Turn a short password into a strong shared key, without the password ever being exposed or guessable offline.
The idea: A password is too short to use as a key: anyone who recorded a login could try every likely password offline. A PAKE mixes the password into a Diffie-Hellman exchange, so each login is a fresh key exchange that only succeeds if both sides used the same password. A recording is useless for guessing: to test a guess, an attacker has to talk to the real server, once per guess, and servers can limit that.
Why it matters: Protects Wi-Fi (WPA3), smart-home pairing and encrypted chat backups.
The details
On the map: SPAKE2, OPAQUE
Password-authenticated key exchange[1]: two parties turn a shared password, or a server-side password verifier, into a strong key, so eavesdroppers learn nothing and an attacker can't test password guesses offline from a recorded session. With OPAQUE the server never even sees the password[2].
Where you meet it: WPA3 Wi-Fi (SAE)[3], iCloud Keychain (SRP)[4], Matter smart-home pairing (SPAKE2+)[5], WhatsApp end-to-end encrypted backups (OPAQUE)[6].
Nothing on the map depends on it: it is an end point, something people use directly.
About the tags
ROM
Its security proof treats a hash function as a perfectly random function (the random oracle model). Real hashes aren't random functions, so this is a heuristic. For signatures and encryption no practical attack has exploited it. For multi-round proof systems, see the Fiat-Shamir box.
References
S.M. Bellovin and M. Merritt. Encrypted key exchange: password-based protocols secure against dictionary attacks. Proceedings 1992 IEEE Computer Society Symposium on Research in Security and Privacy. doi:10.1109/risp.1992.213269
Stanislaw Jarecki, Hugo Krawczyk and Jiayu Xu. OPAQUE: An Asymmetric PAKE Protocol Secure Against Pre-computation Attacks. Advances in Cryptology – EUROCRYPT 2018. doi:10.1007/978-3-319-78372-7_15