Glossary · Cryptography & authentication
OPAQUE
OPAQUE is an asymmetric password-authenticated key exchange (aPAKE) protocol, standardized in RFC 9807, that lets a server verify a password without ever seeing it — the password never leaves the client, even during registration.
Traditional login forms send your password to the server, which hashes and compares it. Even with TLS and good hashing, the server momentarily holds the plaintext password — so a compromised or malicious server can capture it. OPAQUE removes that exposure entirely: the password is never transmitted in any form, hashed or otherwise.
It works by combining an oblivious pseudorandom function (OPRF) with an authenticated key exchange. During registration, the client and server run the OPRF so the client can derive a strong key from the password without the server learning either the password or the key. The client uses that key to encrypt a small "envelope" of key material, which the server stores alongside its OPRF secret — together called the password file or registration record.
At login, the client re-runs the OPRF against the server, decrypts its envelope locally, and the two sides complete a mutually authenticated key exchange. A wrong password simply fails to decrypt the envelope. The server learns one bit: the login succeeded or it did not.
A breached OPAQUE server yields no passwords, no password hashes in the conventional offline-crackable sense, and no reusable credentials — an attacker who steals the registration record must still perform an online OPRF exchange per guess, which the server can rate-limit. This is the core difference from classic schemes where a stolen database enables unlimited offline cracking.
OPAQUE also produces an export key: a client-side secret, derived from the password, that the server never learns. This is what makes OPAQUE a foundation for zero-knowledge applications — the export key can encrypt user data (a vault key, for example) so the operator is architecturally unable to read it.
Ciphera ID uses OPAQUE for all password authentication, via Tessera — Ciphera’s open-source OPAQUE implementation (Rust core with Go and TypeScript SDKs, Apache-2.0). The export key unwraps each account’s vault master key locally, so credentials and vault contents are unreadable to Ciphera by construction.
Common questions
- Is OPAQUE better than SRP?
- For new systems, yes. SRP-6a predates modern security proofs, requires the server to store a password-derived verifier that is offline-attackable after a breach, and resists instantiation with modern elliptic curves. OPAQUE has a formal security model, hides the password even from the server during registration, and is the IETF-standardized successor (RFC 9807).
- What does a breached OPAQUE server reveal?
- The attacker gets per-user registration records and the server’s OPRF key. Passwords cannot be read from them, and offline guessing is not possible without replaying the OPRF per guess — which requires the server’s participation and is rate-limitable. User data encrypted under the export key stays sealed.
- Does OPAQUE replace TLS?
- No. OPAQUE runs inside a TLS session. TLS protects the transport; OPAQUE removes the need to trust the server with the password itself.
- Can I use OPAQUE in production today?
- Yes. RFC 9807 was published in 2025 and production implementations exist — Ciphera runs OPAQUE for all sign-ins via Tessera, which is open source under Apache-2.0 with Rust, Go, and TypeScript packages.