arXiv: Lower Bounds on Black-Box Constructions of Pseudorandom Functions

The publication is a theoretical computer science paper establishing mathematical limits on the efficiency of black-box constructions for pseudorandom functions. It does not introduce new regulations or amend existing legal text under the Digital Operational Resilience Act. Instead, it provides formal proof that certain cryptographic building blocks cannot be combined in a generic, modular way without incurring significant performance overhead. For compliance professionals, this is a technical signal, not a regulatory mandate.

The primary audience is financial entities and ICT third-party providers that fall under DORA’s scope, particularly those relying on cryptographic primitives for secure communications, authentication, or data integrity. Any organisation using pseudorandom functions within their operational resilience frameworks—such as banks, payment processors, or cloud service providers—should note that future system designs may need to account for these lower bounds, potentially affecting performance and security trade-offs.

Compliance teams should treat this as a horizon-scanning input, not an immediate action item. Review your current cryptographic implementations to see if they depend on black-box constructions that could become inefficient under this proof. Engage with your engineering or security teams to assess whether any planned upgrades to encryption or tokenisation protocols might be impacted. Document this assessment in your ICT risk management files, and monitor future papers or industry guidance that translate these theoretical limits into practical recommendations. No immediate filing or notification to regulators is required.