  In recent years, several protocols for password-based authenticated key
exchange have been proposed. These protocols aim to be secure even though the
sample space of passwords may be small enough to be enumerated by an off-line
adversary. In Eurocrypt 2000, Bellare, Pointcheval and Rogaway (BPR) presented
a model and security definition for authenticated key exchange. They claimed
that in the ideal-cipher model (random oracles), the two-flow protocol at the
core of Encrypted Key Exchange (EKE) is secure. Bellare and Rogaway suggested
several instantiations of the ideal cipher in their proposal to the IEEE
P1363.2 working group. Since then there has been an increased interest in
proving the security of password-based protocols in the ideal-cipher model. For
example, Bresson, Chevassut, and Pointcheval have recently showed that the
One-Encryption-Key-Exchange (OEKE) protocol is secure in the ideal cipher
model. In this paper, we present examples of real (NOT ideal) ciphers
(including naive implementations of the instantiations proposed to IEEE
P1363.2) that would result in broken instantiations of the idealised AuthA
protocol and OEKE protocol. Our result shows that the AuthA protocol can be
instantiated in an insecure way, and that there are no well defined (let alone
rigorous) ways to distinguish between secure and insecure instantiations. Thus,
without a rigorous metric for ideal-ciphers, the value of provable security in
ideal cipher model is limited.
