Cryptology ePrint Archive: Report 2020/848

On Composability of Game-based Password Authenticated Key Exchange

Marjan Škrobot and Jean Lancrenon

Abstract: It is standard practice that the secret key derived from an execution of a Password Authenticated Key Exchange (PAKE) protocol is used to authenticate and encrypt some data payload using a Symmetric Key Protocol (SKP). Unfortunately, most PAKEs of practical interest are studied using so-called game-based models, which – unlike simulation models – do not guarantee secure composition per se. However, Brzuska et al. (CCS 2011) have shown that middle ground is possible in the case of authenticated key exchange that relies on Public- Key Infrastructure (PKI): the game-based models do provide secure composition guarantees when the class of higher-level applications is restricted to SKPs. The question that we pose in this paper is whether or not a similar result can be exhibited for PAKE. Our work answers this question positively. More specifically, we show that PAKE protocols secure according to the game-based Real-or-Random (RoR) definition with the weak forward secrecy of Abdalla et al. (S&P 2015) allow for safe composition with arbitrary, higher-level SKPs. Since there is evidence that most PAKEs secure in the Find-then-Guess (FtG) model are in fact secure according to RoR definition, we can conclude that nearly all provably secure PAKEs enjoy a certain degree of composition, one that at least covers the case of implementing secure channels

Category / Keywords: cryptographic protocols / Password Authenticated Key Exchange, Composability, Composition Theorem.

Original Publication (with minor differences): 2018 IEEE European Symposium on Security and Privacy (EuroS&P)

Date: received 8 Jul 2020

Contact author: marjan skrobot at gmail com

Available format(s): PDF | BibTeX Citation

Version: 20200712:123909 (All versions of this report)

Short URL:

[ Cryptology ePrint archive ]