![](bgc.png)
different party than the application using EDHOC in-
tended, and proposed a simple mitigation. We dis-
cussed how the IETF may extract and better define
security properties to enable easier verification.
We verified each method in isolation. Verifying
security under composition is left as future work.
In this work, we have analyzed the EDHOC ver-
sion as of July 2020 (Selander et al., 2020). There
are newer versions, with the most recent version as of
February 2021 (Selander et al., 2021). However, the
changes to the protocol over these versions are not
particularly significant for our analysis.
ACKNOWLEDGEMENTS
This work was partially supported by the Wallen-
berg AI, Autonomous Systems and Software Program
(WASP) funded by the Knut and Alice Wallenberg
Foundation. We are grateful to G
¨
oran Selander, John
Mattsson and Francesca Palombini for clarifications
regarding the specification.
REFERENCES
Barker, E., Chen, L., Roginsky, A., Vassilev, A., and
Davis, R. (2018). SP 800-56A Rev. 3: Recommenda-
tion for Pair-Wise Key-Establishment Schemes Using
Discrete Logarithm Cryptography. Technical report,
NIST.
Blake-Wilson, S., Johnson, D., and Menezes, A. (1997).
Key agreement protocols and their security analysis.
In Proc. of IMA Cryptography and Coding, pages 30–
45.
Blanchet, B. (2001). An efficient cryptographic proto-
col verifier based on prolog rules. In Proc. of IEEE
CSFW-14, pages 82–96.
Bruni, A., Jørgensen, T. S., Petersen, T. G., and Sch
¨
urmann,
C. (2018). Formal verification of ephemeral Diffie-
Hellman over COSE (EDHOC). In Proc.of SSR, pages
21–36.
Canetti, R. and Krawczyk, H. (2002). Security analysis
of IKE’s signature-based key-exchange protocol. In
Proc. of CRYPTO, pages 143–161.
Delpech de Saint Guilhem, C., Fischlin, M., and Warinschi,
B. (2020). Authentication in key-exchange: Defini-
tions, relations and composition. In Proc. of IEEE
CSF, pages 288–303.
Dreier, J., Hirschi, L., Radomirovic, S., and Sasse, R.
(2018). Automated unbounded verification of stateful
cryptographic protocols with exclusive OR. In Proc.
of IEEE CSF, pages 359–373.
EDHOC authors (2020). Personal communication.
Krawczyk, H. (2003). SIGMA: The ‘SIGn-and-
MAc’approach to authenticated Diffie-Hellman and
its use in IKE protocols. In Proc. of CRYPTO, pages
400–425.
Krawczyk, H. (2005). HMQV: A high-performance secure
diffie-hellman protocol. In Shoup, V., editor, Proc. of
CRYPTO, volume 3621 of Lecture Notes in Computer
Science, pages 546–566.
Krawczyk, H. (2016). A unilateral-to-mutual authentication
compiler for key exchange (with applications to client
authentication in TLS 1.3). In Proc. of ACM CCS,
pages 1438–1450.
Krawczyk, H. and Eronen, P. (2010). HMAC-based extract-
and-expand key derivation function (HKDF). RFC
5869.
Krawczyk, H. and Wee, H. (2016). The OPTLS protocol
and TLS 1.3. In Proc. of IEEE EuroS&P 2016, pages
81–96.
Lowe, G. (1997). A hierarchy of authentication specifica-
tion. In Proc. of IEEE CSFW-10, pages 31–44.
Meier, S., Schmidt, B., Cremers, C., and Basin, D. A.
(2013). The TAMARIN prover for the symbolic anal-
ysis of security protocols. In Proc. of CAV, pages 696–
701.
Norrman, K., Sundararajan, V., and Bruni, A. (2020).
EDHOC model. https://github.com/hoheinzollern/
EDHOC-Verification/tree/master/models/edhoc/
secrypt21-tamarin.tgz.
Schaad, J. (2017). CBOR Object Signing and Encryption
(COSE). RFC 8152.
Schmidt, B., Meier, S., Cremers, C. J. F., and Basin, D. A.
(2012). Automated analysis of Diffie-Hellman pro-
tocols and advanced security properties. In Proc. of
IEEE CSF, pages 78–94.
Selander, G., Mattsson, J., and Palombini, F. (2020).
Ephemeral Diffie-Hellman Over COSE (ED-
HOC). IETF Internet-Draft draft-selander-lake-
edhoc-00. https://datatracker.ietf.org/doc/html/
draft-ietf-lake-edhoc-00.
Selander, G., Mattsson, J., Palombini, F., and Seitz, L.
(2019). Object Security for Constrained RESTful En-
vironments (OSCORE). RFC 8613.
Selander, G., Mattsson, J. P., and Palombini, F.
(2018). Ephemeral Diffie-Hellman Over COSE
(EDHOC). IETF Internet-Draft draft-selander-ace-
cose-ecdhe-08. https://datatracker.ietf.org/doc/html/
draft-selander-ace-cose-ecdhe-08.
Selander, G., Mattsson, J. P., and Palombini, F.
(2021). Ephemeral Diffie-Hellman Over COSE
(EDHOC). IETF Internet-Draft draft-ietf-lake-
edhoc-05. https://datatracker.ietf.org/doc/html/
draft-ietf-lake-edhoc-05.
Formal Analysis of EDHOC Key Establishment for Constrained IoT Devices
221