A precomputation attack prepares a huge collection of candidate cryptographic values before a target compromise. When a database is later exposed, the attacker searches the collection instead of recomputing every guess. section 11.2.2
A typical password-authentication attack proceeds like this:
- Obtain a user-specific salt or other information needed to derive candidate keys. section 11.2.2
- Compute many candidate asymmetric private keys and their corresponding public keys offline. section 11.2.2
- After a database breach, compare stored public keys with the precomputed collection and recover matching passwords. section 11.2.2
- Use an OPRF-based design such as OPAQUE to force guesses through online, rate-limitable queries rather than offline computation. section 11.2.2
Alice logs in from another device
An attacker receives Alice’s salt, precomputes a large password-to-key list, and waits for a database compromise. OPRF-based derivation prevents this preparation by requiring server interaction for each guess; the server can then limit attempts, such as ten sign-ins per hour. section 11.2.2
Figure 11.4 An oblivious PRF (OPRF) is a construction that allows one party to compute a PRF over the input of another party without learning that input. To do this, Alice first generates a random blinding factor, then blinds her input with that before sending it to Bob. Bob uses his secret key to compute the PRF over the blinded value, then sends the blinded output to Alice who can unblind it. The result does not depend on the value of the blinding factor.
The OPRF flow shows how blinding lets the server evaluate a password-derived function without learning the password, supporting the online-query defense. section 11.2.2
