{
  "slug": "oblivious-prf",
  "term": "Oblivious pseudorandom function",
  "aliases": [
    "OPRF"
  ],
  "definition": "An oblivious pseudorandom function protocol lets a client obtain a keyed function's output while hiding the input from the server and the server key from the client.",
  "note": "RFC 9497 specifies prime-order-group OPRF variants; verifiable OPRFs additionally bind evaluations to a known public key. It is an Informational IRTF publication, not an IETF standard. This primitive does not by itself provide application authentication or query quotas. [rfc9497] Storage use must document the surrounding trust model. [hesela-dedup-security]",
  "status": "research",
  "advantages": [],
  "limitations": [],
  "related": [
    "convergent-encryption",
    "deduplication",
    "cryptographic-hash"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "citations": [
    {
      "id": "rfc9497",
      "title": "RFC 9497: Oblivious Pseudorandom Functions (OPRFs) Using Prime-Order Groups (2023), sections 1 and 7. Informational IRTF publication.",
      "url": "https://www.rfc-editor.org/rfc/rfc9497.html",
      "accessed": "2026-10-18"
    },
    {
      "id": "hesela-dedup-security",
      "title": "Hesela: Encrypted deduplication: who can test a file guess?",
      "url": "https://hesela.com/analyses/encrypted-deduplication-trust-boundaries/",
      "accessed": "2026-10-18"
    }
  ],
  "updated": "2026-10-18"
}