Paradox Stems from the Security Model or the Security Proof?

Recently, Abdalla and Pointcheval proposed an efficient three-party password-authenticated key exchange protocol and provided a proof of security in the Bellare, Pointcheval, and Rogaway (BPR2000) model. Despite the claim of provable security, the protocol was subsequently shown insecure in the presence of an active adversary by Kim-Kwang et al. But they declaimed the flaws stemmed from the weakness of the security model. We defuses it by demonstrating that the attack can be captured in the BPR2000 model. Furthermore, we argue that the paradox is due to the flaws in the proof of security.