I want to use PAKE for key exchange between two parties (Alice and Bob) which share a low entropy secret (a password they exchanged on a piece of papers).

Alice and Bob use a software on there computer, and log in only occasionally.

Alice gives the password to Bob on a piece of paper, which Bob than (at home) inputs into the Software.

Now, if I would use for example J-PAKE, the password could only be verified at round 2.

The Problem is, if BOB inputs the wrong password because he makes a typo, I want to tell him that right away. The next time Alice logs in could be 24 hours or more later. For reasons of user-friendliness, giving Bob an error at that point is just to late.

Is what I want possible at all? Maybe with a different PAKE algorithm?

If the password would be compromised and could not be used afterwards anymore, that would be a price I would be willing to pay.

1 Answer 1


No, since that would let passwords be tested without sending anything.

You could have the parties [do PAKE with the server] with
independent passwords and let the server be a key sever.

There probably exist protocols in which

Alice chooses a probability p in [0,1] and

even if the server knows the password, the server can't do non-negligibly better
at distinguishing different choices of p than just trying incorrect passwords

an incorrect password will have probability p of passing the honest-server's test

if [the server isn't separately given the password] then the server can't distinguish between
the real password and other passwords which pass the honest-server's test


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .