Security of modular exponentiation for non-uniform inputs

Question

Suppose we have a function $F = f_{s}(x)$ with a key $s \gets \mathbb{Z}_q$ that on input $x$ outputs modular exponentiation $x^s$, where $\mathbb{G}$ is a cyclic group of order $q$ where DDH is hard. If $x$ is selected uniformly at random from $\mathbb{G}$, then modular exponentiation $F$ behaves like a weak PRF (Naor et. al "Distributed Pseudo-Random Functions and KDCs").

However, what happens when inputs are not chosen at random? Say, one can query $F$ for any $x \in \mathbb{G}$. Are there any security estimations?

Answer 1

What happens when inputs are not chosen at random?

We can distinguish an oracle implementing some $f_s$ from one implementing a true PRF with near certainty, as follows:

• Take two arbitrary group elements $x$ and $y$.
• Compute $z=xy$ by multiplying in the group.
• Query the oracle with $x$, $y$, and $z$ so that we get $X=f_s(x)$, $Y=f_s(y)$, $Z=f_s(z)$.
• Test if $XY=Z$ and if so output "the oracle probably is implementing some $f_s$", else output "the oracle must be implementing a PRF".

This works because $(x^s)(y^s)=(xy)^s$.

We can simplify this by querying with $x$ and $z=x^2$ and checking $Z=X^2$. Or just by querying with $x=1$ and checking $X=1$, where $1$ is the group identity.

This contrasts with when we are limited to random queries: no such distinguisher is possible.