[CFRG] Does OPRF/OPAQUE require full implementation of RFC 9380

[Stefan Santesson <[e-mail]>]

This question has lead to intense discussions in our project regarding 
implementation of OPRF in general and OPAQUE specifically.


Section 2.1 in OPR (RFC 9497) states:

"HashToGroup(x):  Deterministically maps an array of bytes x to an 
element of Group.  The map must ensure that, for any adversary receiving 
R = HashToGroup(x), it is computationally difficult to reverse the mapping."

Note that there are not even a "MUST" expressed here. Just a "must" and 
therefore not a requirement according to section 1.1.


It continues to say that "Security properties of this function are 
described in [RFC9380]".

This does not seem like a strong requirement either. Just guidance, 
given that you understand the security requirements here which seems to 
be "computationally difficult to reverse the mapping".


In our evaluation of OPAQUE we did not implement RFC 9380. We just used 
some very simplified functions:


@Override public ECPoint hashToGroup(byte[]elementData) {
   BigInteger inputScalar =new BigInteger(1,hashFunctions.hash(elementData)).mod(
     parameterSpec.getCurve().getOrder());
   return parameterSpec.getG().multiply(inputScalar);
}

@Override public BigInteger randomScalar() {
   return new BigInteger(512,RNG).mod(parameterSpec.getCurve().getOrder().subtract(BigInteger.ONE))
     .add(BigInteger.ONE);
}


This is then used to hash a password into an element before applying the 
OPRF blind at the client side.

Now this is just a mock for evaluation, but I have a hard time 
understanding the rationale why this simplified approach would not work 
in production.

The downside here is, for what I understand, that the "inputScalar" is 
known, and not just the result element. This is problematic for some use 
of hashToGroup, but I'm not sure there is any significant issues for use 
with OPRF Blind(password) function to blind the password input.

I would really appreciate help. Has this been discussed already to any 
detail. Is there any guidance available?

If this is not good enough. Can you take any simpler path than full RFC 
9380 implementation?

Finally, is there any support for G.hashToGroup being planned in any 
major libraries supporting OPRF/OPAQUE?


Thanks for any help.


-- 
________________
Stefan Santesson