Post-quantum PAKE over lattices revised: Smaug-T.PAKE for mobile devices

In this paper, an efficient post-quantum secure password-authenticated key exchange (PAKE) scheme from a well-structured lattice-based key encapsulation mechanism (KEM) is proposed. The generic KEM to PAKE idea, OCAKE, is modified by considering hybrid module learning with errors (MLWE) + module learning with rounding (MLWR) assumptions to obtain explicit password-based authentication from SMAUG-T.KEM procedures. As a KEM primitive, SMAUG-T.KEM is chosen due to its performance against the National Institute of Standards and Technology (NIST) standard Crystals-Kyber (Kyber) to obtain an efficient and post-quantum secure PAKE scheme. Firstly, the anonymity and fuzziness properties of SMAUG-T.KEM are proven to fit the OCAKE approach in constructing the PAKE version of Smaug.KEM. Then, the post-quantum security of the proposed SMAUG-T.PAKE is analyzed in the universal composability (UC) model based on the hybrid security assumptions and proved properties. The reference C and JAVA codes are written to evaluate whether the targeted efficiency is achieved in different platforms. Based on the central processing unit (CPU) and memory usage, run time, and energy consumption metrics, the proposed solution is compared with current PAKE proposals. The performance results showed that SMAUG-T.PAKE, with two optional encryption modes, Advanced Encryption Standard (AES) or Ascon, presents better performance than the other module-based PAKE solutions from lattices in terms of both reference and mobile results.