It sounds impossible for very-low-entropy secrets. Like just imagine if the secret is 1 bit. Anyone can pretend they have that 1 bit (since they can just try bo

It sounds impossible for very-low-entropy secrets. Like just imagine if the secret is 1 bit. Anyone can pretend they have that 1 bit (since they can just try both possibilities), which would let them determine that's the same secret the other person has. The only solution would seem to be to stretch the entropy and make a brute-force enumeration slow.