Prefix property for variable length pseudo-random generators
Recall that Katz-Lindell defines a variable output-length pseudorandom generator as a deterministic polynomial time algorithm G with three properties:


Let $s$ a string and $n&gt;0$ an integer. Then $G(s,1^n)$ outputs a string of length $n$
For all $s,n,n'$ with $n&lt;n'$, the string $G(s,1^n)$ is a prefix of $G(s,1^{n'})$
Define $G_{\ell}:=G(s,1^{\ell(|s|)})$. Then for every polynomial $\ell(\cdot)$ it holds that $G_{\ell}$ is a pseudorandom generator with expansion factor $\ell$.


(I have changed some $\ell$s to $n$s to avoid variable collision).

The second condition is necessary because, without it, this definition does not say anything about the output of $G(s,1^n)$ in the case where $|s|&gt;n$. This is because Katz-Lindell defines a pseudorandom generator (on page 70) to have an $\textit{expansion}$ property-- the output of a pseudorandom generator is longer than the seed--so the above property 3 doesn't (by itself) tell us anything about the case where $|s|&gt;n$.

This is a problem because (as defined on page 63) the first step of the eavesdropping indistinguishability experiment is that "The adversary $\mathcal{A}$ is given input $1^n$, and outputs a pair of messages $m_0,m_1$ of the same length."

The seed used in encryption is of length $n$, so the adversary could choose messages of length less than $n$. Then the messages would be encrypted with the output of $G(k,1^{|m_0|})$ which, as mentioned above, is not guaranteed to be pseudorandom without property 2.

However, it is an easy lemma to prove that a truncation of a pseudorandom string is also pseudorandom. This, together with properties 2 and 3, gives us that all outputs of a variable output-length pseudorandom generator are pseudorandom, and the security proof goes through as normal.