<p>The desirable encryption scheme combines high security with high efficiency for variable-length outputs. To increase security and since designing dedicated secure <Emphasis FontCategory="SansSerif">PRF</Emphasis>s as building blocks for encryption schemes is difficult, various works have studied building optimally secure <Emphasis FontCategory="SansSerif">PRF</Emphasis>s from the sum of independent permutations (<Emphasis FontCategory="SansSerif">SoP</Emphasis>), which led to Encrypted Davies–Meyer (<Emphasis FontCategory="SansSerif">EDM</Emphasis>), its dual (<Emphasis FontCategory="SansSerif">EDMD</Emphasis>), and the Summation-Truncation Hybrid (<Emphasis FontCategory="SansSerif">STH</Emphasis>). To increase efficiency, reducing the number of rounds in primitives has gained traction, as shown, e.g., in <Emphasis FontCategory="SansSerif">AEZ</Emphasis> or Andreeva et al.’s <Emphasis FontCategory="SansSerif">ForkCipher</Emphasis>s. While both directions, the use of sums of permutations and the use of round-reduced and forked constructions, have shown to be valuable on their own, their combination could give rise to primitives that provided both advantages, as <Emphasis FontCategory="SansSerif">FastPRF</Emphasis> indicated. However, this combination has lacked a systematic study so far. This paper aims to address the lack of systematism. We suggest a categorization of sum-based <Emphasis FontCategory="SansSerif">PRF</Emphasis> constructions in terms of three desiderata: (1) birthday-bound vs. optimal <Emphasis FontCategory="SansSerif">PRF</Emphasis> security, (2) fixed- vs. variable-length outputs, as well as constructions from (3) full vs. reduced-round primitives. This categorization allows us to easily identify previously unaddressed gaps that we fill with secure and efficient fixed- and variable-output-length <Emphasis FontCategory="SansSerif">PRF</Emphasis>s: we fork <Emphasis FontCategory="SansSerif">SoP</Emphasis> and <Emphasis FontCategory="SansSerif">STH</Emphasis> to obtain <Emphasis FontCategory="SansSerif">ForkSoP</Emphasis> and <Emphasis FontCategory="SansSerif">ForkSTH</Emphasis>, respectively; we extend <Emphasis FontCategory="SansSerif">STH</Emphasis> to the variable-output-length construction <Emphasis FontCategory="SansSerif">XTH</Emphasis>, and propose <Emphasis FontCategory="SansSerif">ForkXORP</Emphasis>, <Emphasis FontCategory="SansSerif">ForkXTH</Emphasis>, as well as <Emphasis FontCategory="SansSerif">ForkEDMXORP</Emphasis> and <Emphasis FontCategory="SansSerif">ForkEDMDXORP</Emphasis> as the variable-output-length and forked versions of <Emphasis FontCategory="SansSerif">XORP</Emphasis>, <Emphasis FontCategory="SansSerif">STH</Emphasis>, <Emphasis FontCategory="SansSerif">FastPRF</Emphasis>, and <Emphasis FontCategory="SansSerif">FastPRF</Emphasis>’s dual, respectively. Among them, we identify <Emphasis FontCategory="SansSerif">ForkXORP</Emphasis>, <Emphasis FontCategory="SansSerif">ForkEDMXORP</Emphasis>, and <Emphasis FontCategory="SansSerif">ForkEDMDXORP</Emphasis> as variable-output-length <Emphasis FontCategory="SansSerif">PRF</Emphasis>s that can achieve close to optimal security and very high efficiency. We prove almost optimal <Emphasis FontCategory="SansSerif">PRF</Emphasis> security for their non-forked counterparts <Emphasis FontCategory="SansSerif">EDMXORP</Emphasis> and <Emphasis FontCategory="SansSerif">EDMDXORP</Emphasis> under the reasonable assumption that the underlying permutations are pairwise independent. To demonstrate their excellent efficiency in practice, we propose instantiations based on the <Emphasis FontCategory="SansSerif">AES</Emphasis> round function for <Emphasis FontCategory="SansSerif">ForkEDMDXORP</Emphasis> and <Emphasis FontCategory="SansSerif">ForkXORP</Emphasis> that need only 0.40 cycles per byte or less on current off-the-shelf processors and support them with cryptanalysis against the most relevant attacks.</p>