Password-Authenticated Key Exchange (PAKE)
Stub. Authenticated key exchange when the only shared secret is a low-entropy, phishable password rather than a long cryptographic key: why naive approaches fail against phishing, the PAKE security goal, a sequence of protocols (PAKE0 through PAKE2+) building up to a secure construction, explicit key confirmation, the WPA3 Wi-Fi protocol as a deployed case study, and key exchange using an online trusted third party as an alternative to password-only authentication.
Corresponds to Chapter 21.11–21.13. The AKE protocols of authenticated-key-exchange-foundations assume high-entropy, unguessable long-term secrets; a password (see identification-protocols-password-security-and-otp for password security in the login-only setting) is neither, which rules out those protocols directly — an attacker could just guess the password offline from a transcript. Phishing is the headline threat PAKE must also resist (the honest party shouldn’t leak anything useful even to a fake server impersonating the real one). Works through a sequence of protocols (PAKE0 as a flawed starting point, through PAKE1, PAKE2, and the PAKE2+ variant) to build up the full security argument, plus explicit key confirmation (each party proves it actually derived the shared key) and WPA3’s real-world PAKE deployment for Wi-Fi. Closes with an entirely different trust model: key exchange assisted by an online trusted third party, relevant when no password or long-term key is shared directly between the two end parties at all.
Outline (TODO — flesh out each)
- Phishing attacks on naive password-based protocols
- PAKE — an introduction
- Protocol PAKE0; Protocol PAKE1
- Protocol PAKE2; Protocol PAKE2+
- Explicit key confirmation
- Revisiting phishing resistance
- Case study: PAKE in the WiFi WPA3 protocol
- Key exchange using an online trusted third party
- Fun application: establishing Tor channels