Subject: [Crypto-panel] Request to review: draft-selander-ace-cose-ecdhe-11

From: Alexey Melnikov <[email-masked]>
Date: Thu, 21 Feb 2019 14:05:03 +0000

Dear Crypto Panel members,

CFRG chairs received a request to review this document (maybe even 2 
reviews), ideally by March 4. (If you miss the deadline, a review that 
is completed later is still useful.) Any takers?

In particular, the review should concentrate on the following aspects of 
the proposal:

EDHOC 
(https://datatracker.ietf.org/doc/draft-selander-ace-cose-ecdhe-11) is 
being proposed as a new AKE to meet the need of constrained/IoT 
environments (such as those considered by the ACE WG). Formal analysis 
on -08 was conducted by [1] [2]. A review by the Crypto Review Panel 
would be helpful to evaluate the security properties (mutual 
authentication, PFS, and identity protection) claimed by the draft:

** Top-line: does EDHOC provide the security properties it asserts?  How do we reason about/approach answering  that question?
** Is this draft complete -- what would you like to see that isn't written?
** What areas of the draft or features of the protocol require further analysis or polish?  Are the prerequisite/assumptions clear enough?
** Are the choice of ciphersuites acceptable?
** Does the formal analysis in [1] appear credible?
** Does -11 appear to have addressed the concerned outlined by [1] in -08? (The authors of [1] are working on an update of the analysis on -11)

A related key question being discussed is "ignoring whether the security properties of EDHOC are valid, can the 'lightweight property of EDHOC' be realized with another protocol"

[1] https://link.springer.com/content/pdf/10.1007%2F978-3-030-04762-7_2.pdf
[2] https://github.com/theisgroenbech/edhoc-proverif

Thank you,
Alexey

---

From: Russ Housley <[email-masked]>
Date: Thu, 21 Feb 2019 09:53:52 -0500

Yes, I can take a look at it next week.

Russ

> On Feb 21, 2019, at 9:05 AM, Alexey Melnikov <[email-masked]> wrote:
> 
> CFRG chairs received a request to review this document (maybe even 2 reviews), ideally by March 4. (If you miss the deadline, a review that is completed later is still useful.) Any takers?
> 
> In particular, the review should concentrate on the following aspects of the proposal:
> 
> EDHOC (https://datatracker.ietf.org/doc/draft-selander-ace-cose-ecdhe-11 <https://datatracker.ietf.org/doc/draft-selander-ace-cose-ecdhe-11>) is being proposed as a new AKE to meet the need of constrained/IoT environments (such as those considered by the ACE WG). Formal analysis on -08 was conducted by [1] [2]. A review by the Crypto Review Panel would be helpful to evaluate the security properties (mutual authentication, PFS, and identity protection) claimed by the draft:
> 
> [1] https://link.springer.com/content/pdf/10.1007%2F978-3-030-04762-7_2.pdf <https://link.springer.com/content/pdf/10.1007%2F978-3-030-04762-7_2.pdf>
> [2] https://github.com/theisgroenbech/edhoc-proverif <https://github.com/theisgroenbech/edhoc-proverif>
> 
> Thank you,
> Alexey
> _______________________________________________
> Crypto-panel mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/crypto-panel

---

From: "Stanislav V. Smyshlyaev" <[email-masked]>
Date: Fri, 22 Feb 2019 12:58:16 +0500

Dear colleagues!

I’ll do it too.

The deadline (March, 4th) is rather tight, but I’ll try my best to provide
my review until that date.

Best regards,
Stanislav

чт, 21 февр. 2019 г. в 19:54, Russ Housley <[email-masked]>:

> reviews), ideally by March 4. (If you miss the deadline, a review that is
> completed later is still useful.) Any takers?
>
> EDHOC (https://datatracker.ietf.org/doc/draft-selander-ace-cose-ecdhe-11)
> is being proposed as a new AKE to meet the need of constrained/IoT
> environments (such as those considered by the ACE WG). Formal analysis on
> -08 was conducted by [1] [2]. A review by the Crypto Review Panel would be
> helpful to evaluate the security properties (mutual authentication, PFS,
> and identity protection) claimed by the draft:
>