oprf

Overview ¶

Package oprf provides Verifiable, Oblivious Pseudo-Random Functions.

An Oblivious Pseudorandom Function (OPRFs) is a two-party protocol for computing the output of a PRF. One party (the server) holds the PRF secret key, and the other (the client) holds the PRF input.

This package is compatible with the OPRF specification at draft-irtf-cfrg-voprf [1].

Protocol Overview ¶

This diagram shows the steps of the protocol that are common for all operation modes.

Client(info*)                               Server(sk, pk, info*)
=================================================================
finData, evalReq = Blind(input)

                            evalReq
                          ---------->

                            evaluation = Evaluate(evalReq, info*)

                           evaluation
                          <----------

output = Finalize(finData, evaluation, info*)

Operation Modes ¶

Each operation mode provides different properties to the PRF.

Base Mode: Provides obliviousness to the PRF evaluation, i.e., it ensures that the server does not learn anything about the client's input and output during the Evaluation step.

Verifiable Mode: Extends the Base mode allowing the client to verify that Server used the private key that corresponds to the public key.

Partial Oblivious Mode: Extends the Verifiable mode by including shared public information to the PRF input.

All three modes can perform batches of PRF evaluations, so passing an array of inputs will produce an array of outputs.

References ¶

[1] draft-irtf-cfrg-voprf: https://datatracker.ietf.org/doc/draft-irtf-cfrg-voprf

suite := SuiteP256
//                                  Server(sk, pk, info*)
private, _ := GenerateKey(suite, rand.Reader)
server := NewServer(suite, private)
//   Client(info*)
client := NewClient(suite)
//   =================================================================
//   finData, evalReq = Blind(input)
inputs := [][]byte{[]byte("first input"), []byte("second input")}
finData, evalReq, _ := client.Blind(inputs)
//
//                               evalReq
//                             ---------->
//
//                               evaluation = Evaluate(evalReq, info*)
evaluation, _ := server.Evaluate(evalReq)
//
//                              evaluation
//                             <----------
//
//   output = Finalize(finData, evaluation, info*)
outputs, err := client.Finalize(finData, evaluation)
fmt.Print(err == nil && len(inputs) == len(outputs))

Output:

true