Zero-Knowledge Proof System for Password Policy Verification in Asymmetric Password-Authenticated Key Exchange

This paper describes a zero-knowledge proof system that enables verification of password policy compliance within an asymmetric password-authenticated key exchange (aPAKE) protocol specifically OPAQUE (RFC 9807) without revealing the password to the server. The system is built on a composable sub-circuit architecture: independent verification gadgets are combined into a single zero-knowledge proof, each gadget accepting portions of the private witness and producing public instance values, enabling the server to verify multiple password properties in one proof verification. Four gadgets are disclosed: (1) a Policy Engine for character class verification via lookup tables, (2) a History Nullifier for password inequality proof via squared-difference accumulation, (3) an OPAQUE Binder for cryptographic binding to the aPAKE registration element via hash-to-curve and elliptic curve scalar multiplication, and (4) a Breach Detector for offline breached-password detection via Bloom filter non-membership proof using algebraic hashing. The composable architecture permits addition of further gadgets without modifying existing ones, each extending the public instance vector.