409 lines
16 KiB
Markdown
409 lines
16 KiB
Markdown
# Lattice-Based OPAQUE Implementation Plan
|
|
|
|
## Executive Summary
|
|
|
|
This document outlines the strategy for implementing a **true post-quantum OPAQUE** protocol using lattice-based cryptography. The implementation uses:
|
|
- **Ring-LPR OPRF** (Learning Parity with Rounding over Rings) for oblivious password evaluation
|
|
- **ML-KEM (Kyber768)** for authenticated key exchange
|
|
- **ML-DSA (Dilithium3)** for server authentication signatures
|
|
|
|
## Architecture Overview
|
|
|
|
```
|
|
┌─────────────────────────────────────────────────────────────────────┐
|
|
│ POST-QUANTUM OPAQUE │
|
|
├─────────────────────────────────────────────────────────────────────┤
|
|
│ │
|
|
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │
|
|
│ │ Ring-LPR │ │ Kyber768 │ │ Dilithium3 │ │
|
|
│ │ OPRF │ │ KEM │ │ Signatures │ │
|
|
│ │ │ │ │ │ │ │
|
|
│ │ F_k(x) = │ │ Encap/Decap │ │ Sign/Verify │ │
|
|
│ │ ⌊k·H(x)⌋₁ │ │ │ │ │ │
|
|
│ └──────────────┘ └──────────────┘ └──────────────┘ │
|
|
│ │ │ │ │
|
|
│ └──────────────────┼──────────────────┘ │
|
|
│ │ │
|
|
│ ┌───────▼───────┐ │
|
|
│ │ OPAQUE │ │
|
|
│ │ Protocol │ │
|
|
│ └───────────────┘ │
|
|
│ │
|
|
└─────────────────────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
## Ring-LPR OPRF Construction (Shan et al. 2025)
|
|
|
|
### Mathematical Foundation
|
|
|
|
**Ring Definition**: R = Z[x]/(x^n + 1) where n is a power of 2 (we use n=256)
|
|
|
|
**Ring-LPR Problem** (Definition 12 from paper):
|
|
For elements a, s, u ∈ R₂, the following distributions are computationally indistinguishable:
|
|
```
|
|
(a, ⌊a·s mod 4⌋₁) ≈_C (a, ⌊u⌋₁)
|
|
```
|
|
|
|
**Security Reduction Chain**:
|
|
```
|
|
Ring-LPR → LPR → LWR → G-EDCP → DCP (Dihedral Coset Problem)
|
|
```
|
|
DCP has time complexity O(e^n) even for quantum computers.
|
|
|
|
### OPRF Protocol Flow
|
|
|
|
```
|
|
Client Server
|
|
│ │
|
|
│ input: password │ secret: k ∈ R₂
|
|
│ │
|
|
│ 1. h = H₁(password) ∈ R₂ │
|
|
│ 2. Generate blind: b ∈ R₂ │
|
|
│ 3. blinded = h + b │
|
|
│ │
|
|
│ ──────── blinded, OT_setup ──────────► │
|
|
│ │ 4. Compute v = ⌊k·blinded mod 4⌋₁
|
|
│ │ 5. Prepare OT responses
|
|
│ ◄─────── OT_response, aux ──────────── │
|
|
│ │
|
|
│ 6. Unblind using OT results │
|
|
│ 7. output = H₂(unblinded) │
|
|
│ │
|
|
```
|
|
|
|
### Key Properties
|
|
|
|
| Property | How Achieved |
|
|
|----------|--------------|
|
|
| **Obliviousness** | Oblivious Transfer hides client's selection bits |
|
|
| **Determinism** | Rounding ⌊·⌋₁ is deterministic (same input → same output) |
|
|
| **Post-Quantum** | Ring-LPR reduces to DCP (quantum-hard) |
|
|
| **Efficiency** | O(n log n) via NTT, ~8-16ms per evaluation |
|
|
|
|
## Component Implementation Status
|
|
|
|
| Component | Implementation | Status |
|
|
|-----------|---------------|--------|
|
|
| Ring Arithmetic | `oprf/ring.rs` | ✅ Implemented |
|
|
| Hash-to-Ring H₁ | `oprf/ring.rs` | ✅ Implemented |
|
|
| Rounding ⌊·⌋₁ | `oprf/ring.rs` | ✅ Implemented |
|
|
| Oblivious Transfer | `oprf/ot.rs` | ✅ Implemented |
|
|
| Ring-LPR OPRF | `oprf/ring_lpr.rs` | ✅ Implemented |
|
|
| **Fast OPRF (OT-free)** | `oprf/fast_oprf.rs` | ✅ Implemented (experimental) |
|
|
| **Verifiable OPRF** | `oprf/voprf.rs` | ✅ Implemented |
|
|
| Password Hardening | Argon2id | ✅ Implemented |
|
|
| Kyber768 KEM | `ake/kyber.rs` | ✅ Implemented |
|
|
| Dilithium3 Signatures | `ake/dilithium.rs` | ✅ Implemented |
|
|
| Envelope Store/Recover | `envelope/mod.rs` | ✅ Implemented |
|
|
| Registration Flow | `registration.rs` | ✅ Implemented |
|
|
| Login Flow | `login.rs` | ✅ Implemented |
|
|
|
|
## OPAQUE Protocol Flows
|
|
|
|
### Registration
|
|
|
|
```
|
|
Client Server
|
|
│ │
|
|
│ 1. pw_hash = Argon2id(password, salt) │
|
|
│ 2. (state, blind) = OPRF.Blind(pw_hash)│
|
|
│ │
|
|
│ ─────────── blind ──────────────────► │
|
|
│ │ 3. eval = OPRF.Evaluate(seed, blind)
|
|
│ ◄────────── eval ─────────────────── │
|
|
│ │
|
|
│ 4. rw = OPRF.Finalize(state, eval) │
|
|
│ 5. envelope = Encrypt(rw, client_keys) │
|
|
│ │
|
|
│ ─────────── record ─────────────────► │ 6. Store(user_id, record)
|
|
```
|
|
|
|
### Login (KE1 → KE2 → KE3)
|
|
|
|
```
|
|
Client Server
|
|
│ │
|
|
│ KE1: OPRF blind + ephemeral Kyber pk │
|
|
│ ─────────────────────────────────────►│
|
|
│ │ KE2: OPRF eval + Kyber ct + MAC
|
|
│ ◄─────────────────────────────────────│ + Dilithium signature
|
|
│ │
|
|
│ Verify signature, recover envelope │
|
|
│ Derive session key │
|
|
│ │
|
|
│ KE3: Client MAC │
|
|
│ ─────────────────────────────────────►│ Verify MAC, derive session key
|
|
```
|
|
|
|
## Security Analysis
|
|
|
|
### Threat Model
|
|
|
|
| Adversary | Protection |
|
|
|-----------|------------|
|
|
| Passive network | Kyber KEM encryption |
|
|
| Active network | Dilithium signatures + MACs |
|
|
| Malicious server | Ring-LPR OPRF (server cannot offline attack) |
|
|
| Quantum computer | All primitives are post-quantum |
|
|
|
|
### Security Properties
|
|
|
|
1. **Password Obliviousness**: Server learns nothing about password during OPRF evaluation
|
|
2. **Forward Secrecy**: Ephemeral Kyber keys provide FS
|
|
3. **Server Compromise Resistance**: OPRF output cannot be computed without client interaction
|
|
4. **Quantum Resistance**: Ring-LPR, Kyber, Dilithium all resist quantum attacks
|
|
|
|
### Known Limitations
|
|
|
|
1. **Communication Overhead**: ~2-4KB messages (vs ~200 bytes for EC-based OPAQUE)
|
|
2. **Computational Cost**: ~10-20ms OPRF (vs ~1ms for DH-based)
|
|
|
|
## Verifiable OPRF (VOPRF) Extension
|
|
|
|
The implementation includes a **Verifiable OPRF** that allows clients to verify the server used a consistent, previously committed key.
|
|
|
|
### VOPRF Construction
|
|
|
|
```
|
|
Server Setup:
|
|
1. Generate key k ∈ R₂
|
|
2. Sample nonce r ←$ {0,1}^256
|
|
3. Commit: c = H₃(k || r)
|
|
4. Publish commitment c
|
|
|
|
Verifiable Evaluation:
|
|
1. Compute y = F_k(x)
|
|
2. Generate ZK proof π:
|
|
- Sample mask m with small coefficients
|
|
- Compute t = H(m || m·H₁(x))
|
|
- Challenge e = H(c || t || x || y)
|
|
- Response z = m + e·k (with rejection sampling)
|
|
3. Return (y, π)
|
|
|
|
Client Verification:
|
|
1. Check ||z||_∞ < B (bounded response)
|
|
2. Recompute challenge e' = H(c || t || x || y)
|
|
3. Verify e' = e
|
|
```
|
|
|
|
### Sigma Protocol Security
|
|
|
|
| Property | Guarantee |
|
|
|----------|-----------|
|
|
| **Completeness** | Honest prover always convinces verifier |
|
|
| **Soundness** | Cheating prover detected with prob ≥ 1 - 2^(-128) |
|
|
| **Zero-Knowledge** | Proof reveals nothing about k |
|
|
| **Non-Interactive** | Fiat-Shamir transform in ROM |
|
|
|
|
Based on Lyubashevsky's "Fiat-Shamir with Aborts" (2009, 2012).
|
|
|
|
## UC Security Proof
|
|
|
|
Full UC security proof is documented in `SECURITY_PROOF.md`. Key results:
|
|
|
|
### Ideal Functionalities
|
|
|
|
- **F_VOPRF**: Verifiable OPRF with key commitment
|
|
- **F_AKE**: Authenticated Key Exchange
|
|
- **F_aPAKE**: Asymmetric Password-Authenticated Key Exchange
|
|
|
|
### Main Theorem
|
|
|
|
The opaque-lattice protocol UC-realizes F_aPAKE assuming:
|
|
1. Ring-LPR is pseudorandom
|
|
2. ML-KEM is IND-CCA2 secure
|
|
3. ML-DSA is EUF-CMA secure
|
|
4. AEAD is IND-CPA + INT-CTXT secure
|
|
|
|
### Security Bounds
|
|
|
|
```
|
|
Adv(A) ≤ q_pwd · Adv_LPR + q_KEM · Adv_IND-CCA + q_SIG · Adv_EUF-CMA + negl(λ)
|
|
```
|
|
|
|
### Proof Technique
|
|
|
|
Game-hopping sequence:
|
|
1. Game 0: Real protocol
|
|
2. Game 1: Random oracle instrumentation
|
|
3. Game 2: OPRF simulation (Ring-LPR → random)
|
|
4. Game 3: KEM simulation (IND-CCA)
|
|
5. Game 4: Signature simulation (EUF-CMA)
|
|
6. Game 5: Envelope simulation (AEAD)
|
|
7. Game 6: Password test restriction
|
|
8. Game 7: Ideal execution with F_aPAKE
|
|
|
|
## Module Structure
|
|
|
|
```
|
|
opaque-lattice/
|
|
├── Cargo.toml
|
|
├── PLAN.md
|
|
├── papers/ # Research references (65 PDFs)
|
|
└── src/
|
|
├── lib.rs
|
|
├── error.rs
|
|
├── kdf.rs # HKDF-SHA512
|
|
├── mac.rs # HMAC-SHA512
|
|
├── types.rs # Protocol message types
|
|
├── registration.rs # Registration protocol
|
|
├── login.rs # Login protocol (KE1/KE2/KE3)
|
|
├── oprf/
|
|
│ ├── mod.rs
|
|
│ ├── ring.rs # Ring arithmetic R = Z[x]/(x^n+1)
|
|
│ ├── ot.rs # Oblivious transfer
|
|
│ ├── ring_lpr.rs # Ring-LPR OPRF (OT-based, Shan et al.)
|
|
│ ├── fast_oprf.rs # Fast OPRF (OT-free, experimental)
|
|
│ ├── voprf.rs # Verifiable OPRF with ZK proofs
|
|
│ └── hybrid.rs # [DEPRECATED] Old hybrid OPRF
|
|
├── ake/
|
|
│ ├── mod.rs
|
|
│ ├── kyber.rs # Kyber768 KEM
|
|
│ └── dilithium.rs # Dilithium3 signatures
|
|
└── envelope/
|
|
└── mod.rs # Envelope store/recover
|
|
```
|
|
|
|
## Dependencies
|
|
|
|
```toml
|
|
[dependencies]
|
|
# Post-quantum crypto
|
|
pqcrypto-kyber = { version = "0.8", features = ["serialization"] }
|
|
pqcrypto-dilithium = { version = "0.5", features = ["serialization"] }
|
|
pqcrypto-traits = "0.3"
|
|
|
|
# Symmetric crypto & hashing
|
|
sha2 = "0.10"
|
|
sha3 = "0.10"
|
|
hkdf = "0.12"
|
|
hmac = "0.12"
|
|
argon2 = "0.5" # Password hardening
|
|
|
|
# Utilities
|
|
rand = "0.8"
|
|
serde = { version = "1.0", features = ["derive"] }
|
|
zeroize = { version = "1", features = ["derive"] }
|
|
thiserror = "2"
|
|
subtle = "2.5" # Constant-time operations
|
|
```
|
|
|
|
## References
|
|
|
|
1. RFC 9807 - The OPAQUE Augmented PAKE Protocol
|
|
2. Jarecki, Krawczyk, Xu - OPAQUE: An Asymmetric PAKE (Eurocrypt 2018)
|
|
3. **Shan et al. - Fast post-quantum PSI from Ring-LPR OPRF (2025)** ← Primary OPRF reference
|
|
4. Basso - A Post-Quantum Oblivious PRF from Isogenies (SAC 2023)
|
|
5. Faller - Composable OPRFs via Garbled Circuits (2022)
|
|
6. NIST FIPS 203 - ML-KEM (Kyber)
|
|
7. NIST FIPS 204 - ML-DSA (Dilithium)
|
|
|
|
## Fast OPRF Construction (Experimental)
|
|
|
|
### Overview
|
|
|
|
The `oprf/fast_oprf.rs` module implements an **experimental OT-free lattice OPRF** based on Ring-LWE. This is a novel construction that eliminates the 256 OT instances required by Ring-LPR.
|
|
|
|
### Construction ("Structured Error OPRF")
|
|
|
|
```
|
|
Public Parameters: A ∈ R_q (random ring element, CRS-style)
|
|
Server: k (small secret), e_k (small error), B = A*k + e_k (published)
|
|
|
|
Client Blind(password):
|
|
s = H_small(password) // Small ring element
|
|
e = H_small(password || "error") // Small error term
|
|
C = A*s + e // Ring-LWE sample
|
|
Send C to server
|
|
|
|
Server Evaluate(k, C):
|
|
V = k * C = k*A*s + k*e
|
|
h = ReconciliationHelper(V)
|
|
Return (V, h)
|
|
|
|
Client Finalize(s, B, V, h):
|
|
W = s * B = s*A*k + s*e_k
|
|
// V - W = k*e - s*e_k (small!)
|
|
bits = Reconcile(W, h)
|
|
Return H(bits)
|
|
```
|
|
|
|
### Security Analysis
|
|
|
|
| Property | Analysis |
|
|
|----------|----------|
|
|
| **Obliviousness** | Under Ring-LWE: `C = A*s + e` indistinguishable from uniform. Server cannot recover password from C. |
|
|
| **Pseudorandomness** | Output depends on k*A*s. Without k, output is pseudorandom under Ring-LPR. |
|
|
| **Determinism** | Both s and e derived deterministically from password → same password = same output. |
|
|
| **No OT Required** | Algebraic structure replaces OT: reconciliation error `V - W = k*e - s*e_k` is small enough to correct. |
|
|
|
|
### Comparison with Ring-LPR OPRF
|
|
|
|
| Aspect | Ring-LPR (ring_lpr.rs) | Fast OPRF (fast_oprf.rs) |
|
|
|--------|------------------------|--------------------------|
|
|
| **OT Instances** | 256 Kyber KEM operations | **0** |
|
|
| **Estimated Time** | ~8-16ms | **<1ms** (sub-millisecond) |
|
|
| **Message Size** | ~50-100KB (OT setup) | **~2KB** (2 ring elements + helper) |
|
|
| **Security Basis** | Ring-LPR + OT | Ring-LWE |
|
|
| **Obliviousness** | Provably oblivious (OT) | Computationally hiding (LWE) |
|
|
| **Paper Reference** | Shan et al. 2025 | Novel construction |
|
|
|
|
### Relationship to Literature
|
|
|
|
This construction is inspired by:
|
|
1. **VOLE from Ring-LWE** (de Castro et al. 2021): Uses circuit privacy in homomorphic encryption for obliviousness
|
|
2. **LPR Rounding**: Similar to Learning Parity with Rounding but applied differently
|
|
3. **Key Exchange Reconciliation**: Error correction technique from Peikert's key exchange
|
|
|
|
The key insight is that:
|
|
- Client's `C = A*s + e` is an LWE sample (hiding s under Ring-LWE)
|
|
- Server's `V = k*C` computes `k*A*s + k*e`
|
|
- Client's `W = s*B = s*A*k + s*e_k`
|
|
- The difference `V - W = k*e - s*e_k` is small (product of small elements)
|
|
- Reconciliation helper allows recovery of consistent bits from this near-equality
|
|
|
|
### Security Assumptions
|
|
|
|
1. **Ring-LWE**: `C = A*s + e` computationally indistinguishable from uniform
|
|
2. **Reconciliation Security**: Helper data doesn't leak significant information about V
|
|
3. **Parameters**: n=256, q=12289, ||s||∞, ||e||∞ ≤ 3
|
|
|
|
### Limitations & Open Questions
|
|
|
|
1. **Not in Literature**: This construction may be novel - requires peer review
|
|
2. **Reconciliation Accuracy**: Currently ~95-99% bit agreement (may need improvement)
|
|
3. **Verifiability**: No ZK proof mechanism (unlike VOPRF)
|
|
4. **Security Proof**: Formal UC security proof needed
|
|
|
|
### Benchmarks (TODO)
|
|
|
|
```
|
|
Ring-LPR OPRF (OT-based):
|
|
- Client blind: TBD ms
|
|
- Server evaluate: TBD ms
|
|
- Client finalize: TBD ms
|
|
- Total: ~10-20ms
|
|
|
|
Fast OPRF (OT-free):
|
|
- Client blind: TBD μs
|
|
- Server evaluate: TBD μs
|
|
- Client finalize: TBD μs
|
|
- Total: <1ms
|
|
|
|
Speedup: ~10-50x (estimated)
|
|
```
|
|
|
|
## Changelog
|
|
|
|
- **v0.4.0**: Added Fast OPRF (OT-free experimental construction)
|
|
- Novel Ring-LWE based OPRF without Oblivious Transfer
|
|
- ~10-50x faster than Ring-LPR OPRF
|
|
- Needs security peer review
|
|
- **v0.3.0**: Added Verifiable OPRF (VOPRF) and UC Security Proof
|
|
- Implemented lattice-based sigma protocol (Lyubashevsky-style)
|
|
- Key commitment scheme with hash-based binding
|
|
- Full UC security proof in SECURITY_PROOF.md
|
|
- 10 new VOPRF tests
|
|
- **v0.2.0**: Replaced hybrid OPRF with true Ring-LPR OPRF
|
|
- **v0.1.0**: Initial implementation with hybrid Kyber+HMAC OPRF
|