The PRF-ODH assumption basically says that the function value P R F ( g u v , x ∗ ) \color{red}{PRF(g^{uv},x^*)} PRF(guv,x∗) for a DH key g u v \color{red}{g^{uv}} guv looks random, even if given g u \color{red}{g^u} gu and g v \color{red}{g^v} gv and if seeing related values P R F ( S u , x ) \color{red}{PRF(S^u,x)} PRF(Su,x) and/or P R F ( T v , x ) \color{red}{PRF(T^v, x)} PRF(Tv,x) for chosen values S , T , x \color{red}{S,T,x} S,T,x.
Active adversary can submit a modified value S \color{red}{S} S instead of g v \color{red}{g^v} gv to the client, then it can obtain a related key P R F ( S u , . . . ) \color{red}{PRF(S^u, ...)} PRF(Su,...) on the clients’ side. The server’ session key is still P R F ( g u v , . . . ) \color{red}{PRF(g^{uv}, ...)} PRF(guv,...). The PRF-ODH assumption guarantees now that the server’s key is still fresh.
Simple authentication of transmissions cannot remedy the above problem. Since the adversary could use a corrupted server’s key to achieve authenticaiton. Then the Diffie–Hellman keys in the executions would still be non-trivially related. This happens especially if keys are used in multiple sessions.
[CRYPTO 2017] PRF-ODH: Relations, Instantiations, and Impossibility Results