Juan José Echevarria, Jon Legarda, Janire Larrañaga, Jonathan Ruiz-de-Garibay
Device-to-Device (D2D) communication enables devices in proximity to establish a wireless direct link. However, these devices may be severely constrained in terms of memory, CPU, and processing resources. Hence, a D2D communication with a constrained device implies new challenges as it does not have the resources required to be secured with standard cryptography. We propose lwAKE for class 0 devices (RFC 7228), which uses one-way cryptographic functions and zero-knowledge proofs to provide mutual authentication and a secure key establishment. We specify the protocol using the High Level Protocol Specification Language and then verify the security properties using the model checkers OFMC and CL-AtSe. The significance of the protocol stands in a key reuse for any successive authentication. Experimental results show that this shortened authentication mode reduces the computational load greatly.
The problem of revocation in anonymous authentication systems is subtle and has motivated a lot of work. One of the preferable solutions consists in maintaining either a whitelist LWof non-revoked users or a blacklist LBof revoked users, and then requiring users to additionally prove, when authenticating themselves, that they are in LW(membership proof) or that they are not in LB(non-membership proof). Of course, these additional proofs must not break the anonymity properties of the system, so they must be zero-knowledge proofs, revealing nothing about the identity of the users. In this paper, we focus on the RSA-based setting, and we consider the case of non-membership proofs to blacklists L = LB. The existing solutions for this setting rely on the use of universal dynamic accumulators; the underlying zero-knowledge proofs are bit complicated, and thus their efficiency; although being independent from the size of the blacklist L, seems to be improvable. Peng and Bao already tried to propose simpler and more efficient zero-knowledge proofs for this setting, but we prove in this paper that their protocol is not secure. We fix the problem by designing a new protocol, and formally proving its security properties. We then compare the efficiency of the new zero-knowledge non-membership protocol with that of the protocol, when they are integrated with anonymous authentication systems based on RSA (notably, the IBM product Idemix for anonymous credentials). We discuss for which values of the size k of the blacklist L, one protocol is preferable to the other one, and we propose different ways to combine and implement the two protocols.
We prove that for every 3-player (3-prover) game G with value less than one, whose query distribution has the support S = {(1,0,0), (0,1,0), (0,0,1)} of Hamming weight one vectors, the value of the n-fold parallel repetition G^{⊗n} decays polynomially fast to zero; that is, there is a constant c = c(G) > 0 such that the value of the game G^{⊗n} is at most n^{-c}. Following the recent work of Girish, Holmgren, Mittal, Raz and Zhan (STOC 2022), our result is the missing piece that implies a similar bound for a much more general class of multiplayer games: For every 3-player game G over binary questions and arbitrary answer lengths, with value less than 1, there is a constant c = c(G) > 0 such that the value of the game G^{⊗n} is at most n^{-c}. Our proof technique is new and requires many new ideas. For example, we make use of the Level-k inequalities from Boolean Fourier Analysis, which, to the best of our knowledge, have not been explored in this context prior to our work.
Quantum information and computation provide a fascinating twist on the notion of proofs in computational complexity theory. For instance, one may consider a quantum computational analogue of the complexity class NP, known as QMA, in which a quantum state plays the role of a proof (also called a certificate or witness), and is checked by a polynomial-time quantum computation. For some problems, the fact that a quantum proof state could be a superposition over exponentially many classical states appears to offer computational advantages over classical proof strings. In the interactive proof system setting, one may consider a verifier and one or more provers that exchange and process quantum information rather than classical information during an interaction for a given input string, giving rise to quantum complexity classes such as QIP, QSZK, and QMIP* that represent natural quantum analogues of IP, SZK, and MIP. While quantum interactive proof systems inherit some properties from their classical counterparts, they also possess distinct and uniquely quantum features that lead to an interesting landscape of complexity classes based on variants of this model. In this survey we provide an overview of many of the known results concerning quantum proofs, computational models based on this concept, and properties of the complexity classes they define. In particular, we discuss non-interactive proofs and the complexity class QMA, single-prover quantum interactive proof systems and the complexity class QIP, statistical zero-knowledge quantum interactive proof systems and the complexity class QSZK, and multiprover interactive proof systems and the complexity classes QMIP, QMIP*, and MIP*.
Oriane Blondel, Patrícia Gonçalves, Marielle Simon
In this paper we prove the convergence to the stochastic Burgers equation\nfrom one-dimensional interacting particle systems, whose dynamics allow the\ndegeneracy of the jump rates. To this aim, we provide a new proof of the second\norder Boltzmann-Gibbs principle introduced in [Gon\\c{c}alves, Jara 2014]. The\nmain technical difficulty is that our models exhibit configurations that do not\nevolve under the dynamics - the blocked configurations - and are locally\nnon-ergodic. Our proof does not impose any knowledge on the spectral gap for\nthe microscopic models. Instead, it relies on the fact that, under the\nequilibrium measure, the probability to find a blocked configuration in a\nfinite box is exponentially small in the size of the box. Then, a dynamical\nmechanism allows to exchange particles even when the jump rate for the direct\nexchange is zero.\n
Sébastien Philippe, R.J. Goldston, Alexander Glaser, Francesco d’Errico
Zero-knowledge proofs are mathematical cryptographic methods to demonstrate the validity of a claim while providing no further information beyond the claim itself. The possibility of using such proofs to process classified and other sensitive physical data has attracted attention, especially in the field of nuclear arms control. Here we demonstrate a non-electronic fast neutron differential radiography technique using superheated emulsion detectors that can confirm that two objects are identical without revealing their geometry or composition. Such a technique could form the basis of a verification system that could confirm the authenticity of nuclear weapons without sharing any secret design information. More broadly, by demonstrating a physical zero-knowledge proof that can compare physical properties of objects, this experiment opens the door to developing other such secure proof-systems for other applications.
Nesrine Khernane, Maria Potop-Butucaru, Claude Chaudet
Advances in wearable and implementable of wireless sensors have enable the development of tiny and intelligent sensors called body sensors. Monitoring the vital body parameters in real-time using wireless body area network (WBAN) has shown great potential in improving healthcare quality not only for patients but also for medical staff. However, security and privacy are still an important issue in WBANs especially in multi-hop architectures. Considering the constraints of the body sensors (namely energy, memory, computational power, etc.). In this paper, we propose and present the design and the evaluation of a secure lightweight and energy efficient authentication scheme BANZKP based on an efficient cryptographic protocol, Zero Knowledge Proof (ZKP) and a commitment scheme. ZKP is used to confirm the identify of the sensor nodes, with small computational requirement, which is favorable for body sensors given their limited resources, while the commitment scheme is used to deal with replay attacks and hence the injection attacks by committing a message and revealing the key later. BANZKP reduces the memory requirement by 56,13% compared to TinyZKP [10], the comparable alternative so far for Body Area Networks. Also, the simulation results demonstrate that our proposed scheme is 17 and 5 times more efficient in term of execution time, and uses 94.11% and 80% less energy compared to TinyZKP and W-ECDSA [16], respectively.
Nesrine Khernane, Maria Potop-Butucaru, Claude Chaudet
-Wireless body area network(WBAN) has shown great potential in improving\nhealthcare quality not only for patients but also for medical staff. However,\nsecurity and privacy are still an important issue in WBANs especially in\nmulti-hop architectures. In this paper, we propose and present the design and\nthe evaluation of a secure lightweight and energy efficient authentication\nscheme BANZKP based on an efficient cryptographic protocol, Zero Knowledge\nProof (ZKP) and a commitment scheme. ZKP is used to confirm the identify of the\nsensor nodes, with small computational requirement, which is favorable for body\nsensors given their limited resources, while the commitment scheme is used to\ndeal with replay attacks and hence the injection attacks by committing a\nmessage and revealing the key later. Our scheme reduces the memory requirement\nby 56.13 % compared to TinyZKP [13], the comparable alternative so far for Body\nArea Networks, and uses 10 % less energy.\n
Sayan Basu Roy, Shubhendu Bhasin, Indra Narayan Kar
Convergence of controller parameters in standard model reference adaptive control (MRAC) requires the system states to be persistently exciting (PE), a restrictive condition to be verified online. A recent data-driven approach, concurrent learning, uses information-rich past data concurrently with the standard parameter update laws to guarantee parameter convergence without the need of the PE condition. This method guarantees exponential convergence of both the tracking and the controller parameter estimation errors to zero, whereas, the classical MRAC merely ensures asymptotic convergence of tracking error to zero. However, the method requires knowledge of the state derivative, at least at the time instances when the state values are stored in memory. The method further assumes knowledge of the control allocation matrix. This paper addresses these limitations by using a memory-based finite-time system identifier in conjunction with a data-driven approach, leading to convergence of both the tracking and the controller parameter estimation errors without the PE condition and knowledge of the system matrices and the state derivative. A Lyapunov based stability proof is included to justify the validity of the proposed data-driven approach. Simulation results demonstrate the efficacy of the suggested method.
Beginning students in algebra classes have little experience and struggle to write proofs. The aim of this study was to look at students’ use of definitions in determining the validity of statements and in writing proofs for given propositions on divisibility of integers. The main objectives were to highlight the difficulties students have with proofs and suggest strategies to help them in writing proofs. In the first part of the study the class was given the definition of divisibility and problems were set to which written responses were obtained. In the second part of the study, divisibility problems were set and students were guided through their proofs using dialogue. The final set of tasks involved skeleton proofs to support the writing of proofs. We found that all the students had difficulties with problems involving generalised variables as opposed to numerical tasks. There was conflict between the new definition and preconceptions and prior knowledge. Students had language problems, problems of division by zero, and were reluctant to use proof by counter-example or contradiction when no direct proof was possible. The implications are that new definitions must be introduced carefully, using a wide range of examples and appropriate prompts. Dialogue and skeleton proofs are two strategies that can be used to improve students’ understanding of proofs.
Francisco Martín-Fernández, Pino Caballero‐Gil, Cándido Caballero‐Gil
This paper describes the design and analysis of a new scheme for the authenticated exchange of confidential information in insecure environments within the Internet of Things, which allows a receiver of a message to authenticate the sender and compute a secret key shared with it. The proposal is based on the concept of a non-interactive zero-knowledge proof, so that in a single communication, relevant data may be inferred to verify the legitimacy of the sender. Besides, the new scheme uses the idea under the Diffie-Hellman protocol for the establishment of a shared secret key. The proposal has been fully developed for platforms built on the Android Open Source Project, so it can be used in any device or sensor with this operating system. This work provides a performance study of the implementation and a comparison between its promising results and others obtained with similar schemes.
Adaptive control techniques are often avoided in aerospace systems due to stringent plant structural requirements and validation difficulties. This dissertation seeks to broaden the range of aerospace engineering applications that can utilize an adaptive controller through the development of an extended model reference adaptive control (MRAC) design. First, a partitioned control framework is presented that permits the combined use of an adaptive control law and a nonadaptive control law. The partitioned framework is used to shift full control authority away from the adaptive portion of the system. Next, two MRAC variations that can accommodate the nonminimum phase zeros often seen in aerospace applications are discussed for use as the adaptive system. The parallel feedforward compensator approach proposes inclusion of a user--defied fictitious model in parallel with the plant that is designed to make the plant appear nonminimum phase. The surrogate tracking error approach modifies the typical MRAC structure to handle nonminimum phase plants by requiring knowledge of its nonminimum phase zeros. A tracking error convergence proof is provided for this continuous-time MRAC variant. The partitioned design using the surrogate tracking error approach is applied to the control tasks of an experimental, flexible wing aircraft. A simulation is used to demonstrate much improved flight path angle command tracking when compared to use of the aircraft's existing nonadaptive control law, even in the presence of large--scale modeling error. A second simulation is used to show the design applied to flexible motion control of the same aircraft model and exhibits similarly improved performance.
The evolution of the traditional electricity infrastructure into smart grids promises more reliable and efficient power management, more energy aware consumers and inclusion of renewable sources for power generation. These fruitful promises are attracting initiatives by various nations all over the globe in various fields of academia. However, this evolution relies on the advances in the information technologies and communication technologies and thus is inevitably prone to various risks and threats. Even though many solutions have been proposed in the recent literature to overcome the security threats in smart grid networks, many issues still need to be addressed to make smart grids a reliable and efficient innovation. In this thesis, we first introduce the background, network architecture, security threats and the security requirements of smart grid networks. Our work focuses on the security aspects of Neighborhood Area Network (NAN) subsystems of smart grid. We present some of the prominent threats and attacks, specific to this subsystem, which violate the specific security goals requisite for its reliable operation. The proposed solutions and countermeasures for these security issues presented in the recent literature have been deeply reviewed to identify the promising solutions with respect to the specific security goals. Then we propose an improved VI dynamic key refreshment strategy for mesh security in the NAN and an authentication scheme based on software defined network (SDN) using dynamic one-way accumulators. The proposed dynamic key refreshment scheme can protect the mesh network system based on IEEE 802.11s standard from DoS attacks during the key refreshment whereby the intruder could launch the attack using the information from previous key refreshment cycle as proposed in the original key refreshment scheme. The use of simple hash based operation makes the scheme cost effective for the resource limited network devices. The proposed scheme also adds an enhancement to the sub-protocol of the original key refreshment scheme for enhanced security and reliability. The proposed SDN based authentication scheme employs one-way dynamic accumulators combined with zero-knowledge proofs for easy and cost efficient authentication process. The availability of the cross authentication among different NAN devices enables us to replicate the mesh network architecture. Using SDN as the backbone of the scheme helps us accommodate the advances of the upcoming wireless technologies where we can update the changes in the scheme conveniently. Our analysis shows that the proposed schemes can achieve the requisite authentication while withstanding multiple attacks and the balance between security and system performance is also achieved.
A cyber-physical system (CPS) is a sensing and communication platform that features tight integration and combination of computation, networking, and physical processes. In such a system, embedded computers and networks monitor and control the physical processes through a feedback loop, in which physical processes affect computations and vice versa. In recent years, CPS has caught much attention in many different aspects of research, such as security and privacy. In this dissertation, we focus on supporting security in CPS and its communication networks. First, we investigate the electric power system, which is an important CPS in modern society. as crucial and valuable infrastructure, the electric power system inevitably becomes the target of malicious users and attackers. In our work, we point out that the electric power system is vulnerable to potential cyber attacks, and we introduce a new type of attack model, in which an attack cannot be completely identified, even though its presence may be detected. to defend against such an attack, we present an efficient heuristic algorithm to narrow down the attack region, and then enumerate all feasible attack scenarios. Furthermore, based on the feasible attack scenarios, we design an optimization strategy to minimize the damage caused by the attack. Next, we study cognitive radio networks, which are a typical communication network in CPS in the areas of security and privacy. as for the security of cognitive radio networks, we point out that a prominent existing algorithm in cooperative spectrum sensing works poorly under a certain attack model. In defense of this attack, we present a modified combinatorial optimization algorithm that utilizes the branch-and-bound method in a decision tree to identify all possible false data efficiently. In regard to privacy in cognitive radio networks, we consider incentive-based cognitive radio transactions, where the primary users sell time slices of their licensed spectrum to secondary users in the network. There are two concerns in such a transaction. The first is the primary user's interest, and the second is the secondary user's privacy. to verify that the payment made by a secondary user is trustworthy, the primary user needs detailed spectrum utilization information from the secondary user. However, disclosing this detailed information compromises the secondary user's privacy. to solve this dilemma, we propose a privacy-preserving scheme by repeatedly using a commitment scheme and zero-knowledge proof scheme.
In this paper we investigate the concept of cancelable biometrics and propose a new scheme for user authorisation providing anonymity based on privacy-preserving computations on sets. We define a problem called (t;n) -Threshold Subset Problem and apply it to a biometric-based security system. Our solution implements biometric template protection based on one-way transformations and Bloom filters. Users authentication data is stored in form of a whitelist and the authorisation process is based on a zero-knowledge proof approach. Using oblivious polynomial evaluation (OPE) a legitimate user is able to recreate a secret polynomial and answer the challenge send by a verifier. We assume that biometric data can be acquired and digitized to the form of a vector representation.
Loss of control is a serious problem in aviation that primarily affects General Aviation. Technological advancements can help mitigate the problem, but the FAA certification process makes certain solutions economically unfeasible. This investigation presents the design of a generic adaptive autopilot that could potentially lead to a single certification for use in several makes and models of aircraft. The autopilot consists of a conventional controller connected in series with a robust direct adaptive model reference controller. In this architecture, the conventional controller is tuned once to provide outer-loop guidance and navigation to a reference model. The adaptive controller makes unknown aircraft behave like the reference model, allowing the conventional controller to successfully provide navigation without the need for retuning. A strong theoretical foundation is presented as an argument for the safety and stability of the controller. The stability proof of direct adaptive controllers require that the plant being controlled has no unstable transmission zeros and has a nonzero high frequency gain. Because most conventional aircraft do not readily meet these requirements, a process known as sensor blending was used. Sensor blending consists of using a linear combination of the plant’s outputs that has no unstable transmission zeros and has a nonzero high frequency gain to drive the adaptive controller. Although this method does not present a problem for regulators, it can lead to a steady state error in tracking applications. The sensor blending theory was expanded to take advantage of the system’s dynamics to allow for zero steady state error tracking. This method does not need knowledge of the specific system’s dynamics, but instead uses the structure of the A and B matrices to perform the blending for the general case. The generic adaptive autopilot was tested in two high-fidelity nonlinear simulators of two typical General Aviation aircraft. The results show that the autopilot was able to adapt appropriately to the different aircraft and was able to perform three-dimensional navigation and an ILS approach, without any modification to the controller. The autopilot was tested in moderate atmospheric turbulence, using consumer-grade sensors and actuators currently available in General Aviation aircraft. The generic adaptive autopilot was shown to be robust to atmospheric turbulence and sensor and actuator random noise. In both aircraft simulators, the autopilot adapted successfully to changes in airspeed, altitude, and configuration. This investigation proves the feasibility of a generic autopilot using direct adaptive controller. The autopilot does not need a priori information of the specific aircraft’s dynamics to maintain its safety and stability arguments. Real-time parameter estimation of the aircraft dynamics are not needed. Recommendations for future work are provided.
In both query and communication complexity, we give separations between the class NISZK, containing those problems with non-interactive statistical zero knowledge proof systems, and the class UPP, containing those problems with randomized algorithms with unbounded error. These results significantly improve on earlier query separations of Vereschagin [Ver95] and Aaronson [Aar12] and earlier communication complexity separations of Klauck [Kla11] and Razborov and Sherstov [RS10]. In addition, our results imply an oracle relative to which the class NISZK is not contained in PP. This answers an open question of Watrous from 2002 [Aar]. The technical core of our result is a stronger hardness amplification theorem for approximate degree, which roughly says that composing the gapped-majority function with any function of high approximate degree yields a function with high threshold degree. Using our techniques, we also give oracles relative to which the following two separations hold: perfect zero knowledge (PZK) is not contained in its complement (coPZK), and SZK (indeed, even NISZK) is not contained in PZK (indeed, even HVPZK). Along the way, we show that HVPZK is contained in PP in a relativizing manner.
We prove a number of implications of these results, which may be of independent interest outside of structural complexity. Specifically, our oracle separation implies that certain parameters of the Polarization Lemma of Sahai and Vadhan [SV03] cannot be much improved in a black-box manner. Additionally, it implies new lower bounds for property testing algorithms with error probability arbitrarily close to 1/2. Finally, our results imply that two-message protocols in the streaming interactive proofs model of Cormode et al. [CTY11] are surprisingly powerful in the sense that, with just logarithmic cost, they can compute functions outside of UPP^CC.
Abstract The Naor–Yung paradigm [63] allows to generically boost security under chosen-plaintext attacks (CPA) to security against chosen-ciphertext attacks (CCA) for public-key encryption (PKE) schemes. The main idea is to encrypt the plaintext twice (under independent public keys), and to append a non-interactive zero-knowledge (NIZK) proof that the two ciphertexts indeed encrypt the same message. Later work by Camenisch, Chandran, and Shoup [32] and Naor and Segev [ 28 , 30 ] established that the very same technique can also be used in the settings of key-dependent message (KDM) and key-leakage attacks (respectively). In this paper we study the conditions under which the two ciphertexts in the Naor–Yung construction can share the same random coins. We find that this is possible, provided that the underlying PKE scheme meets an additional simple property. The motivation for re-using the same random coins is that this allows to design much more efficient NIZK proofs. We showcase such an improvement in the random oracle model, under standard complexity assumptions including Decisional Diffie–Hellman, Quadratic Residuosity, and Subset Sum. The length of the resulting ciphertexts is reduced by 50%, yielding truly efficient PKE schemes achieving CCA security under KDM and key-leakage attacks. As an additional contribution, we design the first PKE scheme whose CPA security under KDM attacks can be directly reduced to (low-density instances of) the Subset Sum assumption. Our PKE scheme supports key-dependent messages computed via any affine function of the secret key.
Oriane Blondel, Patrícia Gonçalves, Marielle Simon
In this paper we prove the convergence to the stochastic Burgers equation from one-dimensional interacting particle systems, whose dynamics allow the degeneracy of the jump rates. To this aim, we provide a new proof of the second order Boltzmann-Gibbs principle introduced in [7]. The main technical difficulty is that our models exhibit configurations that do not evolve under the dynamics - the blocked configurations - and are locally non-ergodic. Our proof does not impose any knowledge on the spectral gap for the microscopic models. Instead, it relies on the fact that, under the equilibrium measure, the probability to find a blocked configuration in a finite box is exponentially small in the size of the box. Then, a dynamical mechanism allows to exchange particles even when the jump rate for the direct exchange is zero.
Sebastiaan de Hoogh, Berry Schoenmakers, Meilof Veeningen
For many applications of secure multiparty computation it is natural to demand that the output of the protocol is verifiable. Verifiability should ensure that incorrect outputs are always rejected, even if all parties executing the secure computation collude. Since the inputs to a secure computation are private, and potentially the outputs are private as well, adding verifiability is in general hard and costly. In this paper we focus on privacy-preserving linear programming as a typical and practically relevant case for verifiable secure multiparty computation. We introduce certificate validation as an effective technique for achieving verifiable linear programming. Rather than verifying the computation proper, which involves many iterations of the simplex algorithm, we extend the output of the secure computation with a certificate. The certificate allows for efficient and direct validation of the correctness of the output. The overhead incurred by the computation of the certificate is marginal. For the validation of a certificate we design particularly efficient distributed-prover zero-knowledge proofs, fully exploiting the fact that we can use ElGamal encryption for this purpose, hence avoiding the use of more elaborate cryptosystems such as Paillier encryption. We also formulate appropriate security definitions for our approach, and prove security for our protocols in this model, paying special attention to ensuring properties such as input independence. By means of several experiments performed in a real multi-cloud-provider environment, we show that the overall performance for verifiable linear programming is very competitive, incurring minimal overhead compared to protocols providing no correctness guarantees at all.
We propose new constructions for inner product encryption – Open image in new window and Open image in new window , both secure under the eXternal Diffie-Hellman assumption (SXDH) in asymmetric pairing groups. The first scheme has constant-size ciphertexts whereas the second one is weakly attribute hiding. Open image in new window is derived from the identity-based encryption scheme of Jutla Roy (Asiacrypt 2013), that was extended from tag-based quasi-adaptive non-interactive zero-knowledge (QA-NIZK) proofs for linear subspaces of vector spaces over bilinear groups. The verifier common reference string (CRS) in these tag-based systems are split into two parts, that are combined during verification. We consider an alternate form of the tag-based QA-NIZK proof with a single verifier CRS that already includes a tag, different from the one defining the language. The verification succeeds as long as the two tags are unequal. Essentially, we embed a two-equation revocation mechanism in the verification. The new QA-NIZK proof system leads to Open image in new window , a constant-sized ciphertext IPE scheme with very short ciphertexts. Both the IPE schemes are obtained by applying the n-equation revocation technique of Attrapadung and Libert (PKC 2010) to the corresponding identity based encryption schemes and proved secure under SXDH assumption. As an application, we show how our schemes can be specialised to obtain the first fully secure identity-based broadcast encryption based on SXDH with a trade-off among the public parameters, ciphertext and key sizes, all of them being sub-linear in the maximum number of recipients of a broadcast.
Recently, the password-authenticated key exchange protocol J-PAKE of Hao and Ryan (Workshop on Security Protocols 2008) was formally proven secure in the algebraic adversary model by Abdalla et al. (IEEE S&P 2015). In this paper, we propose and examine two variants of J-PAKE - which we call RO-J-PAKE and CRS-J-PAKE - that each makes the use of two less zero-knowledge proofs than the original protocol. We show that they are provably secure following a similar strategy to that of Abdalla et al. We also study their efficiency as compared to J-PAKE’s, also taking into account how the groups are chosen. Namely, we treat the cases of subgroups of finite fields and elliptic curves. Our work reveals that, for subgroups of finite fields, CRS-J-PAKE is indeed more efficient than J-PAKE, while RO-J-PAKE is much less efficient. On the other hand, when instantiated with elliptic curves, both RO-J-PAKE and CRS-J-PAKE are more efficient than J-PAKE, with CRS-J-PAKE being the best of the three. Regardless of implementation, we note that RO-J-PAKE enjoys a looser security reduction than both J-PAKE and CRS-J-PAKE. CRS-J-PAKE has the tightest security proof, but relies on an additional trust assumption at setup time.