Asymmetric password-authenticated key exchange

As explained in Real-World Cryptography

An asymmetric password-authenticated key exchange is a password-authenticated key exchange in which the server does not learn the user's password and typically stores a verifier derived from it.

An asymmetric password-authenticated key exchange lets a user authenticate with a password without revealing the password to the server. The server stores password-derived authentication material instead of the password itself, reducing the damage from password database exposure. section 11.4 section 11.2.2

OPAQUE is the recommended asymmetric or augmented PAKE described here. It uses an oblivious pseudorandom function (OPRF), which lets the server compute a pseudorandom function over a blinded password without learning the password input. section 11.2.2

A simplified OPAQUE flow separates registration from login:

• Registration: the user creates a long-term key pair and sends the public key to the server, associated with the user’s identity. section 11.2.2
• The user runs the OPRF with the password to derive a strong symmetric key, then encrypts a backup of the key pair for storage on the server. section 11.2.2
• Login: the user retrieves the encrypted key pair, repeats the OPRF with the password, and uses the resulting symmetric key to decrypt it. section 11.2.2
• The recovered key material then supports a mutually authenticated key exchange or a signed challenge. section 11.2.2

Why the distinction matters

Passwords are convenient because users carry them in their heads, but weak or reused passwords make breaches costly. An asymmetric PAKE preserves password-based login while keeping the real password away from the server; single sign-on and password managers address different parts of the password problem. section 11.2.2 section 11.4

Figure 11.4 An oblivious PRF (OPRF) is a construction that allows one party to compute a PRF over the input of another party without learning that input. To do this, Alice first generates a random blinding factor, then blinds her input with that before sending it to Bob. Bob uses his secret key to compute the PRF over the blinded value, then sends the blinded output to Alice who can unblind it. The result does not depend on the value of the blinding factor.

Use the OPRF diagram to see how blinding lets one party compute a PRF over another party’s input without learning that input. section 11.2.2

Figure 11.5 To register to a server using OPAQUE, Alice generates a long-term key pair and sends her public key to the server, which stores it and associates it with Alice’s identity. She then uses the OPRF protocol to obtain a strong symmetric key from her password and sends an encrypted backup of her key pair to the server. To log in, she obtains her encrypted key pair from the server, then performs the OPRF protocol with her password to obtain a symmetric key capable of decrypting her key pair. All that’s left is to perform a mutually authenticated key exchange (or possibly sign a challenge) with this key.

Use the OPAQUE flow diagram to follow key generation, encrypted key-pair storage, password-based recovery, and final mutual authentication. section 11.2.2

How Real-World Cryptography covers it

How deep it goes

Explains OPAQUE through OPRFs, registration, login, key recovery, and mutual authentication, without implementation-level protocol detail.

Examples

Uses OPRF blinding and OPAQUE registration and login diagrams as concrete protocol examples.

What it assumes

Assumes familiarity with passwords and basic authentication, then builds OPRFs and augmented PAKE behavior from their purpose.

What you can do after

Apply OPAQUE’s flow to evaluate password authentication designs that avoid revealing passwords to servers.

How it connects

Connects OPAQUE with OPRFs, mutual authentication, TLS, symmetric PAKEs, password managers, and single sign-on.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

• OPAQUEincludes · OPAQUE is an asymmetric password-authenticated key exchange protocol that uses an oblivious pseudorandom function to protect a password-derived encrypted key record.
• symmetric password-authenticated key exchangecontrasts with · A symmetric password-authenticated key exchange is a password-based key exchange in which both parties use symmetric password-derived information rather than a server-held asymmetric password verifier.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.