 it can query the value of the function at any point with one computation step, although it does not have the full description of the function. (See [@goldreichFound] for a detailed description.)

We now define *pseudorandom functions* (see [@goldreich1986construct]). Intuitively, this is a family of functions indexed by a seed, such that it is hard to distinguish a random member of the family from a truly randomly selected function.

A *pseudorandom function ensemble (PRF)* is a set such that the following conditions hold:

-   (easy to compute) $f_s(x)$ can be computed by a PPT algorithm that is given $s$ and $x$;

-   (pseudorandom) the function ensemble, where $F_n$ is uniformly distributed over the multiset $\{f_s\}_{s\in\{0,1\}^n}$, is computationally indistinguishable from $H$.

We use the standard cryptographic assumption that a family of PRFs exists; this assumption is implied by the existence of one-way functions [@haastad1999pseudorandom; @goldreich1986construct]. We actually require the use of a seemingly stronger notion of a PRF, which requires that an attacker getting access to polynomially many instances of a PRF (i.e., $f_s$ for polynomially many values of $s$) still cannot distinguish them from polynomially many truly random functions. Nevertheless, as we show in Appendix \[section:appA\], it follows using a standard “hybrid” argument that any PRF satisfies also this stronger “multi-instance” security notion.

### Public-key Encryption Schemes

We now define public-key encryption schemes. Such a scheme has two keys. The first is public and used for encrypting messages (using a randomized algorithm). The second is secret and used for decrypting. The keys are generated in such a way that the probability that a decrypted message is equal to the encrypted message is equal to $1$. The key generation algorithm takes as input a “security parameter” $k$ that is used to determine the security of the protocols (inuitively, no polynomial-time attacker should be able to “break” the security of the protocol except possibly with a probability that is a negligible function of $k$).

We now recall the formal definitions of public-key encryption schemes [@diffie1976new; @rivest1978
it can query the value of the function at any point with one computation gradation, although it does not take the full description of the function. (See [ @goldreichFound ] for a detailed description .) 

 We immediately define * pseudorandom functions * (experience [ @goldreich1986construct ]). Intuitively, this is a kin of functions indexed by a seed, such that it is hard to identify a random member of the family from a in truth randomly selected function. 

 A * pseudorandom function ensemble (PRF) * is a set such that the following condition hold: 

 -    (easy to compute) $ f_s(x)$ can be calculate by a PPT algorithm that is given $ s$ and $ x$; 

 -    (pseudorandom) the function corps de ballet, where $ F_n$ is uniformly distributed over the multiset $ \{f_s\}_{s\in\{0,1\}^n}$, is computationally identical from $ H$. 

 We use the standard cryptographic assumption that a family of PRFs exists; this assumption is imply by the existence of one - way functions [ @haastad1999pseudorandom; @goldreich1986construct ]. We actually require the use of a apparently strong notion of a PRF, which requires that an attacker getting access to polynomially many instances of a PRF (i.e., $ f_s$ for polynomially many values of $ s$) still cannot distinguish them from polynomially many truly random function. Nevertheless, as we show in Appendix   \[section: appA\ ], it stick to use a standard “ hybrid ” argument that any PRF satisfies also this stronger “ multi - case ” security notion. 

 # # # Public - key Encryption Schemes 

 We now specify public - key encryption schemes. Such a scheme has two keys. The beginning is public and used for encrypting messages (using a randomized algorithm). The second is unavowed and practice for decrypting. The keys are generated in such a way that the probability that a decrypted message is equal to the code message is equal to $ 1$. The key generation algorithm takes as input a “ security parameter ” $ k$ that is used to determine the security system of the protocols (inuitively, no polynomial - time attacker should be able to “ break ” the security of the protocol except possibly with a probability that is a negligible function of $ k$). 

 We nowadays recall the conventional definitions of public - samara encryption system [ @diffie1976new; @rivest1978
 it can query the value of uhe function at aut poinv with kne compjtation step, although it doed bot hqve the full descriptiun of the functiob. (Set [@goldreichFound] hkr a debciled fescxi'tion.)

We now deflne *pseudordndom functionv* (rez [@goldreich1986construct]). Intuitively, thif is a galily of functijns pnqexes by a seed, such that it is hard tk distiiguish a random member of the family from a tguly randomly selefted functiin.

A *[weudorandom wunction ensemble (PRF)* js a set such that the followine conbitions hole:

-   (ewvy to compuve) $f_s(x)$ can be compmned by d PPT akgorithm that ls giten $w$ and $x$;

-   (pseudorandok) the function ensgmble, whera $Y_n$ is uniformly distrubyted mver the nulgistt $\{h_s\}_{s\jn\{0,1\}^n}$, is cojputationamly indistibguishable from $H$.

We ufv the standars crypeodraphic assumption that a family of PRFv esists; this assumption iw implied by the exisjence of oge-way functions [@haastad1999pseudorandom; @goldreich1986consdruct]. De cgbualut gequire the use of a seemingly stronger notiog og s PRF, which rezuires that aj sjtacker gettine access fo polynomially majy instwnces of a PRF (i.e., $g_s$ for polynomially many vaoues of $s$) stpll xannot distinguish them from 'olynokiallu many truly random funetions. Nevertheleds, as we afow in Appendix \[sdctpon:a[pA\], it follows using a stagdard “hybcid” axgument ghat any PWF satisfifs also this stronger “mupti-indtdnce” securlty notion.

### Public-key Encryption Schemes

We now dafite publie-key ekcryption schemqs. Such a scheke has cwo kehs. The firat is pnblic and usqd for encrypdlng messages (using a raneomized algufithm). The secomd is secgeu and used for decrypting. Thc keyr are generated nu wuch a way that thd pwohauilitr that a decrfptea mdxsage is equal ti the encrypted message iv eqhal to $1$. The key gemevation altorithm eakes as inpuy a “security paramtter” $k$ thet is iseq to determine the security of the protlcojs (inuitivelr, no polynomial-tnme attacker should be able to “break” the security of the krotocol except possiyln with a prouabiliey that iv a negligible functuon of $k$).

We now regall the formal definifions mf puhlic-key encryption schemes [@diffie1976new; @rivest1978
it can query the value of the any with one step, although it description the function. (See for a detailed We now define *pseudorandom functions* (see Intuitively, this is a family of functions indexed by a seed, such that is hard to distinguish a random member of the family from a truly selected A function (PRF)* is a set such that the following conditions hold: - (easy to compute) $f_s(x)$ can computed by a PPT algorithm that is given and $x$; - (pseudorandom) function ensemble, where $F_n$ is distributed the multiset is indistinguishable $H$. We use standard cryptographic assumption that a family of PRFs exists; this assumption is implied by the existence of functions [@haastad1999pseudorandom; actually require use a stronger notion of which requires that an attacker getting many instances of a PRF (i.e., $f_s$ for many values $s$) still cannot distinguish them from many truly random functions. Nevertheless, as we show Appendix \[section:appA\], it follows using a standard “hybrid” argument that any PRF satisfies also this security notion. ### Public-key Schemes We now public-key schemes. a has two The first is public and used for encrypting messages (using a algorithm). The second is secret and used for decrypting. The generated such a way the probability that a message equal to the encrypted equal $1$. algorithm as a “security parameter” $k$ is used to determine the of the protocols (inuitively, able to “break” the security of the protocol possibly with a probability that is a function of $k$). We now recall the formal definitions of public-key encryption [@diffie1976new; @rivest1978
 it can query the value of the fuNction at anY poinT wiTh oNe CompUtatIon step, althougH It doEs not have the full descriPtion Of THe fuNCtIon. (SeE [@goldreIChfOUnd] FoR a DetAiLEd DescrIptIon.)

We noW define *pseUdoRaNdom functionS* (SeE [@goldreich1986ConStruct]). IntuitIveLy, this Is A faMIly of FunCtionS indexED by a seEd, such thaT iT Is hard TO distinGUIsH a raNdom member of the faMIlY From a truly randOmly seLeCTeD FUncTioN.

A *pseudoraNdOm funCTion ensEMbLE (prF)* iS A set such that tHe following COndItions HoLd:

-   (eASy to coMpute) $F_s(X)$ Can Be computed bY a PPt algorithM that iS Given $s$ aND $x$;

-   (pseudOrandoM) thE fuNctiON eNsEmbLe, WHerE $f_n$ Is uNIfoRmly distRiBuTed ovEr thE MULTiseT $\{f_s\}_{S\in\{0,1\}^n}$, Is comPutationally iNdiStinGUisHable From $H$.

we usE tHe staNdard cRyptoGrAphic assumption That A family of pRFS eXisTs; This aSSumptiOn iS imPlied by The exisTEncE oF ONE-wAy functions [@haastad1999PsEUDoRandom; @goLdreicH1986CoNsTRuct]. We acTuAllY reqUIRe the Use oF A sEemingly StrongER nOtIon of a PrF, Which rEqUirEs tHat an ATtacKer getTing acceSs to pOLynomially many INstances of a PRf (I.e., $F_S$ FoR PolyNomIally many vaLues OF $s$) stIll cANnOt dIStingUish tHeM FrOM polynomially many trUlY randoM funcTions. NevertheLess, as we shOW IN AppendiX \[secTIoN:AppA\], it follows uSing a Standard “hyBRid” argumEnt thAt any PRF Satisfies ALSo this stRonGer “MulTi-iNSTaNce” security noTIOn.

### PuBlIc-key EnCryPtion ScHemEs

WE noW deFiNe public-kEy encrypTiOn ScHeMes. such a SCheme has TwO keYs. the First IS publiC and uSed fOr EnCRypTing mesSAgES (UsinG a RaNdomIzeD aLgoriThm). THE seCond is sEcret and uSed FOr deCrYpTing. The Keys are generaTeD in such a waY tHat The proBABility thAt a decrypted message is eqUAl to the EncRypteD mesSage is equAl tO $1$. The keY geNEratioN algorIthm tAkEs aS INput a “SECuRitY pArameter” $k$ tHAT is Used tO dEterMine the Security of the protoCOls (Inuitively, no pOlyNomiAL-TiMe aTTaCKer ShOUld BE Able to “break” the sEcurity of tHe PRoTocol excepT PosSiBly with A probabIlity THat is a nEgligible Function oF $k$).

we noW REcaLl the formaL definitIons of pubLIc-key ENcRyptiOn sChemes [@DiFfiE1976new; @rIvest1978
 it can query the value of  the funct ion a t a nypo intwith  one computati o n st ep, although it does n ot ha ve thef ul l des criptio n  o f the  f un cti on .  ( See [ @go ldreich Found] for  ade tailed descr i pt ion.)

Wenow  define *pse udo random  f unc t ions*  (s ee [@ goldre i ch1986 construct ]) .  Intui t ively,t h is  isa family of funct i on s  indexed by aseed,su c ht h atitis hard to  d istin g uish ar an d o m  me m ber of the fa mily from a tru ly ran do mly select ed fu nc t ion .

A *pseud oran dom funct ion en s emble ( P RF)* is  a set  su chthat th efol lo w ing co ndi t ion s hold:
-   (eas y to c o m pute ) $ f_s( x)$ c an be compute d b y aP PTalgor ithmthat  i s giv en $s$  and$x $;

-   (pseudo rand om) the f unc ti onen sembl e , wher e $ F_n $ is un iformly dis tr i b u te d over the multise t$ \ {f _s\}_{s\ in\{0, 1 \} ^n } $, is co mp uta tion a l ly in dist i ng uishable  from$ H$ .
We use  t he sta nd ard  cr yptog r aphi c assu mption t hat a family of PRFs exists; thisa ss u m pt i on i s i mplied by t he e x iste nceo fone - way f uncti on s  [ @ haastad1999pseudora nd om; @g oldre ich1986constr uct]. We a c t u ally req uire th e  use of a seem ingly  strongern otion of  a PR F, which  requires t hat an a tta cke r g ett i n gaccess to pol y n omia ll y manyins tancesofa P RF(i. e. , $f_s$ f or polyn om ia ll yman y val u es of $s $)  st il l c annot distin guish  the mfr o m p olynomi a ll y many  t ru ly r and om  func tion s . N everthe less, aswes howin  A ppendix  \[section:ap pA \], it fol lo wsusinga standard  “hybrid” argument that any PRF  sa tisfi es a lso thisstr onger“mu l ti-ins tance”  secu ri tyn o tion. ## # P ub lic-key En c r ypt ion S ch emes 

We no w define public-ke y  en cryption sche mes . Su c h  a  sc h em e  ha st wok e ys. The first i s public a nd us ed for enc r ypt in g messa ges (us ing a randomi zed algor ithm). Th eseco n d  is  secret an d used f or decryp t ing.T he  keys  ar e gene ra ted  in s uch aw aythatthe pr ob abilit y tha ta decryp ted message is equal to  the e ncryp ted  messageise qua l to $1$.  The  key gener ati onalgor ith m  take s as in put a “se curi t y paramet e r”  $k $ th at is usedt o det ermin e t h e secu rity  of the protocols (inuitively, n o po l y nom ial - time  a ttacker should  be  a b l e to “br ea k” the secu rity ofth e  prot ocol e xceptpossibl y wi t h a pr obab ili ty that i s a  n e gligibl efu n ctionof $ k$ ).

We  now r e call t he formal defini tions o f pub l ic- key e nc ryption sche mes [@diff ie1976new;@rives t197 8
 it_can query_the value of the_function at_any_point with_one_computation step, although_it does not_have the full description_of the function._(See_[@goldreichFound] for a detailed description.)

We now define *pseudorandom functions* (see [@goldreich1986construct]). Intuitively, this is_a_family of_functions_indexed_by a seed, such that_it is hard to distinguish_a random_member of the family from a truly randomly_selected_function.

A *pseudorandom function_ensemble (PRF)* is a set such that the following_conditions hold:

-   (easy to_compute) $f_s(x)$ can_be_computed_by a PPT algorithm_that is given $s$ and $x$;

-_  (pseudorandom) the function ensemble,_where $F_n$ is uniformly distributed over the_multiset $\{f_s\}_{s\in\{0,1\}^n}$, is computationally indistinguishable from_$H$.

We use the standard cryptographic_assumption that_a family of PRFs exists;_this assumption is_implied by_the existence of_one-way functions [@haastad1999pseudorandom; @goldreich1986construct]. We actually_require the use_of a seemingly stronger notion of_a_PRF, which requires_that_an_attacker getting_access to polynomially_many_instances of_a_PRF (i.e., $f_s$ for polynomially many_values_of $s$) still cannot distinguish them from_polynomially many truly random_functions._Nevertheless, as we show_in Appendix \[section:appA\], it follows using_a standard “hybrid” argument that any_PRF satisfies_also this_stronger “multi-instance” security notion.

### Public-key Encryption Schemes

We now define public-key encryption_schemes. Such a scheme has two_keys. The first is_public and_used_for encrypting messages_(using_a randomized_algorithm). The second is secret and used_for decrypting._The keys are generated in such_a way that the_probability_that a decrypted message is equal_to the encrypted message is equal_to $1$. The key generation_algorithm_takes_as input a “security parameter”_$k$ that is used to determine_the security of_the protocols (inuitively, no polynomial-time attacker should_be_able to “break” the security of_the_protocol except possibly with a probability_that_is_a negligible function of $k$).

We_now recall the formal definitions of_public-key encryption schemes [@diffie1976new; @rivest1978