the Hofmann Elimination

tl;dr

This project implements the OPRF and OPAQUE security protocols to provide a way for common services to reduce their attack surfaces including offline attacks from stolen credentials. Usable with standard Java frameworks like Dropwizard and Spring Boot.

Module Structure

Java / Server-side (Maven artifacts)

-- Artifact ID	Version	Description
hofmann-rfc		All RFC implementations: hash-to-curve (RFC 9380), OPRF (RFC 9497), OPAQUE (RFC 9807), plus shared model DTOs.
hofmann-client		Client files needed for OPRF/OPAQUE integration.
hofmann-server		Server files needed for OPRF/OPAQUE integration.
hofmann-dropwizard		Integration files specific for Dropwizard.
hofmann-springboot		Integration files specific for Spring Boot.

TypeScript / Browser client

Directory	Description
hofmann-typescript	Browser/Node TypeScript client — RFC 9497 OPRF (base, VOPRF and POPRF) + RFC 9807 OPAQUE-3DH. Built on @noble/curves and @noble/hashes. Includes a Vite-powered interactive demo page.

Demo environment

Directory	Description
hofmann-demo	Docker Compose environment running the Dropwizard server and the TypeScript demo UI behind HAProxy with TLS 1.3. Self-signed P-256 cert generated via make certs. Run with make up.

Example Application

See hofmann-elimination-example for a complete working application demonstrating OPAQUE integration end-to-end.

Documentation

• Project landing page — overview, protocol diagrams, quick start guides
• Migration guide — how to migrate an existing site from traditional password auth to OPAQUE
• Documentation map — every document indexed by the question it answers
• Server configuration — every config field, its default, and what leaving it there costs
• Key management — generating the four secrets, injecting them, and the three rotation runbooks
• Framework integration — Dropwizard, Spring Boot, bare framework, and the two store interfaces
• Client configuration — Java and TypeScript clients, and the parameters that must match the server
• Account recovery guide — pluggable account recovery via email, OTP, or custom mechanisms
• Architecture decision records — why the load-bearing decisions are shaped the way they are, and which earlier analyses turned out to be wrong
• Interactive API docs — Swagger UI for OPAQUE and OPRF endpoints
• At runtime (Dropwizard only): set serveApiDocs: true and visit /api-docs/ for embedded Swagger UI. It is off by default, and the Spring Boot integration does not serve API docs at all.
• Raw OpenAPI specs: OPRF API |

Building

Java (requires Java 21)

./gradlew clean build test

This is the beginning of the README. Read the rest at the original. Read the full README ↗