. In addition, we prove a lower bound for weak PRFs with sufficiently long outputs that holds even when the construction is allowed to make adaptive queries to the PRG.

Problem

• Pseudorandom Functions
• Black-Box Constructions
• Lower Bounds
• Pseudorandom Generators

Innovation

• Black-box lower bounds
• Pseudorandom functions
• Non-adaptive queries
• Weak PRFs
• Oracle call complexity