speke

SPEKE, short for Simple Password Exponential Key Exchange, is a password-based key agreement protocol in the family of PAKE (password-authenticated key exchange) schemes. It enables two parties who share a low-entropy password to establish a high-entropy session key over an insecure channel while aiming to resist offline dictionary attacks.

Operation: SPEKE relies on a deterministic password-to-generator mapping. Both parties deterministically map the shared password P to a generator g of a large cyclic group of prime order q. Each party selects a fresh random exponent a (and the other party selects b) and computes A = g^a and B = g^b, then exchanges A and B. Each side computes the shared secret s = B^a = A^b = g^{ab}. A key derivation function then processes s, often incorporating transcript data to bind identities and context, producing the final session key. This construction ensures that the resulting key depends on the password without revealing it.

Security properties: SPEKE provides forward secrecy and mutual authentication when combined with appropriate transcript data or channel authentication. The password-to-generator step prevents offline verification of candidate passwords by eavesdroppers who only observe A and B. Nevertheless, the protocol requires careful parameter selection and a secure password-to-generator function to avoid weaknesses such as subgroup-related vulnerabilities or implementation pitfalls.

Variants and usage: SPEKE is one of several PAKE schemes, alongside others such as SRP, J-PAKE, and OPAQUE. It is used in secure channel introductions and authentication mechanisms that rely on password-based key exchange, and may be adapted with different hash functions, group choices, and transcript bindings to suit specific protocol requirements.