Beyond-birthday secure domain-preserving PRFs from a single permutation