I am started working in post quantum cryptography(lattice based cryptography) specifically in Password Authenticated Key Exchange (PAKE). I come across many PAKE key exchange scheme (like this one) that do not take in consideration the registration process and login process. These schemes simply assumes that two parties are sharing some secret password of low entropy and based on that they will generate common session key. So, my question regarding PAKE techniques are

What is the scope of PAKE schemes? Is Registration or Login process should not be considered while designing the PAKE key Exchange schemes?

  • $\begingroup$ I have started a chat related to cryptanalysis of key exchange given by Ding et al. based RLWE. Please see it here chat.stackexchange.com/rooms/62701/pake-based-on-rlwe $\endgroup$
    – vivek
    Commented Jul 24, 2017 at 5:21
  • $\begingroup$ PAKE is a protocol which allows 2 parties knowing the same password to establish a secure channel (by establishing a common secret key) over insecure channel (over regular internet connection, which is eavesdropped by attacker or even attacker is able to change messages of parties). What you're looking for, registration process and login, is completely different thing $\endgroup$ Commented Jun 17, 2020 at 15:33
  • $\begingroup$ @MikhailKoipish PAKE protocol proposed now a days includes registration and login phase. So, I am confused why they include these phases. The link for one such paper is ieeexplore.ieee.org/abstract/document/8417960 $\endgroup$
    – vivek
    Commented Jun 18, 2020 at 11:10
  • $\begingroup$ After brief looking into the paper I would say that what they propose is "anonymous authentication protocol" with "registration phase, mutual authentication phase, and password update phase". This is not a PAKE in generally accepted in cryptography community sense. If you like, regular PAKE is probably used as part of their proposed system, which includes also additional services like registration of password on the server, anonymity, change of passwords. Their system is actually called something like anonymous credentials scheme, or anonymous authentication protocol. $\endgroup$ Commented Jun 19, 2020 at 14:28

1 Answer 1


The definition of PAKE just suggests that one or more parties are exchanging keys with knowledge of a shared password that authenticates the exchanged key. There are definitely use-cases of PAKEs that extend beyond, say, a web application authentication process that requires registration. For example, there could exist two or more embedded systems with shared passwords built into the firmware during manufacturing but these systems want to exchange fresh keys for communication. There are PAKEs that do cover registration (e.g. SRP), but the "definition" of a PAKE does not really require a specification for a registration process.

Personally, I think PAKE authors should specify a password bootstrapping process, if possible! It could prevent implementors from rolling-their-own protocol extensions.

  • $\begingroup$ What is password bootstrapping process $\endgroup$
    – vivek
    Commented Jul 3, 2017 at 6:16
  • $\begingroup$ It very difficult to analyze security of the key exchange schemes without the knowledge of how communication starts. $\endgroup$
    – vivek
    Commented Jul 3, 2017 at 6:18
  • $\begingroup$ For example in the above paper link given, I have to assume that the users get registered and then they starts the key exchange process using above technique. So security analysis become difficult. Thanks $\endgroup$
    – vivek
    Commented Jul 3, 2017 at 6:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.