#crypto #pake #cpace

no-std pake-cpace

A simple implementation of CPace, a balanced PAKE

7 releases

0.1.6 Nov 30, 2020
0.1.5 May 14, 2020

#3 in #pake

22 downloads per month

ISC license

172 lines


CPace-Ristretto255, a balanced PAKE

A CPace implementation for Rust.

This is a port of the CPace implementation for libsodium.


CPace is a protocol for two parties that share a low-entropy secret (password) to derive a strong shared key without disclosing the secret to offline dictionary attacks.

CPace is a balanced PAKE, meaning that both parties must know the low-entropy secret.

Applications include pairing IoT and mobile applications using ephemeral pin codes, QR-codes, serial numbers, etc.


The CPace protocol requires a single round trip.

It returns a set of two 256-bit (SHARED_KEY_BYTES bytes) keys that can be used to communicate in both directions.

use pake_cpace::CPace;

// client-side
let client = CPace::step1("password", "client", "server", Some("ad")).unwrap();

// server-side
let step2 = CPace::step2(&client.packet(), "password", "client", "server", Some("ad")).unwrap();

// client-side
let shared_keys = client.step3(&step2.packet()).unwrap();

// both parties now have the same set of shared keys
assert_eq!(shared_keys.k1, step2.shared_keys.k1);
assert_eq!(shared_keys.k2, step2.shared_keys.k2);


  • This implementation uses the Ristretto255 group and SHA-512 as the hash function, so it is compatible with the C implementation and can trivially be ported to wasm-crypto.
  • Client and server identifiers have a maximum size of 255 bytes.
  • no_std compatible, WebAssembly compatible.


~38K SLoC