Can a password strength policy i.e.: must contain at-least 8 chars must contain one uppercase letter must contain one lowercase letter must contain one number
Be enforced if a PAKE protocol is used, such as OPAQUE? Is there any way with these protocols (eg, OPAQUE) to prove the password conforms to the above. As with PAKE the password never reaches the server, and client side checks can be easily bypassed. Does this mean with PAKE that users could use passwords with 3 or 4 characters (or lower, of course)?
I know I can check against commonly used passwords & specific passwords, such as historic user passwords, by encrypting and comparing outputs. But of course it is not feasible to check the output of every password combination up to 8 characters.
I want to check only the historic passwords & common passwords that conform to this policy.
Is there any-way on the server side to prove that the input on the client side conforms, with a protocol like OPAQUE? Given that the password is never actually seen by the server.
Does this mean the use of PAKE such as OPAQUE could potentially reduce password security?
EDIT: I am aware that enforcing minimum character requirements (eg: one number, etc) is contested. The above policy is merely an exmaple.