OPAQUE is an augmented password-authenticated key exchange protocol. It allows a client to authenticate to a server using a password, without ever having to expose the plaintext password to the server.
This implementation is based on RFC 9807.
Augmented Password Authenticated Key Exchange (aPAKE) protocols are designed to provide password authentication and mutually authenticated key exchange without relying on PKI (except during user/password registration) and without disclosing passwords to servers or other entities other than the client machine.
OPAQUE is a PKI-free aPAKE that is secure against pre-computation attacks and capable of using a secret salt.
The API can be found here along with an example for usage. More examples can be found in the examples directory.
Add the following line to the dependencies of your Cargo.toml:
opaque-ke = "5.0.0-pre.0"
Rust 1.88 or higher.
The migration requires elliptic-curve 0.14.3 and voprf 0.6.0-pre.2,
removing the crypto-bigint 0.5 path affected by
RUSTSEC-2026-0387.
Custom cipher suites and group implementations now use digest 0.11,
rand/rand_core 0.10, and the corresponding RustCrypto group/signature types.
Primitive buffers use hybrid_array::Array; serialized messages continue to use
generic_array::GenericArray, now from version 1, to support compound lengths.
System randomness is available through rand::rngs::SysRng, wrapped in
rand::rand_core::UnwrapErr when an infallible generator is required.
opaque-ke no longer enables getrandom's wasm_js backend: users targeting
wasm32-unknown-unknown in the browser who rely on system randomness must
enable getrandom/wasm_js themselves.
The existing protocol vectors and persisted registration formats are preserved. The optional ML-KEM integration continues to serialize expanded decapsulation keys, preserving pending client states. Migration tests use frozen public data from older releases so that testing compatibility does not reintroduce their old crypto dependencies.
This library was audited by NCC Group in June of 2021. The audit was sponsored by WhatsApp for its use in enabling end-to-end encrypted backups.
The audit found issues in release v0.5.0, and the fixes were subsequently incorporated into release v1.2.0. See the full audit report here.
- OPAQUE academic publication, including formal definitions and a proof of security
- RFC 9807, containing a detailed (byte-level) specification for OPAQUE
- "Let's talk about PAKE", an introductory blog post written by Matthew Green that covers OPAQUE
- @serenity-kit/opaque, a WebAssembly package for this library
- opaque-wasm, a WebAssembly package for this library. A comparison between
@serenity-kit/opaqueandopaque-wasmcan be found here - react-native-opaque, a React Native package for this library matching the API of
@serenity-kit/opaque
The authors of this code are Kevin Lewi (@kevinlewi) and François Garillot (@huitseeker). To learn more about contributing to this project, see this document.
Special thanks go to Hugo Krawczyk and Chris Wood for helping to clarify discrepancies and making suggestions for improving this implementation. Additional credit goes to @daxpedda for adding no_std support, p256 support, and making other general improvements to the library.
This project is dual-licensed under either the MIT license or the Apache License, Version 2.0. You may select, at your option, one of the above-listed licenses.