Security Audit

After getting the the opaque and react-native-opaque version to a stable release a security audit was conducted by 7ASecurity. It included extensive testing, a code review and fuzz testing of the libraries. No issues could be identified in the libraries. Only in the examples a handful of issues were found. We fixed them and re-tested from 7ASecurity.

Another result of the audit was the recommendation to improve the release process. We followed this advice and introduced publishing via the Github CI. This also allowed us to now generate provenance statements with each release.

You can read up on the full report here: https://7asecurity.com/reports/pentest-report-opaque.pdf

Extensive documentation

The documentation is ready and contains all the content we planned to produce. We are especially proud of the interactive animation in the system simulation and protocol visualisation.

Why has it not yet been release as 1.0.0?

The draft for the OPAQUE-protocol RFC has passed the review by the Crypto Forum Research Group (CFRG). It now has been handed over to the IETF editors and once it passed this step it will be released published as an RFC. Probably publish it by then.

What's next?

We want to promote Opaque and the OPAQUE-protocol so many many more software engineering teams can benefit from it's existence. This will be done through various talks at conferences and meet-ups in the coming year e.g. React Summit on 14th June in Amsterdam.

Since we are using Opaque ourself in our end-to-end encrypted workspaces application Serenity we intend to maintain Opaque for a long time. While we don't expect any big changes in the core library, it certainly will be necessary to keep the examples and ReactNative dependencies up-to-date.

Conclusion

Working on this project was a pleasure for the whole team and we are grateful to formest Netidee having faith in our plans. It's rare to get dedicated funding an Open Source project of this kind and it allowed us to establish a quality level that is rare in software development and focus on details in the documentation we deeply care about.

In addition we want to thank the Open Technology Foundation for sponsoring the security audit and 7ASecurity for their incredible work on the audit itself.