PRF ⇒ CPA-secure SKE

A PRF implies a CPA-secure SKE.

Construction

Migrated verbatim from PRF § Other results:

PRF implies CPA-secure SKE: CTR-mode encryption $\mathsf{Enc}(k,m_1\cdots m_{\ell })=\mathsf{PRF}(k,1)\Vert \cdots \Vert \mathsf{PRF}(k,\ell )\oplus m_1\Vert \cdots \Vert m_{\ell }$

Notes

status: stub and source: folklore: the claim carried no citation on the page it was migrated from, and none was invented.

Suspected error in the migrated sketch, recorded and not fixed. As written the construction is deterministic — the counter sequence starts at $1$ for every message, so encrypting the same message twice repeats the ciphertext and the scheme cannot be CPA-secure. CTR mode samples a fresh nonce per encryption, which the formula omits. Compare SKE § Other results, which states the same construction with a fresh nonce $r$. The parenthesisation is also ambiguous: the $\oplus$ appears to bind only the last $\mathsf{PRF}$ block.