Draft: draft-ietf-lake-edhoc

Commentary: The new definition of info in th ecurrent specification is . I noticed two problems with this while implementing . create the array you need to parse context to see how many items it contains . context is validated , length is not strictly defined ( an attacker could create collisions ) I suggest that info is changed to : 
 In the exporter , the application using EDHOC could input a context ( a encoded CBOR sequence ) that is not valid CBOR . That is not a big problem , but might lead to security issues in the future , if is assumed that info is valid CBOR . prefered sequence to array . I do n't think bstr wrapping the sequence has the same problems as array wrapping the sequence . Array wrapping the info sequence seems like an unesasary step . I suggest . 
 We have also gotten comments disliking the use of any 
 Current specification could give the impression that there is a single maclength . But the  length in message2 and message_3 may be different . 
 One fix is to update to
Paragraph (version A):
where label is a registered tstr from the EDHOC Exporter Label
registry (exporter-label), context is a CBOR sequence defined by the
application, and length is a uint defined by the application.  The
(label, context) pair must be unique, i.e., a (label, context) MUST
NOT be used for two different purposes.  However an application can
re-derive the same key several times as long as it is done in a
secure way.  For example, in most encryption algorithms the same
(key, nonce) pair must not be reused.  The context can for example be
the empty (zero-length) sequence or a single CBOR byte string.
Paragraph (version B):
where label is a registered tstr from the EDHOC Exporter Label
registry (exporter-label), context is a bstr defined by the
application, and length is a uint defined by the application.  The
(label, context) pair must be unique, i.e., a (label, context) MUST
NOT be used for two different purposes.  However an application can
re-derive the same key several times as long as it is done in a
secure way.  For example, in most encryption algorithms the same
(key, nonce) pair must not be reused.  The context can for example be
the empty (zero-length) sequence or a single CBOR byte string.
Paragraph (version A):
Compute MAC_2 = EDHOC-KDF( PRK_3e2m, TH_2, "MAC_2", ( ID_CRED_R,
CRED_R, ? EAD_2 ), mac_length ).  If the Responder authenticates
with a static Diffie-Hellman key (method equals 1 or 3), then
mac_length is the EDHOC MAC length given by the selected cipher
suite.  If the Responder authenticates with a signature key
(method equals 0 or 2), then mac_length is equal to the output
size of the EDHOC hash algorithm given by the selected cipher
suite.
Paragraph (version B):
Compute MAC_2 = EDHOC-KDF( PRK_3e2m, TH_2, "MAC_2", << ID_CRED_R,
CRED_R, ? EAD_2 >>, mac_length_2 ).  If the Responder
authenticates with a static Diffie-Hellman key (method equals 1 or
3), then mac_length_2 is the EDHOC MAC length given by the
selected cipher suite.  If the Responder authenticates with a
signature key (method equals 0 or 2), then mac_length_2 is equal
to the output size of the EDHOC hash algorithm given by the
selected cipher suite.
Paragraph (version A):
Compute MAC_3 = EDHOC-KDF( PRK_4x3m, TH_3, "MAC_3", ( ID_CRED_I,
CRED_I, ? EAD_3 ), mac_length ).  If the Initiator authenticates
with a static Diffie-Hellman key (method equals 2 or 3), then
mac_length is the EDHOC MAC length given by the selected cipher
suite.  If the Initiator authenticates with a signature key
(method equals 0 or 1), then mac_length is equal to the output
size of the EDHOC hash algorithm given by the selected cipher
suite.
Paragraph (version B):
Compute MAC_3 = EDHOC-KDF( PRK_4x3m, TH_3, "MAC_3", << ID_CRED_I,
CRED_I, ? EAD_3 >>, mac_length_3 ).  If the Initiator
authenticates with a static Diffie-Hellman key (method equals 2 or
3), then mac_length_3 is the EDHOC MAC length given by the
selected cipher suite.  If the Initiator authenticates with a
signature key (method equals 0 or 1), then mac_length_3 is equal
to the output size of the EDHOC hash algorithm given by the
selected cipher suite.