Module oprf 

Oblivious pseudorandom functions, RFC 9497, with the P256-SHA256 suite.

An OPRF lets a client learn F(k, input) for a server’s key k without the server learning the input or the client learning the key. The client blinds its input, the server evaluates the blinded value, and the client removes the blind. It is the building block of OPAQUE, of password hardening services that hold a pepper the database never sees, and of privacy-preserving tokens.

All three of RFC 9497’s modes:

• Mode::Oprf: the base protocol.
• Mode::Voprf: the server also proves, with a discrete-logarithm equality proof, that it used the key whose public half the client holds, so it cannot single a client out with a different key.
• Mode::Poprf: as VOPRF, with a public info string both sides see bound into the evaluation – a per-user or per-epoch tweak, which is how a hardening service can rate-limit or rotate by tweak.

use ic_ec::oprf::{blind, finalize, Mode, ServerKey};
let server = ServerKey::generate(Mode::Oprf, &mut rng)?;
let (state, blinded) = blind(Mode::Oprf, b"password", b"", None, &mut rng)?;
let (evaluated, _) = server.blind_evaluate(&blinded, b"", &mut rng)?;
let output = finalize(b"password", b"", &state, &blinded, &evaluated, None)?;
assert_eq!(output, server.evaluate(b"password", b"")?);

Elements are 33-byte compressed SEC1 points, scalars 32 bytes big-endian, a proof two scalars, and an output 32 bytes. Checked against every P-256 vector in RFC 9497 appendix A.3.

Structs

BlindState

What a client keeps between blinding and finalizing.

ServerKey

A server’s key for one mode.

Enums

Mode

Which of RFC 9497’s three protocols.

Constants

ELEMENT_LEN

Bytes in a serialized element.

MAX_BATCH

The most elements one batch may hold. Batches are worked on the stack, a point is 96 bytes, and this crate builds for targets with a few kilobytes of it.

OUTPUT_LEN

Bytes in an output.

PROOF_LEN

Bytes in a serialized proof.

SCALAR_LEN

Bytes in a serialized scalar.

Functions

blind

Blind input for evaluation.

diffie_hellman

Diffie-Hellman in this group as OPAQUE-3DH defines it for P-256: private * public, serialized as an element – the compressed point, not the bare x-coordinate ordinary ECDH yields. public is validated.

finalize

Finish one evaluation; see finalize_batch.

finalize_batch

Unblind a batch of evaluations, writing one output for each input.

self_test

The known-answer test: RFC 9497 appendix A.3.1.1, the OPRF mode’s first vector, evaluated with the derived key.

validate_element

Check that element is a valid serialized element: compressed, on the curve, not the identity. For protocols built on this group, such as OPAQUE, which receive keys in the same encoding.