libdpf/doc/pages/introduction.md

\htmlonly
<p class="hero-lead"><code>libdpf++</code> is a header-only C++17 library of distributed point functions: short keys that hide one secret index, then answer at public points as secret shares.</p>
<h2 id="features">What it does</h2>
<div class="feature-grid">
<a class="feature-card" href="verifiability.html"><span class="feature-kicker">Proofs</span><strong>Verifiability &amp; authenticity</strong><p>Honest correction seeds, a weight-1 sketch, and MACs on the leaves, on the same walk.</p></a>
<a class="feature-card" href="programmability.html"><span class="feature-kicker">Late binding</span><strong>Programmability</strong><p>Fill the index or the payload after the key exists. Rewrite an updatable leaf in place.</p></a>
<a class="feature-card" href="comparisons.html"><span class="feature-kicker">Predicates</span><strong>Comparisons &amp; ranges</strong><p>Less-than, equality, interval containment, and blocked checks, as keys.</p></a>
<a class="feature-card" href="multipoint_keys.html"><span class="feature-kicker">Many secrets</span><strong>Multipoint keys</strong><p>Pack many secret points into one cuckoo key. One batched proof covers the set.</p></a>
<a class="feature-card" href="multiparty.html"><span class="feature-kicker">Three parties</span><strong>Multiparty &amp; 3-server</strong><p>Any two of three open a Shamir key. Or an information-theoretic three-server DPF.</p></a>
<a class="feature-card" href="dealer_free.html"><span class="feature-kicker">No dealer</span><strong>Dealer-free keygen</strong><p>The parties already share the index. Doerner–Shelat, geneval, and IKNP finish the key.</p></a>
<a class="feature-card" href="beaver_triples.html"><span class="feature-kicker">Multiplication</span><strong>Beaver triples</strong><p>Authenticated products on leaf shares, including the ABY2.0 MAC check.</p></a>
<a class="feature-card" href="jet_and_ring.html"><span class="feature-kicker">After the offset</span><strong>Grotto</strong><p>Jets, polynomials, carry, and exact ring changes once a public offset is open.</p></a>
<a class="feature-card" href="ppvc_manual.html"><span class="feature-kicker">Commitments</span><strong>Programmable vectors</strong><p>Bind a vector, then open one hidden coordinate or the sum.</p></a>
<a class="feature-card" href="applications.html"><span class="feature-kicker">Protocols</span><strong>Application sketches</strong><p>The DPF step of Duoram, keyword PIR, PSI, Prio, LLAMA, and the rest.</p></a>
</div>
\endhtmlonly

## A complete program {#first_program}

Leaf shares are subtractive. `reconstruct` is `share0 - share1`.
The same program is `examples/mwe/point.cpp`.
More programs are on [Pick a construction](@ref which_dpf) and [Code examples](@ref listings).

\htmlonly
<pre class="fragment">#include "dpf.hpp"

const std::uint8_t alpha = 42;
const std::uint64_t beta = 7;
auto [k0, k1] = dpf::make_dpf(alpha, beta);

const std::uint64_t at = dpf::reconstruct(
    *dpf::eval_point(k0, alpha),
    *dpf::eval_point(k1, alpha));
// at == 7; any other public point opens to 0

// c++ -std=c++17 -march=native -I include -I thirdparty examples/mwe/point.cpp
</pre>
\endhtmlonly