CPace

As explained in Real-World Cryptography

CPace is a symmetric password-authenticated key-exchange algorithm in which parties derive a group generator from a shared password and use it for ephemeral Diffie-Hellman key exchange.

When two devices need mutual authentication over WiFi, Bluetooth, or NFC, a long public key may be impractical. CPace lets both parties use a shared password to establish a secure session key. section 11.3.2 section 11.4

A simplified CPace exchange proceeds as follows:

• Both devices derive a generator for a predetermined cyclic group from the shared password. section 11.3.2
• They use that generator as the base for an ephemeral Diffie-Hellman exchange. section 11.3.2
• They derive the session key from the exchange output, ephemeral public-key transcript, and unique session ID. section 11.3.2

Connecting a new device

Instead of manually entering a cumbersome public key, a user enters a short shared password on both devices, as commonly happens when joining home WiFi. section 11.4

Figure 11.14 The CPace PAKE works by having the two devices create a generator based on a password and then use it to perform as a base for the usual ephemeral DH key exchange.

The figure shows the password-derived generator becoming the base for the usual ephemeral Diffie-Hellman exchange. section 11.3.2

How Real-World Cryptography covers it

How deep it goes

Explains generator derivation, ephemeral exchange, session binding, and elliptic-curve safeguards without detailing implementation procedures.

Examples

Uses device pairing over WiFi, Bluetooth, or NFC and entering a password to connect to home WiFi.

What it assumes

Starts from a shared password and introduces the required ephemeral Diffie-Hellman construction rather than assuming imported public keys.

What you can do after

Evaluate/understand how password-based device pairing can replace cumbersome public-key import while retaining mutual authentication.

How it connects

Connects password-authenticated key exchange with Diffie-Hellman, elliptic curves, hash-to-curve, session identifiers, and authenticated channels.

liveBookmanning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Related concepts

• Diffie–Hellman key exchangeuses · Diffie–Hellman key exchange is a public-key key-agreement protocol that enables parties to derive a shared secret over an insecure channel without transmitting it.
• symmetric password-authenticated key exchangekind of · A symmetric password-authenticated key exchange is a password-based key exchange in which both parties use symmetric password-derived information rather than a server-held asymmetric password verifier.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.