Virtualizing a key hierarchy using a partially-oblivious pseudorandom function (p-oprf)

A computing device comprising:

• an interface configured to interface and communicate with a communication system;
• memory that stores operational instructions;
• and
• processing circuitry operably coupled to the interface and to the memory, wherein the processing circuitry is configured to execute the operational instructions to:
• process an input value that is associated with a key based on a blinding key in accordance with an Oblivious Pseudorandom Function (OPRF) blinding operation to generate a blinded value;
• generate an Oblivious Key Access Request (OKAR) based on the blinded value and based on a challenge to be used by another computing device that is associated with a Key Management System (KMS) service to verify at least one of identity of the KMS service or correctness of operation of the KMS service;
• transmit, via the communication system, the OKAR to the another computing device that is associated with the KMS service;
• receive, via the communication system and from the another computing device that is associated with the KMS service, a blinded key and a response to the challenge, wherein the blinded key is based on processing of the OKAR based on a Partially Oblivious Pseudorandom Function (P-OPRF) using a P-OPRF secret and an arbitrary exposed message that is known to the another computing device, wherein the response to the challenge is based on processing of the challenge by the another computing device that is associated with the KMS service to verify the at least one of the identity of the KMS service or the correctness of operation of the KMS service;
• determine whether the response to the challenge compares favorably to the challenge;
• based on a determination that the response to the challenge compares favorably to the challenge, process the blinded key based on the blinding key in accordance with an OPRF unblinding operation to generate the key that is associated with the input value;
• and
• access secure information based on the key.

A method for execution by a computing device, the method comprising:

• processing an input value that is associated with a key based on a blinding key in accordance with an Oblivious Pseudorandom Function (OPRF) blinding operation to generate a blinded value;
• generating an Oblivious Key Access Request (OKAR) based on the blinded value;
• transmitting, via an interface of the computing device that is configured to interface and communicate with a communication system and via the communication system, the OKAR to another computing device that is associated with a Key Management System (KMS) service;
• receiving, via the interface and via the communication system and from the another computing device that is associated with the KMS service, a blinded key, wherein the blinded key is based on processing of the OKAR based on a Partially Oblivious Pseudorandom Function (P-OPRF) using a P-OPRF secret and an arbitrary exposed message that is known to the another computing device;
• processing the blinded key based on the blinding key in accordance with an OPRF unblinding operation to generate the key that is associated with the input value;
• and
• accessing secure information based on the key.