In June 2021, WhatsApp engaged NCC Group to conduct a security assessment of the ‘opaque-ke’ library, an open source Rust implementation of the OPAQUE password authenticated key exchange protocol. The protocol is designed to allow password-based authentication in such a way that a server does not actually learn the plaintext value of the client’s password, only a blinded version of the password computed using a verifiable oblivious pseudorandom function.
Two consultants spent a total of 15 days over 2 weeks focused on a detailed review of the ‘opaque-ke’ source code and the associated version of the OPAQUE specification. The library is open source, with code available in GitHub, and the specification is available as an IETF draft RFC. The WhatsApp team provided support throughout the engagement, and the NCC Group project team achieved good coverage of the provided source code and the associated draft of the OPAQUE specification.
The Public Report for this review may be downloaded below:
