Draft: draft-ietf-lake-edhoc

Commentary: Hi all , Our previous formal analysis on draft 12 and 14 lead to a publication at USENIX 23 available here As the two other previous formal analysis were cited in the draft , I 'm proposing to add next to them our new one with this PR . As a side remark , our models are here ( ) , and we are trying to update everything according to draft 17 with a new overall pass . It might be tight for IETF115 , but we are trying our best ! And anyway , it should only be positive results by now ;) 
 Thanks ! Great that you follow up with the latest version . The latest relevant changes are probably in -16 and only adds things to the key derivation ( some of which was proposed by you :-) . 
 Thanks for the pointer ! Though , the biggest issue is not so much updating the model of the protocol , but rather making a new full pass on the security claims and new appendices , trying to have a clear systematized link between claims from the draft and what we check in the model . 
 let 's check if there are some other papers missing and what we want to say about them . 
 We should at least add references to work by ETH and ENS . Let 's merge this as a starting point and continue discussion in . 
 Given the various security analyses EDHOC has seen and their insights being discussed in Section 8 , would it make sense to add informative references to those ( as done , e.g. , for TLS 1.3 , RFC 8446 Appendix E ) ? 
 Seems like a good idea to me 
 Related to 
 This was discussed on the IETF 116 LAKE WG meeting , and in absence of volunteers to draft such an appendix we decided to start with adding references . We may want to go somewhere in between a whole appendix and a sentence , and expand with a paragraph about each reference . We still need someone to draft that paragraph for the different references and would like to conclude on this fairly soon . We start by merging now . 
 Closing since is merged .
Mailing list commentary: Hi all , While we do not have any explicit comments on the document , we thought it is maybe still worthwhile to share the following analysis confirmation . We updated our computational analysis of the SIG - SIG mode , of which presented an earlier version at IETF 114 , to draft 17 . We could confirm that with some of the later cryptographic suggestions ( PR # 276 , # 318 ) included , EDHOC SIG - SIG achieves key exchange security ( key secrecy and explicit authentication ) in a strong model capturing potentially colliding credential identifiers , assuming , among others , an " exclusive ownership " property of the signature scheme ( established for Ed25519 , conjectured for the way ECDSA is used in EDHOC SIG - SIG ) . Our updated analysis is not publicly available yet at this point . Let us know if a public reference would be helpful for the draft RFC ; we can also share the document individually upon request . The last point actually maybe does lead to a comment on the document : Given the various security analyses EDHOC has seen and their insights being discussed in Section 8 , would it make sense to add informative references to those ( as done , e.g. , for TLS 1.3 , RFC 8446 Appendix E ) ? Kind regards , ( with )
Paragraph (version A):
Two earlier versions of EDHOC have been formally analyzed Norrman20
Bruni18 and the specification has been updated based on the analysis.
Paragraph (version B):
Three earlier versions of EDHOC have been formally analyzed Jacomme23
Norrman20 Bruni18 and the specification has been updated based on the
analysis.