[Lake] Explanation of issue #52 - encryption of message_2

[John Mattsson <[e-mail]>]

Hi,

There was a AP on me from the last iterim to send an email discussing the requirements for encryption of message_2.

This is issue nr. 52 on GitHub
https://github.com/lake-wg/edhoc/issues/52

The main requirements as I see them are:

- Security requirements: conceal the identity of the server to any passive attackers. As described in the SIGMA paper an active attacker can get the identity by sending his/her own message_1. The security requirements here are lower than we normally require. So IND-CPA encryption with a key that only the Initiator and Responser have is good enough. 

- Expansion requirements: message_2 is already 1 byte to large for the currently estimated size requirements. Wwe will later have to compress it further by concatenating some byte strings with known length. The encryption can therefore not cause any message expansion so only IND-CPA is possible.

- Ease for developers requirement: We want to make the implementation easy for developers implementing EDHOC. We would e.g. like to avoid forcing them to implement stream cipher modes of AES and ChaCha.  

Based on the feedback from developers the solution in -04 is to use (HDKF-)Expand as a binary additive stream cipher. This provides better confidentiality than AES-CTR. The paper calculating AEAD limits for CCM is e.g. enthusiastic about the confidentiality properties of HMAC-SHA1 used as a stream cipher. 

Cheers,
John