denote the uniform distribution over the set of all functions from to . Then we require and are computationally indistinguishable, where n is the security parameter. That is, for any adversary that can query the oracle of a function sampled from either or , the advantage that she can tell apart which kind of oracle is given to her is negligible in . Oblivious pseudorandom functions In an oblivious pseudorandom function, abbreviated OPRF, information is concealed from two parties that are involved in a PRF. That is, if Alice cryptographically hashes her secret value, cryptographically blinds the hash to produce the message she sends to Bob, and Bob mixes in his secret value and gives the result back to Alice, who unblinds it to get the final output, Bob is not able to see either Alice's secret value or the final output, and Alice is not able to see Bob's secret input, but Alice sees the final output which is a PRF of the two inputs -- a PRF of Alice's secret and Bob's secret. This enables transactions of sensitive cryptographic information to be secure even between untrusted parties. An OPRF is used in some implementations of password-authenticated key agreement. An OPRF is used in the Password Monitor functionality in Microsoft Edge. Application PRFs can be used for: dynamic perfect hashing; even if the adversary can change the key-distribution depending on the values the hashing function has assigned to the previous keys, the adversary can not force collisions. Constructing deterministic, memoryless authentication schemes (message authentication code based) which are provably secure against chosen message attack. Distributing unforgable ID numbers, which can be locally verified by stations that contain only a small amount of storage. Constructing identification friend or foe systems. See also Pseudorandom permutation Notes References Theory of cryptography Cryptographic primitives Pseudorandomness