# Do random oracles are called even by honest users in the PAK protocol [BMK00]?

In the full-length proof of PAK scheme, the authors made extensive use of random oracles to extract (guessed) password from the messages generated by the real world adversary for the ideal world simulator.

Questions:

1. Are all the random oracle calls $H_i(\cdots)$ in the real world protocol (even called by honest users) controlled by the simulator?

2. Does the simulator need to make responses for the requests of honest users via the real world adverary's delivering?

3. Does the simulator make use of the status of honest users? For example, A (either the honest user or impersonated by the real world adversary) sends a password to B and B sets the status of himself as accept or reject. Is B's status watched by the simulator and the real world adversary?

4. Why the password-extraction from real world messages is so imporant in simulation-based proofs? Is it indeed some kind of zero-knowledge proof for showing these password-related messages in the real protocol are as zero-knowledge as the messages in the ideal world? (as the authors suggested to use NIZK in place of random oracle)

5. Is there any weaker proof method (which, however, still guarantees us security practically), especially for the password-authenticated key exchange area?