[Lake] FW: New Version Notification for draft-selander-lake-edhoc-01.txt

[John Mattsson <[e-mail]>]

Hi, we have submitted draft-selander-lake-edhoc-01

Main changes is that the signature and static DH modes have been merged together and the overhead has been minimized further. EDHOC will be able to do both PSK and RPK authentication over 3 unfragmented frames in 5-hop 6TiSCH and 51 byte LoRaWAN. Since the last update we have made a large number of changes resulting from comments and feedback from people who work on implementation or verification of EDHOC

- One LAKE requirement is to support mixed cerificate and RPK modes. To minimize the overhead for such modes, we have merged the signature and static DH modes into a asymmetric mode which allows mixed signature and static DH authentication.
- With the new mixed mode it was more optimal to use a MAC-then-Sign approach like IKEv2 instead of Sign-then-MAC like TLS 1.3. This is also more aligned with the SIGMA-I paper which does not discuss Sign-then-MAC.
- As disucssed in the SIGMA paper, the second message only requires IND-CPA encryption instead of IND-CCA as there is no confidentiality protection against active attackers anyway.
- The key derivation for static DH authentication has been changed from a parallel to a serial structure based on the suggestions from Karthik Bhargavan on the list.
- The encoding of connection and key identifiers was optimized. There is now 49 values that take 1 byte on the wire.
- SIGMA puts a lot of effort to protect against weaknesses in the PKI process. To protect against similar weaknesses in RPK distribution process, EDHOC now allows an optional subject name (put in external_aad) when RPKs are used.
- The asymmetric mode now makes use of a new SIGNATURE_OR_MAC field based on a suggestion from Eric Rescorla. 
- The info structure in the key derivation was simplified and by defining an EDHOC-KDF function in terms of HKDF-Expand, it became possible to more clearly define how keys are derived in the body of the text as requested by Klaus Hartke.
- After comments from Klaus Hartke regarding the SUITES encoding, the option to signal a cipher suite as an array has been removed. This also meant that the index could be changed to the int of the selected cipher suite.
- AD was missing from the external_aad of the signature and internal MAC, it is now covered.

- Party U and V were renamed Initiator and Responder.
- The key naming has been changed inspired by suggestions from Karthik Bhargavan on the list.
- After suggestions from Klaus Hartke the introduction has been expanded to better explain pre-requisites such as transport, correlation, and trust anchors.
- The introduction has been expanded with sections discussing auxiliary data, identities, and negotiation.
- After suggestions from Karl Norrman, the key derivation now clarifies how and why the two different HKDF steps are used.
- The TBD for the COSE header attributes has been updated to their temporary assignments.
- We have a generated a much larger set of test vectors covering most of the specification.

Cheers,
John

-----Original Message-----
From: "[e-mail]" <[e-mail]>
Date: Monday, 9 March 2020 at 18:35
To: Göran Selander <[e-mail]>, Göran Selander <[e-mail]>, Francesca Palombini <[e-mail]>, John Mattsson <[e-mail]>, John Mattsson <[e-mail]>
Subject: New Version Notification for draft-selander-lake-edhoc-01.txt

    
    A new version of I-D, draft-selander-lake-edhoc-01.txt
    has been successfully submitted by =?utf-8?q?John_Preu=C3=9F_Mattsson?= and posted to the
    IETF repository.
    
    Name:		draft-selander-lake-edhoc
    Revision:	01
    Title:		Ephemeral Diffie-Hellman Over COSE (EDHOC)
    Document date:	2020-03-09
    Group:		Individual Submission
    Pages:		60
    URL:            https://www.ietf.org/internet-drafts/draft-selander-lake-edhoc-01.txt
    Status:         https://datatracker.ietf.org/doc/draft-selander-lake-edhoc/
    Htmlized:       https://tools.ietf.org/html/draft-selander-lake-edhoc-01
    Htmlized:       https://datatracker.ietf.org/doc/html/draft-selander-lake-edhoc
    Diff:           https://www.ietf.org/rfcdiff?url2=draft-selander-lake-edhoc-01
    
    Abstract:
       This document specifies Ephemeral Diffie-Hellman Over COSE (EDHOC), a
       very compact, and lightweight authenticated Diffie-Hellman key
       exchange with ephemeral keys.  EDHOC provides mutual authentication,
       perfect forward secrecy, and identity protection.  EDHOC is intended
       for usage in constrained scenarios and a main use case is to
       establish an OSCORE security context.  By reusing COSE for
       cryptography, CBOR for encoding, and CoAP for transport, the
       additional code footprint can be kept very low.
    
                                                                                      
    
    
    Please note that it may take a couple of minutes from the time of submission
    until the htmlized version and diff are available at tools.ietf.org.
    
    The IETF Secretariat