Password authenticated key exchange should do what we want. I was hoping WPA2 would have have used it already.

http://en.wikipedia.org/wiki/Password-authenticated_key_agre...