Why a pseudorandom permutation is used in a simulation based proof but pseudorandom function is not? In this paper:

https://eprint.iacr.org/2011/272.pdf

the authors use peudorandom permutation in the protocols and proof rather than pseudorandom function. On page 31 (last two lines) they say:

"We also note that for the purposes of the simulation, we need to use a pseudorandom permutation rather than any pseudorandom function."



Question: Why can we use pseudorandom permutation in the simulation but we cannot use pseudorandom function?
I happened to be talking to one of the authors and asked about this. The short answer is: Eventually on page 34 they are considering a malicious adversary. The simulator has to extract the adversary's effective input but it only knows the messages sent by the adversary, which in this case are just the PRP outputs. The simulator knows the PRP key so it can invert the PRP to determine the adversary's effective input. A PRF wouldn't allow this, although a PRF is indeed enough for the semi-honest variant of the protocol starting on page 31.