A Cryptographic Analysis of the TLS 1.3 Handshake Protocol Candidates
Triple Handshakes and Cookie Cutters: Breaking and Fixing Authentication over TLS