SPAKE2+

通信双方已知基点P，以及另外两个点M & N，且分别选取一个随机数x

\[ \begin{align}\begin{aligned}(w_0, w_1) = KDF(pw) // A已知pw，B仅存储w_0、w_1*P\\A -> B : x_a * P + w_0 * M B -> A : x_b * P + w_0 * N 显然，最终双方能获得 SK_0 = x_a*x_b*P, SK_1 = w_1*x_b*P\end{aligned}\end{align} \]