Downgrade Resilience in Key-Exchange Protocols
sigma : the ' sign - and - mac ' approach to authenticated diffie - hellman and its use in the ike - protocols .