Revolutionizing Auth with Oblivious Crypto

### The Crisis of Centralized Credential Storage At 00:00, Adam Everspaugh introduces oblivious pseudorandom functions (OPRF) and cryptographic authentication at the Crypto and Privacy Village. Everspaugh discusses how corporate credential breaches continue to expose hundreds of millions of user passwords despite standard hashing mechanisms.

### Limitations of Traditional Password Hashing At 04:54, Everspaugh reviews traditional server-side hashing algorithms like bcrypt and Argon2. While these functions slow down guessing, attackers who breach database servers can still run massively parallelized offline dictionary attacks using GPU clusters without detection.

### Architecture of Oblivious Authentication At 09:49, the speaker introduces OPRF-based authentication systems. Under this protocol, the client and an authentication server jointly evaluate a pseudorandom function: the client learns the cryptographic token without revealing their plaintext password, while the server evaluates the token without learning the user's secret.

### Blinded Cryptographic Evaluations and Mathematical Security At 14:42, Everspaugh details the mathematical mechanisms behind blinded evaluation protocols. By utilizing elliptic curve Diffie-Hellman operations with blinding factors, the user masks their credentials before transmission, mathematically preventing the authentication server from logging or compromising user credentials.

### Rate Limiting and Protecting Against Data Breaches Concluding between 21:35 and 26:44, Everspaugh presents Pythia, an OPRF-based password hardening architecture. By isolating rate limiting into specialized cryptographic key servers, service providers can enforce strict query thresholds, preventing offline dictionary attacks even if backend databases are completely leaked.

(AI summary — Gemini Flash)