Re: [Cfrg] Adoption call for draft-sullivan-cfrg-voprf

[Hugo Krawczyk <[e-mail]>]

Hi David, to use a V-OPRF the client needs to store the public key Y=kG
corresponding to the server's OPRF key k. In the OPAQUE setting we do not
assume that the user carries any public key with her. The only information
the user carries is the password (and account information where to login).
This makes OPAQUE immune to PKI failures.

Hugo

On Tue, May 14, 2019 at 11:23 AM David Wong <[e-mail]>
wrote:

> Hey all,
>
> I’m very interested in the verifiability of the OPRF.
> Note that OPAQUE also mentions this draft currently:
> https://tools.ietf.org/html/draft-krawczyk-cfrg-opaque-01
> I would be interested in knowing why OPAQUE doesn’t want to use a VOPRF
>
> I support the adoption of this draft.
>
> Cheers,
> David
>
> On May 9, 2019, at 2:44 AM, Alex Davidson <
> adavidson=[e-mail]> wrote:
>
> Hi all,
>
> I’m one of the authors of this draft.
>
> Perhaps the draft’s authors can clarify here on the extent to which there
> is a dependency on other drafts, especially the ristretto draft (which is
> not a CFRG document, currently).
>
>
> The only hard dependency of this draft is on the specification of the
> hash-to-curve algorithm that is made in
> https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-03. The
> dependency on the Ristretto draft is made only as a plausible cryptographic
> configuration for using OPRFs. We are happy to remove the dependency on
> Ristretto and specify a different set of ciphersuites focusing only on the
> NIST curves and others such as Curve25519, for example. In general, it
> would be useful for us to have a wider discussion with the community on
> what parameter/curve settings are suitable for our use-case.
>
>
> I think this draft does fit with the CFRG charter, in that VOPRFs are an
> emerging cryptographic mechanism that at least some people here see as
> being useful in contexts traditionally associated with IETF. Again, the
> authors of the draft can explain their intended applications better than
> me, but I think a good starting point if you are interested in knowing more
> would be:
>
> *https://petsymposium.org/2018/files/papers/issue3/popets-2018-0026.pdf
> <https://petsymposium.org/2018/files/papers/issue3/popets-2018-0026...pdf>*
>
>
> Other applications that feature OPRFs as dependencies include
> password-protected secret-sharing (https://eprint.iacr.org/2014/650.pdf),
> password-authenticated key-exchange (
> https://tools.ietf.org/html/draft-krawczyk-cfrg-opaque-01) and hiding
> password-storage (http://webee.technion.ac.il/~hugo/sphinx.pdf). In
> particular, the current version of the OPAQUE draft
> (draft-krawczyk-cfrg-opaque) lists draft-sullivan-cfrg-voprf as a
> dependency. There are also many applications in general secure computation
> research literature (such as constructions of protocols for private set
> intersection).
>
> Thanks,
> Alex
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg
>
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg
>