[shim__]

Yes 32 bit is enough because in PAKE its used for authenticstion not encryption. Which means you get exactly one attempt to brute force after which the procedere will fail