Skip to content

build(deps): update opaque-ke requirement from 3 to 4#8

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/cargo/opaque-ke-4
Open

build(deps): update opaque-ke requirement from 3 to 4#8
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/cargo/opaque-ke-4

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Oct 24, 2025

Updates the requirements on opaque-ke to permit the latest version.

Release notes

Sourced from opaque-ke's releases.

v4.0.0

What's Changed

Full Changelog: facebook/opaque-ke@v3.0.0...v4.0.0

Changelog

Sourced from opaque-ke's changelog.

4.0.0 (October 23, 2025)

  • Increased MSRV to 1.83
  • Synced implementation with RFC 9807 (no core protocol changes)
  • Added a SIGMA-I key exchange implementation
  • Removed KeGroup type from the Ciphersuite trait (now part of KeyExchange type)
    • Breaking: existing Ciphersuite trait definitions need to be updated
  • Ensured that dummy record is always created to avoid timing attack issues
  • Modified the dummy registration file to only contain the public key instead of the keypair
    • Breaking: existing ServerSetups need to be updated 
      // Given `old` is a `ServerSetup` from `opaque-ke` v3.
let old_serialized = old.serialize();
type OldSeedLen = <<<OldCipherSuite as opaque_ke_3::CipherSuite>::OprfCs as voprf::CipherSuite>::Hash as OutputSizeUser>::OutputSize;
type OldSkLen = <<OldCipherSuite as opaque_ke_3::CipherSuite>::KeGroup as opaque_ke_3::key_exchange::group::KeGroup>::SkLen;
let (old_serialied_rest, old_fake_keypair_serialized): (
GenericArray<u8, Sum<OldSeedLen, OldSkLen>>,
_,
) = old_serialized.split();
let old_fake_keypair =
KeyPair::<<OldCipherSuite as opaque_ke_3::CipherSuite>::KeGroup>::from_private_key_slice(
&old_fake_keypair_serialized,
)
.unwrap();
let old_fake_pk_serialized = old_fake_keypair.public().serialize();
let new_serialized = old_serialied_rest.concat(old_fake_pk_serialized);
// Given NewCipherSuite is a CipherSuite implementation equivalent to OldCipherSuite.
ServerSetup::<NewCipherSuite>::deserialize(&new_serialized).unwrap()

  • Added remote OPRF seed support
  • Replace remote private key trait with a state machine, facilitating async support.
  • Serde de/serialization formats have been simplified
    • Breaking: existing ServerRegistrations may need to be updated 
      // Given `old` is a `ServerRegistration` from `opaque-ke` v3.
let old_serialized = old.serialize();
// Given `NewCipherSuite` is a `CipherSuite` implementation equivalent to the old cipher suite.
ServerRegistration::<NewCipherSuite>::deserialize(&old_serialized).unwrap()

3.0.0 (October 10, 2024)

  • Synced implementation with draft-irtf-cfrg-opaque-16
    • Breaking: protocol context string changed from RFCXXXX to OPAQUEv1-
  • Dropped unmaintained json crate in favor of serde_json
  • Updated dependencies

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): update opaque-ke requirement from 3 to 4
af85669 
Updates the requirements on [opaque-ke](https://github.com/facebook/opaque-ke) to permit the latest version.
- [Release notes](https://github.com/facebook/opaque-ke/releases)
- [Changelog](https://github.com/facebook/opaque-ke/blob/main/CHANGELOG.md)
- [Commits](facebook/opaque-ke@v3.0.0...v4.0.0)

---
updated-dependencies:
- dependency-name: opaque-ke
  dependency-version: 4.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants