Authentication aims to validate the legitimate identity. The authenticated key exchange aims to establish a secure common session key. But can we say that password authentication scheme contains the registration phase, the authentication phase and the authenticated key exchange phase? Normally, we should separate these different phases, but, for examples, when we discuss the authenticated key exchange, it implies that authentication and registration are executed in advance.
-
$\begingroup$ password based authentication usually occurs over a secure channel that already exists, or without a key exchange existing at all, so I would not say it includes an authenticated key exchange phase $\endgroup$– Richie FrameJul 23, 2020 at 19:21