Server
Client
Server
Client
blinded = r · H(email)
evaluated = oprf_key · blinded
oprf_output = (1/r) · evaluated
login_bidx = truncate(SHA-256(oprf_output), k_bits)