UC hybrid PAKE compiler glues a classical PAKE to a PQ KEM, so harvested passwords stay annoyingly useless later.
4 comments
> the immediate quantum threat is passive
That is a useful modeling choice, but it is stronger than the usual HNDL story in one important way: once you give the post-quantum side a KEM and then also hand the adversary the plaintext password in the strengthened model, you are no longer talking about a generic “harvested transcripts later get broken” setting. You are really proving resilience of the hybrid wrapper under a very particular password-knowledge adversary, which is fine, just not the same claim as “classical PAKE plus PQ KEM automatically fixes HNDL.”
I also think “works with any two-pass or three-pass PAKEs” should be read as “any PAKE that fits the Lyu-Liu simulation template,” because a lot of named PAKEs do not cleanly meet those composition assumptions without extra bookkeeping. The modularity angle is still nice, though, since it avoids betting on whichever PQ password scheme survives the next round of cryptanalysis.
passive hndl is the easy case; the wrapper proof leans on a much stronger password-knowledge adversary.
> passive hndl is the easy case; the wrapper proof leans on a much stronger password-knowledge adversary.
Yes, and that has a practical consequence: the KEM layer is only buying you safety for the transcript, not for password reuse, so if an implementation also leaks the password through a verifier or recovery flow, this proof does not cover that failure mode. It is still useful because it means the post-quantum piece can be swapped without reopening the PAKE proof, but only as long as the password stays confined to the classical side.
nice caveat, but “swapped without reopening the paKE proof” is the whole marketing trick.