TLS 1.3 for transport (psi-conf can run over TLS or plain TCP – plain mode only for isolated lab use). 7. Performance Benchmarks | Set size (each) | Round trips | Runtime (client) | Runtime (server) | Bandwidth | |----------------|-------------|------------------|------------------|------------| | 10 | 2 | 8 ms | 12 ms | 24 KB | | 100 | 2 | 45 ms | 62 ms | 180 KB | | 1,000 | 2 | 410 ms | 580 ms | 1.4 MB | | 10,000 | 2 | 4.2 s | 6.1 s | 12 MB |
1. Overview psi-conf (Private Set Intersection for Configuration) is a lightweight cryptographic protocol and software tool that enables two parties—typically a device and a server—to determine shared configuration parameters or identity attributes without revealing their non-shared data . psi-conf software
disk_encrypted=true os_version>=22.04 # normalized match av_updated=true | Threat | Mitigation | |--------|-------------| | Malicious client enumerating server policy | Server rate-limits per IP; optional padding of policy set to fixed size. | | Malicious server learning client’s non‑matching items | OPRF ensures server never sees unblinded client hashes. | | Replay attacks | Nonce/timestamp included in each PSI round (implicit via session ID). | | Side‑channel (timing) | Constant‑time comparisons and blinding operations. | | | Replay attacks | Nonce/timestamp included in
TLS 1.3 for transport (psi-conf can run over TLS or plain TCP – plain mode only for isolated lab use). 7. Performance Benchmarks | Set size (each) | Round trips | Runtime (client) | Runtime (server) | Bandwidth | |----------------|-------------|------------------|------------------|------------| | 10 | 2 | 8 ms | 12 ms | 24 KB | | 100 | 2 | 45 ms | 62 ms | 180 KB | | 1,000 | 2 | 410 ms | 580 ms | 1.4 MB | | 10,000 | 2 | 4.2 s | 6.1 s | 12 MB |
1. Overview psi-conf (Private Set Intersection for Configuration) is a lightweight cryptographic protocol and software tool that enables two parties—typically a device and a server—to determine shared configuration parameters or identity attributes without revealing their non-shared data .
disk_encrypted=true os_version>=22.04 # normalized match av_updated=true | Threat | Mitigation | |--------|-------------| | Malicious client enumerating server policy | Server rate-limits per IP; optional padding of policy set to fixed size. | | Malicious server learning client’s non‑matching items | OPRF ensures server never sees unblinded client hashes. | | Replay attacks | Nonce/timestamp included in each PSI round (implicit via session ID). | | Side‑channel (timing) | Constant‑time comparisons and blinding operations. |