Subject: [Crypto-panel] Review of Oblivious Pseudorandom Functions (OPRFs) using Prime-Order Groups (draft-irtf-cfrg-voprf-09)

From: Virendra Kumar <[email-masked]>
Date: Thu, 17 Mar 2022 18:38:18 +0000

Dear all,

In my view, the draft is not ready for publication. I had to stop my review midway because there are a number of issues (see below), which make me believe that minor edits won't be sufficient, and a thorough re-write of the draft would be needed for it to be ready for full review.

Major comments:

  1.  2.1 on page 9 says "This function can raise a DeserializeError if deserialization fails or A is the identity element of the group": This implies that if I serialize and then serialize the identity element, I will get an error!
  2.  2.2 on page 10 says "... proving that the discrete log of two values is identical in zero knowledge" without ever defining discrete log and zero knowledge proofs. The authors say that their construction is built on Chaum-Pedersen proof, but no further details are provided.
  3.  2.2.1 on page 11 has statements like Cs = [C], Ds = [D] without explaining what square brackets [ ] actually mean.
  4.  2.2.1 on page 11 ends the description of GenerateProof without ever describing why the output of the function [c , s] is a discrete log equivalence proof and why is it zero knowledge.

Minor comments:

  1.  1.3 on page 7: object x --> byte array x
  2.  1.3 on page 7: Better to separate I2SOP and OS2IP, because the current description might be taken to suggest that I2SOP converts a byte array to a non-negative integer, which according to RFC 8017 is just the opposite, i.e., converts a non-negative integer to a byte array.
  3.  1.3 on page 8 says "String values such as "Finalize" are ASCII string literals": It would be good to have all the strings mentioned here not just an example.
  4.  2 on page 8: Redundant long at the end of this sentence "A cryptographic hash function whose output length is Nh bytes long".
  5.  2.1 on page 8 starts talking about groups and then suddenly mentions finite fields without explaining what they are. It becomes clear reading further down that the authors need them for scalars. It would have been less confusing if they simply used the set of integers {0, 1, ..., p-1}.
  6.  2.1 on page 9 says "... multiplicative inverse of input Scalar s modulo ...". This is the first time modulo operation is mentioned.

Regards,
Virendra