Re: [Cfrg] Adoption call for draft-sullivan-cfrg-voprf

[Alex Davidson <[e-mail]>]

Hi all,

I’m one of the authors of this draft.

> Perhaps the draft’s authors can clarify here on the extent to which there is a dependency on other drafts, especially the ristretto draft (which is not a CFRG document, currently).

The only hard dependency of this draft is on the specification of the hash-to-curve algorithm that is made in https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-03 <https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-03>. The dependency on the Ristretto draft is made only as a plausible cryptographic configuration for using OPRFs. We are happy to remove the dependency on Ristretto and specify a different set of ciphersuites focusing only on the NIST curves and others such as Curve25519, for example. In general, it would be useful for us to have a wider discussion with the community on what parameter/curve settings are suitable for our use-case.

>  
> I think this draft does fit with the CFRG charter, in that VOPRFs are an emerging cryptographic mechanism that at least some people here see as being useful in contexts traditionally associated with IETF. Again, the authors of the draft can explain their intended applications better than me, but I think a good starting point if you are interested in knowing more would be:
>  
> https://petsymposium.org/2018/files/papers/issue3/popets-2018-0026.pdf <https://petsymposium.org/2018/files/papers/issue3/popets-2018-0026.pdf>
Other applications that feature OPRFs as dependencies include password-protected secret-sharing (https://eprint.iacr.org/2014/650.pdf <https://eprint.iacr.org/2014/650.pdf>), password-authenticated key-exchange (https://tools.ietf.org/html/draft-krawczyk-cfrg-opaque-01 <https://tools.ietf.org/html/draft-krawczyk-cfrg-opaque-01>) and hiding password-storage (http://webee.technion.ac.il/~hugo/sphinx.pdf <http://webee.technion.ac.il/~hugo/sphinx.pdf>). In particular, the current version of the OPAQUE draft (draft-krawczyk-cfrg-opaque) lists draft-sullivan-cfrg-voprf as a dependency. There are also many applications in general secure computation research literature (such as constructions of protocols for private set intersection).

Thanks,
Alex