Invertible PRFs ⇒ PRF

Fully-black-box reduction · standard model · folklore · security loss: tight: the PRF advantage equals the iPRF advantage of the wrapped distinguisher

Statement

If $(\mathsf{KeyGen},\mathsf{Eval},\mathsf{Invert})$ is an invertible PRF, then $(\mathsf{KeyGen},\mathsf{Eval})$ is a PRF: every PRF distinguisher is an iPRF distinguisher that never queries its inversion oracle, with the same advantage — folklore.

Sketch

Plain iPRF security is ${\mathbf{G}}^{\mathrm{prf}}$ itself, and ${\mathbf{G}}^{\mathrm{iprf}}$ with its inversion oracles removed is ${\mathbf{G}}^{\mathrm{prf}}$, so a PRF distinguisher against $(\mathsf{KeyGen},\mathsf{Eval})$ breaks either notion without using $\mathsf{Invert}$.