I want Alice to symmetrically encrypt a large file, transmit it over a public network and have Bob decrypt it. The shared secret of the two is a password, potentially very simple and may be reused often. The password is shared offline, potentially insecurely (by Alice shouting it across the room or whispering it into Bob's ears or even being a preshared key like Alice asking "the same password as always?"). I am envisioning an AES-CTR + HMAC-SHA256 + SPAKE2 implementation.
The way I understand the perfect forward secrecy PAKE gives me (by not sharing its internal state but only a derived state) means that even if an eavesdropper could listen to both
- Alice shouting the password to Bob
- Intercepting the entire transmission
they would not be able to find the exchanged key and thus be able to decipher the message. Is that correct?
The way I understand it, the only situation in which a third party could successfully interfere is after Alice shouted the password but before Bobs SPAKE2 message reached Alice. Is that correct?