opaque-ke

opaque-ke is a Rust implementation of OPAQUE, an augmented password-authenticated key exchange (aPAKE) protocol that lets a client authenticate to a server using a password without ever exposing the plaintext password to the server. It is based on RFC 9807 and provides PKI-free mutual authentication that is secure against pre-computation attacks.

Maintained by Meta and audited by NCC Group (sponsored by WhatsApp for end-to-end encrypted backups), the crate implements the full registration and login flows with a modular ciphersuite system. It supports multiple elliptic curves, key stretching functions like Argon2, optional post-quantum KEM hybridization, and no_std targets.

What You Get

• Complete OPAQUE client and server registration and login flows
• A pluggable ciphersuite abstraction over OPRF group, key exchange, and hashing choices
• Support for multiple curves (ristretto255, curve25519, ed25519, ECDSA) via features
• Configurable key stretching functions (KSF) including Argon2
• Optional post-quantum KEM hybridization and no_std support

Common Use Cases

• Password login that never transmits or stores the plaintext password on the server
• End-to-end encrypted backup systems keyed from a user password
• PKI-free mutually authenticated key exchange between client and server
• Building breach-resistant authentication resistant to pre-computation attacks

Under The Hood

Architecture - The protocol is decomposed into focused modules: opaque.rs drives the registration and login state machines, ciphersuite.rs defines the CipherSuite trait that binds OPRF group, key exchange, and hash together, key_exchange/ holds the 3DH-style AKE, envelope.rs implements the OPAQUE envelope, ksf.rs the key-stretching abstraction, and keypair.rs/messages.rs/serialization/ handle keys and wire formats. It builds on the voprf crate for the oblivious PRF.

Tech Stack - Rust edition 2024 (MSRV 1.87) built on RustCrypto building blocks: curve25519-dalek, elliptic-curve/ecdsa, ed25519-dalek, generic-array, plus voprf, argon2 for KSF, and optional ml-kem for post-quantum hybridization. Everything is gated behind fine-grained Cargo features with ristretto255 and serde on by default.

Code Quality - The crate has an internal src/tests/ suite plus integration tests (tests/migration.rs, tests/remote_key.rs), benchmarks, and strict tooling (clippy.toml, deny.toml, rustfmt/taplo config). Critically, it was independently audited by NCC Group, with fixes folded back into the release line.

API Design - The public API mirrors the OPAQUE message flow (registration start/finish, login start/finish) with strongly typed state objects, which is precise but demands understanding of the protocol; the README and docs.rs examples plus an examples/ directory ease the notable learning curve for a security-critical, generically parameterized crate.