[CFRG] OPAQUE AKE instantiations

[Christopher Wood <[e-mail]>]

Currently, draft-irtf-cfrg-opaque specifies the "core protocol," which effectively consists of the OPRF-based credential storage and retrieval functionality. An instantiation of OPAQUE glues this core protocol together with a specific AKE, such as 3DH, HMQV, or SIGMA(-I). For completeness, the editors think this draft should minimally describe one complete instantiation with wire format details. And we think this ought to be OPAQUE-3DH. It's a simple variant that's easy to implement. 

If we go down this route, this opens questions about how specific the other instantiations should be. For instance:

- Should also specify a complete signature-based instantiation, such as OPAQUE-SIGMA? (A benefit of doing so is to give applications a choice over which variant they want. A downside is that this introduces yet another SIGMA-based AKE into the mixture of protocols, where something like OPAQUE-in-TLS would probably suffice.)
- If we don't specify any other complete instantiations, how much information should we give for future documents regarding AKE integration? For example, what if one wanted an instantiation based entirely on KEMs, a la KEMTLS [1]

There are undoubtedly plenty of questions to ask about particulars here, though we'd like to hear from folks here on the following two high-level questions:

1) Should we choose OPAQUE-3DH as the standard instantiation? 
2) Should we specify another complete instantiation in this document? And if so, which one?

Thanks,
Chris

[1] https://eprint.iacr.org/2020/534
[2] https://github.com/cfrg/draft-irtf-cfrg-opaque/issues/77