[Lake] Some questions about CIPHERTEXT_2 of Message 2 in draft-ietf-lake-edhoc-20

["Yanlei(Ray)" <[e-mail]>]

Dear authors,

I am confused about how the  CIPHERTEXT_2 is calculated.
In Section 5.3.2 of draft-ietf-lake-edhoc-20, I found there are 2 sentences that contradict each other.
¡° * CIPHERTEXT_2 is calculated by using the EDHOC_Expand function as a binary additive stream cipher over the following plaintext:
- PLAINTEXT_2 =...
...
- CIPHERTEXT_2 = PLAINTEXT_2 XOR KEYSTREAM_2¡±
Is the calculation of the CIPHERTEXT_2 using the EDHOC_Expand function or just making the XOR operation?

Another concern is the security level of the encryption using XOR.
In Section 9.1 of draft-ietf-lake-edhoc-20: ¡°EDHOC has similar security properties as can be expected from the theoretical SIGMA-I protocol [SIGMA] and the Noise XX pattern [Noise], which are similar to methods 0 and 3, respectively.¡±
However, Section 3.2 of the referenced paper [SIGMA] said the encryption of the XOR type is not safe : ¡° In this case the above attack against STS is still viable if the encryption is of the XOR type discussed above. In this case, when A sends the message { A , sigA(gy, gx) }Ks, Eve replaces A¡¯s identity (or certificate) by just XORing the value A ¨’ E in the identity location in the ciphertext. When decrypted by B this identity is read as E¡¯s and the signature verified also as E¡¯s.¡±
By the way, is the encryption using XOR quantum-safe?

Regards,
Lei YAN