A Cryptographic Analysis of the TLS 1.3 Handshake Protocol Candidates
Stronger Security of Authenticated Key Exchange