Blocklisted Oblivious Pseudorandom Functions

TL;DR

This paper introduces a blocklisted oblivious pseudorandom function (OPRF) that prevents evaluation on inputs on a blocklist by embedding inputs into a metric space, enabling efficient and secure blocklist checks for applications like password security and malware detection.

Contribution

It extends traditional OPRFs by incorporating blocklist functionality through metric space embeddings, enabling efficient and secure input filtering.

Findings

Efficient implementation of blocklist checks within OPRF framework.

Application of blocklisted OPRF to password security and malware detection.

Supports repeated evaluations on the same input more efficiently.

Abstract

An oblivious pseudorandom function (OPRF) is a protocol by which a client and server interact to evaluate a pseudorandom function on a key provided by the server and an input provided by the client, without divulging the key or input to the other party. We extend this notion by enabling the server to specify a blocklist, such that OPRF evaluation succeeds only if the client's input is not on the blocklist. More specifically, our design gains performance by embedding the client input into a metric space, where evaluation continues only if this embedding does not cluster with blocklist elements. Our framework exploits this structure to separate the embedding and blocklist check to enable efficient implementations of each, but then must stitch these phases together through cryptographic means. Our framework also supports subsequent evaluation of the OPRF on the same input more efficiently. We demonstrate the use of our design for password blocklisting in augmented password-authenticated key exchange, and to MAC only executables that are not similar to ones on a blocklist of known malware.