Oblivious Pseudorandom Function (OPRF)

The core guarantee of an OPRF is that the server learns nothing about the client's input value x. The protocol execution reveals zero information about x beyond what could be inferred from the output itself. This is achieved through blinding techniques where the client masks its input before sending it to the server.

• The client's input is hidden information-theoretically or computationally.
• This property is critical for Contact Discovery and Private Set Intersection (PSI) , where the client's query must remain confidential.
• Even a malicious server cannot extract the raw input from the protocol transcript.

The server's secret key k is the critical private parameter that defines the pseudorandom function. The OPRF protocol ensures the client learns nothing about k beyond what is trivially learnable from the output F(k, x).

• The client cannot compute F(k, x') for any x' ≠ x without engaging in a new protocol execution.
• This prevents the client from evaluating the PRF on arbitrary inputs, which is essential for rate-limiting and security in protocols like OPAQUE (asymmetric password-authenticated key exchange).
• The key remains confidential even against a malicious client mounting an active attack.

For a fixed server key k and client input x, the OPRF output y = F(k, x) is always the same. This determinism is what makes OPRFs useful as building blocks for private set intersection.

• If two clients query the same input x, they receive identical outputs.
• This allows a server to compare encrypted sets without seeing the raw elements.
• The output is pseudorandom, meaning it is computationally indistinguishable from a truly random string to anyone who does not know k or x.

A standard OPRF does not prevent a malicious server from using a different key for each query, breaking output consistency. A Verifiable OPRF (VOPRF) extends the protocol with a zero-knowledge proof that binds the server to a single, committed key.

• The server publishes a public key pk corresponding to its secret key k.
• During the protocol, the server provides a proof that the evaluation was performed correctly using the committed key.
• This is essential for Privacy Pass and anonymous token redemption systems where unlinkability must be guaranteed.

A Partially Oblivious PRF (POPRF) allows the server to bind a public, non-secret metadata string t to the evaluation. The client learns F(k, x, t), but the server still learns nothing about x.

• The metadata t can encode an expiration date, a rate-limiting epoch, or a context tag.
• This prevents a client from using an output from one context in another.
• POPRFs are a key component in the OPAQUE protocol for password-authenticated key exchange, where t binds the evaluation to a specific user session.

A Threshold OPRF (TOPRF) distributes the server's secret key k across multiple independent servers using secret sharing. The client must interact with a threshold number of servers to reconstruct the final output.

• No single server ever holds the full key, eliminating a single point of compromise.
• The client's input x remains hidden from all servers as long as fewer than the threshold collude.
• This architecture is used in production password managers and privacy-preserving authentication systems to ensure that a breach of any single server does not expose user secrets.

A foundational cryptographic protocol where a sender holds multiple messages and a receiver selects one. The sender remains oblivious to which message was chosen, and the receiver learns nothing about the unselected messages. OPRFs are often constructed directly from OT, making this the most critical primitive to understand. 1-out-of-2 OT is the standard variant, where the sender inputs two strings and the receiver's choice bit determines which one is delivered.

A cryptographic technique that efficiently generates millions of oblivious transfers from a small number (typically 128) of base OTs using only fast symmetric-key operations. This is the engine that makes OPRFs practical at scale. Without OT extension, each OT would require expensive public-key operations. The IKNP protocol is the seminal construction, with modern variants like Ferret OT achieving throughput exceeding 10 million OTs per second on commodity hardware.

A cryptographic primitive where two parties generate a long vector of correlated oblivious linear evaluations. The sender learns a random vector and a scalar key; the receiver learns a vector that is the sender's vector multiplied by a scalar of their choice, plus an offset. VOLE enables extremely fast, low-communication OPRFs and forms the backbone of state-of-the-art PSI protocols. It can be instantiated from OT extension or lattice-based assumptions for post-quantum security.

The classic OPRF construction based on the computational Diffie-Hellman assumption in prime-order groups. The server holds a secret key k; the client blinds their input x as H(x)^r for a random r. The server applies its key to return H(x)^{rk}, and the client removes the blinding factor r to obtain H(x)^k. This construction is simple, round-efficient, and widely deployed in systems like Privacy Pass for anonymous authentication tokens.

An extension of the standard OPRF where the server can prove to the client that the output is correct with respect to a committed key, without revealing the key itself. This prevents a malicious server from substituting different keys per query to learn the client's input. VOPRFs are standardized in RFC 9497 and are critical for applications like password-authenticated key exchange and privacy-preserving token redemption where server misbehavior must be detectable.

A variant where the server learns a public metadata tag associated with the client's query, while the private input remains hidden. This enables rate-limiting and abuse prevention without sacrificing privacy. For example, a server can enforce per-domain token quotas while remaining oblivious to the specific URLs a client accesses. This construction bridges the gap between fully oblivious evaluation and practical deployment constraints requiring some server-side policy enforcement.