docs(pattern): add Beasley lattice VOPRF preprint to vOPRF Nullifiers - #199
Merged
Merged
Conversation
Adds one See also bullet pointing at ePrint 2026/2010 (Li, Wang, Zhang), an implemented round-optimal, maliciously secure lattice VOPRF over MLWE/MSIS, as a candidate post-quantum replacement for the DDH-based construction this pattern describes. Notes the reported benchmarks and the two caveats that matter here: per-evaluation bandwidth and the single-server (non-threshold) setting.
rymnc
approved these changes
Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds one
## See alsobullet to vOPRF Nullifiers for Beasley (ePrint 2026/2010) by Baiyu Li, Ting-Yuan Wang, and Jiapeng Zhang.Why it belongs in this pattern: the
post_quantumblock already says the DDH-based construction is broken by a CRQC and that lattice OPRFs are "in research". This paper is a concrete implementation of that mitigation path — a round-optimal, maliciously secure lattice VOPRF over MLWE/MSIS, following the ADDS21/LeOPaRd blueprint with a generalized BLMR13 PRF (4 input bits per step) and ring-switching sumcheck proofs in place of LaBRADOR. Reported benchmarks on one AVX2 core: 520 ms client request plus NIZK proof, 15.3 ms server verification, 109 KB client communication, 75.4 KB proof.The bullet also records the two caveats that matter for this pattern: per-evaluation bandwidth is orders of magnitude above the elliptic-curve construction, and the paper benchmarks a single-server VOPRF, not the threshold committee this pattern assumes (the word "threshold" appears in the paper only in a citation to AG24).
Left the
post_quantum.mitigationfrontmatter unchanged — happy to update it to name this construction if you want the reference to carry there too.Also adds the matching
[Unreleased]CHANGELOG line, following the Espalier preprint entry.Prompted by: ac