PAKE Protocols and Their Properties

Password Authenticated Key Exchange (PAKE) is a family of protocols that allow two parties sharing only a low-entropy password to establish a high-entropy session key with mutual authentication. Unlike traditional password authentication, PAKE provides forward secrecy and resistance to offline dictionary attacks without transmitting the password.

Balanced PAKE (B-PAKE) treats both parties symmetrically: both client and server hold the same secret (the password or a symmetric transform of it). Augmented PAKE (A-PAKE) is asymmetric: the server holds only a public verifier derived from the password, making server compromise non-catastrophic for client security.

Simple Password Exponential Key Exchange (SPEKE) is a balanced PAKE where both parties use the password to define a group generator g = H(password). The subsequent exchange is a Diffie-Hellman key exchange using this password-derived generator, ensuring only parties knowing the password can complete it.

Password Authenticated Key Exchange by Juggling (J-PAKE), RFC 8236, uses zero-knowledge proofs to allow two parties to establish a session key from a shared password. J-PAKE is used in Thread (IoT network protocol) and was implemented in OpenSSL. It is patent-free and provides balanced PAKE properties.

OPAQUE (an IETF draft, draft-irtf-cfrg-opaque) is an augmented PAKE with strong security properties. During registration, the client uses an oblivious PRF (OPRF) to derive a key from the password without the server learning the password. The server stores an encrypted envelope containing the client's private key.

During OPAQUE login, the client and server execute an OPRF protocol to reconstruct the client's key without the server learning the password. The client then uses this key to decrypt the envelope and retrieve credentials for completing a key exchange. The server never observes the password in any phase.

OPAQUE provides pre-computation resistance: even if an attacker compromises the server and obtains all stored data, they cannot perform an offline dictionary attack on the stored values without simulating a fresh OPRF interaction for each guess. This is a stronger guarantee than SRP provides.

SPAKE2 (RFC 9382) is a simple balanced PAKE based on Diffie-Hellman with password-blinded public keys. SPAKE2+ is the augmented variant where the server stores separate values for client and server roles. Apple uses SPAKE2+ in HomeKit for pairing devices, and it is used in several IoT device commissioning protocols.

CPace (RFC 9380 component) is a composable PAKE designed by Haase and Labrique, adopted as the IETF standard balanced PAKE. CPace is designed to be composed with subsequent key confirmation steps and is recommended for use in new protocols needing balanced PAKE. It is the CFRG-selected B-PAKE alongside OPAQUE as A-PAKE.

All PAKEs provide authentication and key establishment. A-PAKEs additionally provide server compromise resistance. OPAQUE provides pre-computation resistance beyond server compromise. FIDO2 provides origin binding that prevents phishing. The choice depends on whether password-based auth is required or can be replaced with public-key credentials.

PAKE protocols are more complex to implement correctly than simple password hashing and should be sourced from audited libraries. The IETF CFRG has standardized CPace (B-PAKE) and OPAQUE (A-PAKE) as the recommended choices for new protocols. SRP remains in use in existing deployments but OPAQUE is preferred for new designs.

Which PAKE property distinguishes Augmented PAKE (A-PAKE) from Balanced PAKE (B-PAKE)?

PAKE protocols enable password-based mutual authentication with key establishment. B-PAKEs (CPace, SPAKE2, J-PAKE) are symmetric. A-PAKEs (SRP, OPAQUE, SPAKE2+) store only server-side verifiers. OPAQUE provides the strongest guarantees including pre-computation resistance. IETF has standardized CPace and OPAQUE as the recommended modern choices.