OPRF

Oblivious Pseudorandom Functions per RFC 9497. An OPRF lets a client learn F(serverKey, input) — a keyed pseudorandom value — without the server learning the input and without the client learning the key. It is the primitive behind Privacy Pass tokens, password-breach checks and password hardening (the server can pepper a password without ever seeing it), and private set intersection.

Two modes are provided per RFC 9497: oprf (base) and voprf (verifiable — the client can prove the server used the committed key, via a DLEQ proof carried in the evaluation). The partially-oblivious poprf mode is not yet exposed: the vendored @noble/curves does not implement it, so it will be added when upstream ships it rather than stubbed here. The base protocol is: the client blinds its input to a group element, the server blindEvaluates it with its secret key, and the client finalizes by un-blinding and hashing. Because un-blinding cancels the blind, the output depends only on the key and the input — a server-side evaluate produces the same value directly.

suite(name) returns the suite for one of the RFC 9497 ciphersuites — ristretto255-sha512 (the Privacy Pass default), p256-sha256, p384-sha384, or p521-sha512 — each exposing both shipped modes. Group and hash-to-curve operations come from the vendored @noble/curves. Byte arguments are Uint8Array / Buffer; returned elements and outputs are Uint8Array.

b.crypto.oprf.suite(name) #

Return the RFC 9497 OPRF suite for name — one of "ristretto255-sha512", "p256-sha256", "p384-sha384", or "p521-sha512" (case insensitive). The result is { name, oprf, voprf }; each mode object has the protocol functions:

• deriveKeyPair(seed, info) / generateKeyPair() → { secretKey, publicKey }
• blind(input) → { blind, blinded } (client)
• oprf.blindEvaluate(secretKey, blinded) → evaluation element; voprf.blindEvaluate(secretKey, publicKey, blinded) → { evaluated, proof } (server)
• oprf.finalize(input, blind, evaluation) / voprf.finalize(input, blind, evaluated, blinded, publicKey, proof) → output bytes (client; voprf verifies the proof and throws if it does not match publicKey)
• evaluate(secretKey, input) → output bytes (server-side, non-oblivious — equals the client's finalize output)

The partially-oblivious poprf mode is intentionally absent (not implemented by the vendored @noble/curves). Throws OprfError for an unknown suite name.

var s = b.crypto.oprf.suite("ristretto255-sha512");
var kp = s.oprf.deriveKeyPair(seed, Buffer.from("my-app"));
var c  = s.oprf.blind(Buffer.from("user@example.com"));   // client
var ev = s.oprf.blindEvaluate(kp.secretKey, c.blinded);   // server
var out = s.oprf.finalize(Buffer.from("user@example.com"), c.blind, ev);
// out === s.oprf.evaluate(kp.secretKey, Buffer.from("user@example.com"))

Last updated 2026-08-08T16:39:49.652Z by seeder.