I am started working in post quantum cryptography(lattice based cryptography) specifically in Password Authenticated Key Exchange (PAKE). I come across many PAKE key exchange scheme (like this one) that do not take in consideration the registration process and login process. These schemes simply assumes that two parties are sharing some secret password of low entropy and based on that they will generate common session key. So, my question regarding PAKE techniques are

What is the scope of PAKE schemes? Is Registration or Login process should not be considered while designing the PAKE key Exchange schemes?

  • $\begingroup$ I have started a chat related to cryptanalysis of key exchange given by Ding et al. based RLWE. Please see it here chat.stackexchange.com/rooms/62701/pake-based-on-rlwe $\endgroup$ – vivek Jul 24 '17 at 5:21
  • $\begingroup$ PAKE is a protocol which allows 2 parties knowing the same password to establish a secure channel (by establishing a common secret key) over insecure channel (over regular internet connection, which is eavesdropped by attacker or even attacker is able to change messages of parties). What you're looking for, registration process and login, is completely different thing $\endgroup$ – Mikhail Koipish Jun 17 '20 at 15:33
  • $\begingroup$ @MikhailKoipish PAKE protocol proposed now a days includes registration and login phase. So, I am confused why they include these phases. The link for one such paper is ieeexplore.ieee.org/abstract/document/8417960 $\endgroup$ – vivek Jun 18 '20 at 11:10
  • $\begingroup$ After brief looking into the paper I would say that what they propose is "anonymous authentication protocol" with "registration phase, mutual authentication phase, and password update phase". This is not a PAKE in generally accepted in cryptography community sense. If you like, regular PAKE is probably used as part of their proposed system, which includes also additional services like registration of password on the server, anonymity, change of passwords. Their system is actually called something like anonymous credentials scheme, or anonymous authentication protocol. $\endgroup$ – Mikhail Koipish Jun 19 '20 at 14:28

The definition of PAKE just suggests that one or more parties are exchanging keys with knowledge of a shared password that authenticates the exchanged key. There are definitely use-cases of PAKEs that extend beyond, say, a web application authentication process that requires registration. For example, there could exist two or more embedded systems with shared passwords built into the firmware during manufacturing but these systems want to exchange fresh keys for communication. There are PAKEs that do cover registration (e.g. SRP), but the "definition" of a PAKE does not really require a specification for a registration process.

Personally, I think PAKE authors should specify a password bootstrapping process, if possible! It could prevent implementors from rolling-their-own protocol extensions.

  • $\begingroup$ What is password bootstrapping process $\endgroup$ – vivek Jul 3 '17 at 6:16
  • $\begingroup$ It very difficult to analyze security of the key exchange schemes without the knowledge of how communication starts. $\endgroup$ – vivek Jul 3 '17 at 6:18
  • $\begingroup$ For example in the above paper link given, I have to assume that the users get registered and then they starts the key exchange process using above technique. So security analysis become difficult. Thanks $\endgroup$ – vivek Jul 3 '17 at 6:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.