What are the major advantages of SPHF for PAKE?

Question

I am working on Password Authenticated Key Exchange (PAKE). I noted some PAKE schemes were built upon the smooth projective hash function (SPHF). I am confused why SPHF can be used to design PAKE?

I can understand the definition of SPHF and I know it is a special case of designated-verifier ZK. But what are the main advantages of SPHF for PAKE?

Answer 1

SPHF are a very versatile tool, and they have a large number of applications. Their application to PAKE stems from three main properties:

• first, they allow for low-interactivity PAKE. Note that this is very desirable, since latency is one of the main source of inefficiency when communicating with a server on the web. To see it, consider a construction with a designated-verifier proof: intuitively, each player could just prove to the other that, say, some commitment contains the right password. The parties could then perform a standard key exchange after verifying the proofs. However, making this formal requires in particular several rounds of interactions. SPHFs improve that because for PAKE, it is not needed at all that each party proves to the other that he knows the right password: we only want to ensure that if both parties know the same password, they get the same strong key. Intuitively, this fits perfectly the SPHF definition: an SPHF gives you some specific kind of designated-verifier proof where the prover and the verifier end up having the same random key in the statement is true, and independent keys otherwise. To make that a real proof, the prover then sends his key to the verifier, who checks that this is the same as the one she got. But in the PAKE application, this last check is not needed: the hash values can directly be used as the strong key, without any further verification step. Hence, this allows for single round PAKE (for more details, see this paper).
• Second, they can be built from well-studied standard assumptions, namely, DDH (and it's variant, such as DLIN). In contrast, the natural alternative approach to obtaining a low-interactivity PAKE (which, as I already argued, is very desirable for efficiency reasons) would rely on non-interactive zero-knowledge proofs, which are not known from such well-studied assumptions (existing efficient NIZKs require pairing-based cryptography, or the random oracle model).
• Third, they are very algebraic, which is a strong bonus both for optimizing efficiency (since all kinds of tricks, such as batching, become available) and analyzing security. Hence, SPHFs lead to the most efficient PAKEs in the standard model (with only 6 group elements sent by each party, in a single round) with the highest security notion (UC security, which means security even in an arbitrary concurrent setting, as well as full adaptive security for some more recent constructions).