Replay Attacks on Zero Round-Trip Time: The Case of the TLS 1.3 Handshake Candidates
Authenticated Diffie-Hellman Key Agreement Protocols