Agreed. I'm worried SAE hasn't received as much peer review as other PAKE protocols. IMHO they should have gone with J-PAKE (https://en.wikipedia.org/wiki/Pass

Agreed. I'm worried SAE hasn't received as much peer review as other PAKE protocols. IMHO they should have gone with J-PAKE (https://en.wikipedia.org/wiki/Password_Authenticated_Key_Exchange_by_Juggling https://en.wikipedia.org/wiki/Password_Authenticated_Key_Exc...) which is one of the few PAKE protocols that is not patent encumbered and decently peer-reviewed. In fact, that's why Thread (https://www.threadgroup.org/ https://www.threadgroup.org/) selected J-PAKE as their authentication protocol.