研究成果

An oblivious pseudorandom function (OPRF) is a two-party protocol that enables a client to obtain F_k(x) on an input x without learning the server-held key k, while the server learns nothing about x. OPRF is a fundamental building block in a wide range of privacy-preserving applications, including password-authenticated key exchange (PAKE), private set intersection (PSI), and distributed function secret sharing. In this work, we present the first concrete, high-throughput, post-quantum secure, verifiable distributed OPRF (dOPRF) tolerating t < n/2 malicious servers over replicated secret sharing, built on the recently introduced Gold OPRF of Yang et al. (IEEE S&P 2025), which supports multi-bit outputs in a single invocation. We adopt an offline--online paradigm and introduce new protocol designs for both phases. (i) In the offline phase, we develop efficient protocols for batched generation of replicated secret sharing of α^e whose cost is independent of e. We present two complementary approaches, each designed for different parameter regimes: the first leverages a degenerate additive encoding under which exponentiation commutes with secret sharing; the second employs t+1 designated dealers that prove dual-share consistency via non-interactive zero-knowledge proofs, instantiated using both VOLE-in-the-Head and Ligero, yielding post-quantum security based solely on collision-resistant hashing. (ii) In the online phase, we propose a constant-round protocol that tightly integrates secure multiplication-and-opening with distributed zero-knowledge proof (DZKP) verification, reducing both computation and communication compared to naively using the standard DZKP framework. Our end-to-end benchmarks show that the construction substantially outperforms the state-of-the-art Legendre-PRF dOPRF of Kaluđerović et al. (ESORICS 2025) in communication complexity across all evaluated settings, and remains practical up to (n, t)=(9, 4), a regime where prior approaches become bandwidth- or memory-prohibitive.