computer science

Password-authenticated key agreement

Password-authenticated key agreement is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Password-authenticated key agreement rather than just read about it. In short: In cryptography, a password-authenticated key agreement (PAK) method is an interactive method for two or more parties to establish cryptographic keys based on one or more parties' knowledge of a password. An important property is that an eavesdropper or man-in-the-middle cannot obtain enough information to be able to brute-force guess a password without further interactions with the parties for each (few) guesses.

Key takeaways

Password-authenticated key agreement belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Password-authenticated key agreement to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Password-authenticated key agreement from memory before moving on to harder problems.

Reference excerpt

In cryptography, a password-authenticated key agreement (PAK) method is an interactive method for two or more parties to establish cryptographic keys based on one or more parties' knowledge of a password. An important property is that an eavesdropper or man-in-the-middle cannot obtain enough information to be able to brute-force guess a password without further interactions with the parties for each (few) guesses. This means that a stronger security can be obtained using weak passwords.

Types Password-authenticated key agreement generally encompasses methods such as:

Balanced password-authenticated key exchange Augmented password-authenticated key exchange Password-authenticated key retrieval Multi-server methods Multi-party methods In the most stringent password-only security models, there is no requirement for the user of the method to remember any secret or public data other than the password. Password-authenticated key exchange (PAKE) is a method in which two or more parties, based only on their knowledge of a shared password, establish a cryptographic key using an exchange of messages, such that an unauthorized party (one who controls the communication channel but does not possess the password) cannot participate in the method and is constrained as much as possible from brute-force guessing the password. (The optimal case yields exactly one guess per run exchange.) Two forms of PAKE are balanced and augmented methods.

Balanced PAKE Balanced PAKE assumes the two parties in either a client-client or client-server situation use the same secret password to negotiate and authenticate a shared key. Examples of these are:

Encrypted Key Exchange (EKE) PAK and PPK SPEKE (Simple password exponential key exchange) Dragonfly – IEEE Std 802.11-2012, RFC 5931, RFC 6617 CPace SPAKE1 and SPAKE2 SESPAKE J-PAKE – ISO/IEC 11770-4 (2017), RFC 8236 ITU-T Recommendation X.1035 "Advanced modular handshake for key agreement and optional authentication"

Augmented PAKE

Augmented PAKE is a variation more applicable to client-server scenarios, in which the server does not store password-equivalent data. This means that an attacker who stole the server data still cannot masquerade as the client unless they first perform a brute force search for the password. Some augmented PAKE systems use an oblivious pseudorandom function to mix the user's secret password with the server's secret salt value, so that the user never learns the server's secret salt value and the server never learns the user's password (or password-equivalent value) or the final key. Examples include:

AMP Augmented-EKE B-SPEKE PAK-X SRP AugPAKE OPAQUE AuCPace SPAKE2+ Owl "Advanced modular handshake for key agreement and optional authentication"

Key retrieval Password-authenticated key retrieval is a process in which a client obtains a static key in a password-based negotiation with a server that knows data associated with the password, such as the Ford and Kaliski methods. In the most stringent setting, one party uses only a password in conjunction with N (two or more) servers to retrieve a static key. This is completed in a way that protects the password (and key) even if N − 1 of the servers are completely compromised. Signal Messenger's "secure value recovery" is one example of such a setup.

Brief history The first successful password-authenticated key agreement methods were Encrypted Key Exchange methods described by Steven M. Bellovin and Michael Merritt in 1992. Although several of the first methods were flawed, the surviving and enhanced forms of EKE effectively amplify a shared password into a shared key, which can then be used for encryption and/or message authentication. The first provably-secure PAKE protocols were given in work by M. Bellare, D. Pointcheval, and P. Rogaway and V. Boyko, P. MacKenzie, and S. Patel. These protocols were proven secure in the so-called random oracle model (or even stronger variants), and the first protocols proven secure under standard assumptions were those of O. Goldreich and Y. Lindell (Crypto 2001) which serves as a plausibility proof but is not efficient, and J. Katz, R. Ostrovsky, and M. Yung (Eurocrypt 2001) which is practical. The first password-authenticated key retrieval methods were described by Ford and Kaliski in 2000. A considerable number of alternative, secure PAKE protocols were given in work by M. Bellare, D. Pointcheval, and P. Rogaway, variations, and security proofs have been proposed in this growing class of password-authenticated key agreement methods. Current standards for these methods include IETF RFC 2945, RFC 5054, RFC 5931, RFC 5998, RFC 6124, RFC 6617, RFC 6628 and RFC 6631, IEEE Std 1363.2-2008, ITU-T X.1035 and ISO-IEC 11770-4:2006.

PAKE selection process for use in internet protocols On request of the internet engineering task force IETF, a PAKE selection process has been carried out in 2018 and 2019 by the IRTF crypto forum research group (CFRG). The selection process has been carried out in several rounds. In the final round in 2019 four finalists AuCPace, OPAQUE (augmented cases) and CPace, SPAKE2 (balanced PAKE) prevailed. As a result of the CFRG selection process, two winner protocols were declared as "recommended by the CFRG for usage in IETF protocols": CPace and OPAQUE.

See also Cryptographic protocol IEEE P1363 Simultaneous Authentication of Equals Outline of cryptography Zero-knowledge password proof

References

… excerpt ends here. Continue reading the full article.

Worked examples

Example 1 — a first encounter with Password-authenticated key agreement

Start with the simplest possible case. Write down what Password-authenticated key agreement claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Password-authenticated key agreement before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Password-authenticated key agreement ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Password-authenticated key agreement

In research: Password-authenticated key agreement appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Password-authenticated key agreement in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Password-authenticated key agreement is common in secondary-school and first-year university syllabi. It links to neighbouring topics Authentication protocols, Cryptography, Key-agreement protocols, so understanding it makes those chapters shorter.
In everyday life: Look for Password-authenticated key agreement outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Ask Teacher Smith questions about this articleOpens your AI tutor with a question about “Password-authenticated key agreement” →

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Password-authenticated key agreement in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Password-authenticated key agreement means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Password-authenticated key agreement out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Password-authenticated key agreement in simple terms?

Why does Password-authenticated key agreement matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Password-authenticated key agreement?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Password-authenticated key agreement.