The Pseudo-Random Function (PRF) primitive lets you produce stable, arbitrary
length, pseudo-random outputs for a given input.

Since Tink operates on [keysets](https://developers.google.com/tink/design/keysets), this primitive exposes a
corresponding set of PRFs instead of a single PRF. The PRFs are indexed by a 32
bit key ID. This can be used to rotate the key used to redact a piece of
information, without losing the previous association.

PRF has the following properties:

- **Deterministic**: Computing a PRF for a given input will always produce the same output.
- **Randomness**: The output of a PRF is indistinguishable from random bytes.

> [!CAUTION]
> **Caution:** Since PRFs operate deterministically on their input, using a PRF to redact will *not* provide anonymity, but only provide pseudonymity. It can be an important tool to build privacy-aware systems, but has to be used carefully.

## Choose a key type

We recommend using **`HMAC_SHA256_PRF`** for most uses, but there are other
options as well.

In general, the following holds true:

- `HMAC_SHA512_PRF` may or may not be faster depending on your input size and the specifics of the hardware you use.
- `HMAC_SHA512_PRF` is the most conservative mode that can be used for practically unlimited number of messages.
- `AES_CMAC_PRF` is fastest on systems that support the [AES-NI](https://www.intel.com/content/www/us/en/developer/articles/technical/advanced-encryption-standard-instructions-aes-ni.html) hardware acceleration.

> [!CAUTION]
> **Caution:** While `HMAC_SHA256_PRF`, `HMAC_SHA512_PRF`, and `HKDF_SHA256` behave like a cryptographically secure hash function if the key is revealed, and still provide some protection against revealing the input, `AES_CMAC_PRF` is only secure as long as the key is secure.

## Minimal security guarantees

- Without knowledge of the key, the PRF is indistinguishable from a random function
- At least 128-bit security, also in multi-user scenarios (when an attacker is not targeting a specific key, but any key from a set of up to 2^32^ keys)
- At least 16 bytes of output available

## Example use cases

Use cases for PRF include deterministic redaction of personally identifiable
information (PII), keyed hash functions, and creating sub-IDs that don't allow
joining with the original dataset without knowing the key.

While PRFs can be used in order to prove authenticity of a message, using the
[MAC primitive](https://developers.google.com/tink/mac) is recommended for that use case, as it has support for
verification, avoiding the security problems that often happen during
verification, and having automatic support for key rotation. It also allows for
non-deterministic algorithms.