I want to use PAKE for key exchange between two parties (Alice and Bob) which share a low entropy secret (a password they exchanged on a piece of papers).

Alice and Bob use a software on there computer, and log in only occasionally.

Alice gives the password to Bob on a piece of paper, which Bob than (at home) inputs into the Software.

Now, if I would use for example J-PAKE, the password could only be verified at round 2.

The Problem is, if BOB inputs the wrong password because he makes a typo, I want to tell him that right away. The next time Alice logs in could be 24 hours or more later. For reasons of user-friendliness, giving Bob an error at that point is just to late.

Is what I want possible at all? Maybe with a different PAKE algorithm?

If the password would be compromised and could not be used afterwards anymore, that would be a price I would be willing to pay.


No, since that would let passwords be tested without sending anything.

You could have the parties [do PAKE with the server] with
independent passwords and let the server be a key sever.

There probably exist protocols in which

Alice chooses a probability p in [0,1] and

even if the server knows the password, the server can't do non-negligibly better
at distinguishing different choices of p than just trying incorrect passwords

an incorrect password will have probability p of passing the honest-server's test

if [the server isn't separately given the password] then the server can't distinguish between
the real password and other passwords which pass the honest-server's test


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.