Security News
tea.xyz Spam Plagues npm and RubyGems Package Registries
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
@cloudflare/voprf-ts
Advanced tools
Readme
An Oblivious Pseudorandom Function (OPRF) is a two-party protocol between a client and server for computing the output of a Pseudorandom Function (PRF).
The server provides the PRF secret key, and the client provides the PRF input. At the end of the protocol, the client learns the PRF output without learning anything about the PRF secret key, and the server learns neither the PRF input nor output.
A verifiable OPRF (VOPRF) ensures clients can verify that the server used a specific private key during the execution of the protocol.
A partially-oblivious (POPRF) extends a VOPRF allowing the client and server to provide public shared input to the PRF computation.
This library supports all three modes:
Oprf.Mode.OPRF
Oprf.Mode.VOPRF
Oprf.Mode.POPRF
and supports three suites corresponding to the underlying group and hash used:
Oprf.Suite.P256_SHA256
Oprf.Suite.P384_SHA384
Oprf.Suite.P521_SHA512
Specification: Compliant with IETF draft-irtf-cfrg-voprf and tests vectors match with v21.
First set up a client and a server. In this case, we use the VOPRF mode with suite P384-SHA384.
import {
Oprf, VOPRFClient, VOPRFServer, generatePublicKey, randomPrivateKey
} from '@cloudflare/voprf-ts';
const suite = Oprf.Suite.P384_SHA384;
const privateKey = await randomPrivateKey(suite);
const publicKey = generatePublicKey(suite, privateKey);
const server = new VOPRFServer(suite, privateKey);
const client = new VOPRFClient(suite, publicKey);
The client prepares arbitrary input[s] that will be batch evaluated by the server. The blinding method produces an evaluation request, and some finalization data to be used later. Then, the client sends the evaluation request to the server.
const input = new TextEncoder().encode("This is the client's input");
const batch = [input]
const [finData, evalReq] = await client.blind(batch);
Once the server received the evaluation request, it responds to the client with an evaluation.
const evaluation = await server.blindEvaluate(evalReq);
Finally, the client can produce the output[s] of the OPRF protocol using the server's evaluation and the finalization data from the second step. If the mode is verifiable, this step allows the client to check the proof that the server used the expected private key for the evaluation.
// Get output matching first input of batch
const [output] = await client.finalize(finData, evaluation);
Task | NPM scripts |
---|---|
Installing | $ npm ci |
Building | $ npm run build |
Unit Tests | $ npm run test |
Examples | $ npm run examples |
Benchmarking | $ npm run bench |
Code Linting | $ npm run lint |
Code Formatting | $ npm run format |
Dependencies
This project uses the Stanford Javascript Crypto Library sjcl. Support for elliptic curves must be enabled by this compilation step, which produces the necessary files inside the src/sjcl folder.
$ make -f sjcl.Makefile
The project is licensed under the BSD-3-Clause License.
FAQs
voprf-ts: A TypeScript Library for Oblivious Pseudorandom Functions (OPRF)
The npm package @cloudflare/voprf-ts receives a total of 940 weekly downloads. As such, @cloudflare/voprf-ts popularity was classified as not popular.
We found that @cloudflare/voprf-ts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 31 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.
Security News
UnitedHealth Group disclosed that the ransomware attack on Change Healthcare compromised protected health information for millions in the U.S., with estimated costs to the company expected to reach $1 billion.