  We propose pretty simple password-authenticated key-exchange protocol which
is based on the difficulty of solving DDH problem. It has the following
advantages: (1) Both $y_1$ and $y_2$ in our protocol are independent and thus
they can be pre-computed and can be sent independently. This speeds up the
protocol. (2) Clients and servers can use almost the same algorithm. This
reduces the implementation costs without accepting replay attacks and abuse of
entities as oracles.
