[Book] Note Privacy (OOB) actually depends on PRFness of PRF^expand

[defuse]

https://zcash.github.io/orchard/design/nullifiers.html

The argument that Note Privacy (OOB) is near-perfect relies on \psi being chosen independently at random. Since \psi is the output of PRF^expand_rseed, Note Privacy (OOB) must assume PRF^expand_rseed is a PRF. This should be clarified in the table.

(PRF^expand_rseed is called KDF^\psi in the book).

[daira]

I think only WeakPRF is needed. Also, the derivation of ψ using PRF^expand is part of note encryption/decryption, and not strictly speaking required by the rest of the protocol.