An oblivious pseudorandom function (OPRF) lets one party obtain a pseudorandom-function result for a secret input without revealing the input to the key holder or the key to the input holder. section 11.2.2
A typical OPRF exchange proceeds in four steps:
- Alice converts her input into a group element and blinds it with a fresh random blinding factor. section 11.2.2
- Alice sends the blinded input to Bob, who applies the PRF using his secret key. section 11.2.2
- Bob returns the still-blinded result, which is useless to him without Alice’s blinding factor. section 11.2.2
- Alice unblinds the result to obtain the real PRF output; the output stays consistent for the same input despite fresh blinding factors. section 11.2.2
Private set intersection
Alice obtains OPRF values for every word in her list, while Bob computes values for his own words. Comparing the values reveals matching words without revealing either original list. section 15.1.1
Figure 11.4 An oblivious PRF (OPRF) is a construction that allows one party to compute a PRF over the input of another party without learning that input. To do this, Alice first generates a random blinding factor, then blinds her input with that before sending it to Bob. Bob uses his secret key to compute the PRF over the blinded value, then sends the blinded output to Alice who can unblind it. The result does not depend on the value of the blinding factor.
Follow the protocol flow from blinding through keyed evaluation to unblinding. section 11.2.2
