Security Analysis of the EDHOC protocol

Baptiste Cottier (1, 2) , David Pointcheval (1, 2)

1 CASCADE - Construction and Analysis of Systems for Confidentiality and Authenticity of Data and Entities
2 DI-ENS - Département d'informatique - ENS Paris

Ephemeral Diffie-Hellman Over COSE (EDHOC) aims at being a very compact and lightweight authenticated Diffie-Hellman key exchange with ephemeral keys. It is expected to provide mutual authen- tication, forward secrecy, and identity protection, with a 128-bit security level. A formal analysis has already been proposed at SECRYPT ’21, on a former version, leading to some improvements, in the ongoing evaluation process by IETF. Unfortunately, while formal analysis can detect some misconceptions in the protocol, it cannot evaluate the actual security level. In this paper, we study the last version. Without complete breaks, we anyway exhibit attacks in 2^64 operations, which contradict the expected 128-bit security level. We thereafter propose improvements, some of them being at no additional cost, to achieve 128-bit security for all the security properties (i.e. key privacy, mutual authentication, and identity- protection).

Mots clés: Security Analysis; Lightweight cryptography; Authenticated Key Exchange

Domaines: Cryptographie et sécurité [cs.CR]

Baptiste Cottier, David Pointcheval. Security Analysis of the EDHOC protocol. 2022. ⟨hal-03772082v1⟩