search

facebook / opaque-ke

An implementation of the OPAQUE password-authenticated key exchange protocol
Apache License 2.0
291 stars 41 forks source link

Question about version compatibility #316

Closed vdhanan closed 1 year ago

vdhanan commented 1 year ago

Hi! We are currently using opaque-ke v1.2.0 in our login workflow. We would like to upgrade to v2.0.0, but are concerned about backwards compatibility. If a user was registered using v1.2.0 (and the stored "password file" is a v1.2.0 file), will the user still be able to log in successfully if we upgrade to v2.0.0 on our service?

kevinlewi commented 1 year ago

Hi @vdhanan, there is no backwards compatibility support between major versions. If a user is registered to v1.2, the user will not be able to log in if you upgrade to v2.0.

If you want to do the upgrade, I would recommend running 1.2 and 2.0 in parallel, so that when users log in the next time, you can register them under 2.0. Eventually, when all (most?) users have switched over to 2.0, you can deprecate 1.2.

Closing, but feel free to re-open if you have any more questions!