Why does DH-EKE require that public keys be indistinguishable from random? The introduction to SPAKE pre-authentication states:


  Diffie-Hellman Encrypted Key Exchange (DH-EKE) is the earliest widely deployed PAKE. It works by encrypting the public keys of a Diffie-Hellman key exchange with a shared secret. However, it requires both that unauthenticated encryption be used and that the public keys be indistinguishable from random data. This last requirement makes it impossible to use this form of PAKE with elliptic curve cryptography. For these reasons, DH-EKE is not a good fit.


I'm curious about the sentence in bold--why does DH-EKE require that the public keys be indistinguishable from random data? After all, the public keys are public, and furthermore, they will be encrypted with the shared password.

I'm guessing that if the public keys are in fact distinguishable from random data, that that reveals some information about the shared password, but I don't know how.
In DH-EKE, Alice needs to encrypt her chosen public key with the shared password. If the public keys do not look random, an attacker can try to decrypt Alice's first encrypted message to recover a small set of possible passwords, merely by checking if the decrypted message belongs to the public key space or not. Note that this is an offline attack, which is the type of attacks that PAKE protocols aim to prevent.