Three-Party Password-Authenticated Key Exchange without Random Oracles