Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The AugPAKE spec says it can be implemented over elliptic curves. This sounds very promising, but they don't actually back that claim. Can this really be achieved? If so, how would one go about mapping the existing protocol to elliptic curves?

share|improve this question
up vote 2 down vote accepted

Yes for sure you can do that. Mapping this protocol to an elliptic curve setting is just like mapping DH key exchange to ECDH key exchange. In AugPAKE you work in a prime order $q$ subgroup of $Z_p^*$ and in the EC setting you use a prime order $q$ elliptic curve group.

Observe that in the EC setting a multiplication of group elements in AugPAKE is then point addition and exponentiation in AugPAKE is then scalar multiplication.

share|improve this answer
Can you clarify "a prime order q elliptic curve group"? Do I need to construct that elliptic curve group? – user2398029 Mar 28 '14 at 13:21
No you do not have to specify them on your own. You can use standardized curves such as those proposed by, e.g., NIST, which are available in common libraries. If you are more on the "conspiracy theory side" you may want to choose alternative curves. – DrLecter Mar 28 '14 at 13:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.