The introduction to SPAKE pre-authentication states:
Diffie-Hellman Encrypted Key Exchange (DH-EKE) is the earliest widely deployed PAKE. It works by encrypting the public keys of a Diffie-Hellman key exchange with a shared secret. However, it requires both that unauthenticated encryption be used and that the public keys be indistinguishable from random data. This last requirement makes it impossible to use this form of PAKE with elliptic curve cryptography. For these reasons, DH-EKE is not a good fit.
I'm curious about the sentence in bold--why does DH-EKE require that the public keys be indistinguishable from random data? After all, the public keys are public, and furthermore, they will be encrypted with the shared password.
I'm guessing that if the public keys are in fact distinguishable from random data, that that reveals some information about the shared password, but I don't know how.