Oblivious pseudorandom function in a key management system

A computing device comprising:

• an interface configured to interface and communicate with a communication system;
• memory that stores operational instructions;
• and
• processing circuitry operably coupled to the interface and to the memory, wherein the processing circuitry is configured to execute the operational instructions to:
• process an input value that is associated with a key based on a blinding key in accordance with an Oblivious Pseudorandom Function (OPRF) blinding operation to generate a blinded value;
• transmit, via the communication system, the blinded value to another computing device that is associated with a Key Management System (KMS) service, wherein the input value is unknown to the another computing device and includes a key identifier that is associated with the key, wherein the key is unknown to the another computing device and includes a Data Encryption Key (DEK) or a Key Encryption Key (KEK);
• receive, via the communication system and from the another computing device that is associated with the KMS service, a blinded key, wherein the blinded key is based on processing of the blinded value based on an OPRF using an OPRF secret, wherein the OPRF secret is unknown to the computing device and is based on a Customer Root Key (CRK) that is associated with the computing device;
• process the blinded key based on the blinding key in accordance with the OPRF unblinding operation to generate the key that is associated with the input value;
• and
• access secure data based on the key based on the key including the Data Encryption Key (DEK) or generate another key based on the key based on the key including the Key Encryption Key (KEK).

A method for execution by a computing device, the method comprising:

• processing an input value that is associated with a key based on a blinding key in accordance with an Oblivious Pseudorandom Function (OPRF) blinding operation to generate a blinded value;
• transmitting, via an interface of the computing device that is configured to interface and communicate with a communication system, the blinded value to another computing device that is associated with a Key Management System (KMS) service;
• receiving, via the interface and via the communication system and from the another computing device that is associated with the KMS service, a blinded key, wherein the blinded key is based on processing of the blinded value based on an OPRF using an OPRF secret;
• processing the blinded key based on the blinding key in accordance with an OPRF unblinding operation to generate the key that is associated with the input value;
• and
• accessing secure information based on the key.