Table 4. Comparison of four-phase lattice-based PAKE protocols.

	Hard problem	Number of party	Number of arithmetic operation −	Number of flow*	Number of hash	Reconciliation bound	Reconciliation components	Reusable key	Used method for SLA resistance	Anonymity	Security model	PFS
Dabra, Bala & Kumari (2020)				RLWE	2	3 × 3 +	9	3	$q>16\left(4{\beta }^2{n}^{\frac{2}{3}}+2\beta n^{\frac{1}{2}}\right)$	Cha(), Mod2()	×	Direct Public Key Validation From Zero-Knowledge Authentication	✓	RoR	✓
Ding, Cheng & Qin (2022)				RLWE	2	2 × 2 +	9	3	$q>16\left({\alpha }^3{n}^{\frac{5}{2}}+\alpha n^{\frac{1}{2}}\right)$	Cha(), Mod2()	✓	Practical Randomized KE+	✓	RoR	✓
Islam & Basu (2021)				LWE	3	1×	10	3	$q>16{\beta }^2{n}^{\frac{2}{3}}$	Cha(), Mod2()	×	×	×	ROM	✓
Li, Wang & Morais (2020)				LWE	2	− −	2	4	For $n,m\ge n\sqrt{logq}$, inner product <e, k > should be negligible.	×	×	×	×	ROM	×
BiGISIS.PAKE				BiGISIS	2	2 × 5 +/-	9	3	∥kś − km´ ∥  ≤ 2(8ϑ + β)	MSB()	✓	BiP	✓	RoR	✓

Notes.

*Total number of passes for all stages, ×, Multiplication; +, Addition; −, Subtraction; − −,No computation; ⁻, Number of arithmetic operations used in key component calculation; ROM, Random Oracle Model) ⁺: According to Bindel, Stebila & Veitch (2021) and Qin et al. (2022), because of the used reconciliation, SLA is possible.