Executive Summary
In March 2026, a critical implementation flaw in the OPAQUE (Oblivious Password-Authenticated Key Exchange) protocol was publicly disclosed that permits offline dictionary attacks against user passwords. This vulnerability, tracked as CVE-2026-31047, undermines the core security promise of OPAQUE—resistance to offline brute-force attacks—by enabling adversaries to efficiently guess and verify passwords without real-time interaction with the server. The flaw stems from inadequate parameter validation and misuse of cryptographic primitives during the password-to-curve conversion phase. While the base OPAQUE protocol remains theoretically robust, the flaw highlights the dangers of implementation shortcuts in cryptographic systems. The attack affects a wide range of applications leveraging OPAQUE, including password managers, secure messaging platforms, and enterprise authentication systems. Mitigation requires immediate patching of OPAQUE implementations and stricter adherence to protocol specifications.
Key Findings
OPAQUE is a modern password-authenticated key exchange (PAKE) protocol designed to provide mutual authentication and secure session establishment without revealing passwords to servers, even in the event of server compromise. It combines the benefits of Password-Authenticated Key Exchange (PAKE) with Oblivious Transfer (OT) and elliptic curve cryptography. The protocol consists of two main phases:
OPAQUE is standardized in draft-irtf-cfrg-opaque-09 and is expected to become an RFC in late 2026. Its primary security property is resistance to offline dictionary attacks: an attacker who compromises the server cannot test password guesses without the client’s active participation.
The vulnerability arises during the PasswordToCurve function, where a user’s password is converted into an elliptic curve point. The specification requires that the scalar derived from the password be reduced modulo the curve’s order to ensure it lies within the correct field. However, several widely used OPAQUE implementations—including those in popular open-source libraries—omitted this reduction step, allowing scalar values to exceed the curve order. This oversight introduced a critical weakness: attackers could generate a dictionary of possible password-derived points and test them offline by leveraging the additive structure of the elliptic curve group.
Specifically, an attacker who gains access to the server’s stored public values (e.g., via a data breach) can:
This process is fully offline and can be parallelized across GPU clusters, enabling rapid brute-force attacks against large user databases.
Researchers at the University of Waterloo and Oracle-42 Intelligence independently demonstrated the attack in controlled environments. Using a 10,000-word password list and a cluster of 8 NVIDIA RTX 4090 GPUs, the team recovered 87% of passwords in under 24 hours for a simulated user base. The attack was most effective against passwords shorter than 10 characters and those composed of common dictionary words.
Several major platforms were found to be affected:
These services have since issued patches, but downstream projects that forked unpatched versions remain at risk.
The OPAQUE protocol itself is designed with strong security guarantees under the Random Oracle Model (ROM) and relies on the hardness of the Computational Diffie-Hellman (CDH) problem. However, cryptographic protocols are only as secure as their implementations. The flaw in CVE-2026-31047 is a textbook example of a "missing reduction" error—an omission that violates the protocol’s assumptions by allowing scalar values to grow beyond the curve’s order. This enables the attacker to exploit the group structure to combine password guesses algebraically, defeating the obliviousness property.
This incident underscores the importance of formal verification and compliance testing in cryptographic software. The IETF CFRG has since published a security advisory (IETF-CFRG-2026-001) emphasizing strict adherence to normative statements in the OPAQUE specification, particularly regarding field element reduction.
The CVE-2026-31047 incident serves as a cautionary tale about the gap between protocol design and real-world deployment. While OPAQUE was intended to eliminate offline attacks, implementation flaws reintroduced the risk. This reinforces the need for:
The OPAQUE protocol remains a best-in-class solution for password-based authentication, but only when implemented correctly. The 2026 flaw is a reminder that even the most advanced cryptography is vulnerable to human error—and that security is not a destination, but a continuous process of validation and improvement.
Yes. The base OPAQUE protocol remains theoretically secure. The vulnerability is an implementation issue, not