[Crypto-panel] Request to review: draft-selander-ace-cose-ecdhe-11

[Alexey Melnikov <[e-mail]>]

Dear Crypto Panel members,

CFRG chairs received a request to review this document (maybe even 2 
reviews), ideally by March 4. (If you miss the deadline, a review that 
is completed later is still useful.) Any takers?

In particular, the review should concentrate on the following aspects of 
the proposal:

EDHOC 
(https://datatracker.ietf.org/doc/draft-selander-ace-cose-ecdhe-11) is 
being proposed as a new AKE to meet the need of constrained/IoT 
environments (such as those considered by the ACE WG). Formal analysis 
on -08 was conducted by [1] [2]. A review by the Crypto Review Panel 
would be helpful to evaluate the security properties (mutual 
authentication, PFS, and identity protection) claimed by the draft:

** Top-line: does EDHOC provide the security properties it asserts?  How do we reason about/approach answering  that question?
** Is this draft complete -- what would you like to see that isn't written?
** What areas of the draft or features of the protocol require further analysis or polish?  Are the prerequisite/assumptions clear enough?
** Are the choice of ciphersuites acceptable?
** Does the formal analysis in [1] appear credible?
** Does -11 appear to have addressed the concerned outlined by [1] in -08? (The authors of [1] are working on an update of the analysis on -11)

A related key question being discussed is "ignoring whether the security properties of EDHOC are valid, can the 'lightweight property of EDHOC' be realized with another protocol"

[1] https://link.springer.com/content/pdf/10.1007%2F978-3-030-04762-7_2.pdf
[2] https://github.com/theisgroenbech/edhoc-proverif

Thank you,
Alexey