Subject: [Cfrg] A note on PRF

From: Watson Ladd <[email-masked]>
Date: Sun, 12 Jan 2014 06:49:15 -0800

Let H(k, m) be a PRF with output length n and input all strings. Then
I claim that
H(H(k, m), "0"), H(H(k,m),"1") is a PRF of output length 2n.

A proof of this, together with evaluating the loss of security
resulting from such composite,
is left as an exercise for the reader.

In other words, don't worry about the length of the hash function we
adopt for our new Schnorr style signature scheme: it can be extended
by classical techniques easily.

Sincerely,
Watson Ladd