rfc9529.original.xml   rfc9529.xml 
<?xml version='1.0' encoding='utf-8'?> <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE rfc [ <!DOCTYPE rfc [
<!ENTITY nbsp "&#160;"> <!ENTITY nbsp "&#160;">
<!ENTITY zwsp "&#8203;"> <!ENTITY zwsp "&#8203;">
<!ENTITY nbhy "&#8209;"> <!ENTITY nbhy "&#8209;">
<!ENTITY wj "&#8288;"> <!ENTITY wj "&#8288;">
]> ]>
<?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?>
<!-- generated by https://github.com/cabo/kramdown-rfc version 1.6.40 (Ruby 3.0. <rfc xmlns:xi="http://www.w3.org/2001/XInclude" ipr="trust200902" submissionType
2) --> ="IETF" category="info" consensus="true" docName="draft-ietf-lake-traces-09" num
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" ipr="trust200902" docName="draft ber="9529" tocDepth="2" tocInclude="true" sortRefs="true" symRefs="true" updates
-ietf-lake-traces-08" category="info" submissionType="IETF" tocDepth="2" tocIncl ="" obsoletes="" xml:lang="en" version="3">
ude="true" sortRefs="true" symRefs="true" version="3">
<!-- xml2rfc v2v3 conversion 3.18.0 --> <!-- xml2rfc v2v3 conversion 3.18.0 -->
<front> <front>
<title>Traces of EDHOC</title> <title abbrev="Traces of EDHOC">Traces of Ephemeral Diffie-Hellman Over COSE
<seriesInfo name="Internet-Draft" value="draft-ietf-lake-traces-08"/> (EDHOC)</title>
<seriesInfo name="RFC" value="9529"/>
<author initials="G." surname="Selander" fullname="Göran Selander"> <author initials="G." surname="Selander" fullname="Göran Selander">
<organization>Ericsson</organization> <organization>Ericsson</organization>
<address> <address>
<postal> <postal>
<country>Sweden</country> <country>Sweden</country>
</postal> </postal>
<email>goran.selander@ericsson.com</email> <email>goran.selander@ericsson.com</email>
</address> </address>
</author> </author>
<author initials="J" surname="Preuß Mattsson" fullname="John Preuß Mattsson" > <author initials="J" surname="Preuß Mattsson" fullname="John Preuß Mattsson" >
skipping to change at line 43 skipping to change at line 44
<author initials="M" surname="Serafin" fullname="Marek Serafin"> <author initials="M" surname="Serafin" fullname="Marek Serafin">
<organization>ASSA ABLOY</organization> <organization>ASSA ABLOY</organization>
<address> <address>
<postal> <postal>
<country>Poland</country> <country>Poland</country>
</postal> </postal>
<email>marek.serafin@assaabloy.com</email> <email>marek.serafin@assaabloy.com</email>
</address> </address>
</author> </author>
<author initials="M" surname="Tiloca" fullname="Marco Tiloca"> <author initials="M" surname="Tiloca" fullname="Marco Tiloca">
<organization>RISE</organization> <organization>RISE AB</organization>
<address> <address>
<postal> <postal>
<street>Isafjordsgatan 22</street>
<code>164 40</code>
<city>Kista</city>
<country>Sweden</country> <country>Sweden</country>
</postal> </postal>
<email>marco.tiloca@ri.se</email> <email>marco.tiloca@ri.se</email>
</address> </address>
</author> </author>
<author initials="M" surname="Vučinić" fullname="Mališa Vučinić"> <author initials="M" surname="Vučinić" fullname="Mališa Vučinić">
<organization>Inria</organization> <organization>Inria</organization>
<address> <address>
<postal> <postal>
<country>France</country> <country>France</country>
</postal> </postal>
<email>malisa.vucinic@inria.fr</email> <email>malisa.vucinic@inria.fr</email>
</address> </address>
</author> </author>
<date year="2023" month="September" day="22"/> <date year="2024" month="March"/>
<area>Security</area> <area>sec</area>
<workgroup>LAKE Working Group</workgroup> <workgroup>lake</workgroup>
<keyword>Internet-Draft</keyword> <keyword>test vector</keyword>
<abstract> <keyword>lightweight</keyword>
<?line 109?> <keyword>authenticated key exchange</keyword>
<keyword>LAKE</keyword>
<keyword>AKE</keyword>
<t>This document contains some example traces of Ephemeral Diffie-Hellman Over C <abstract>
OSE (EDHOC).</t> <t>This document contains example traces of Ephemeral Diffie-Hellman Over COSE (
EDHOC).</t>
</abstract> </abstract>
</front> </front>
<middle> <middle>
<?line 113?>
<section anchor="introduction"> <section anchor="introduction">
<name>Introduction</name> <name>Introduction</name>
<t>EDHOC <xref target="I-D.ietf-lake-edhoc"/> is a lightweight authenticat ed key exchange protocol designed for highly constrained settings. This document contains annotated traces of EDHOC sessions, with input, output, and intermedia te processing results to simplify testing of implementations. The traces have be en verified by two independent implementations.</t> <t>EDHOC <xref target="RFC9528"/> is a lightweight authenticated key excha nge protocol designed for highly constrained settings. This document contains an notated traces of EDHOC sessions with input, output, and intermediate processing results to simplify testing of implementations. The traces have been verified b y two independent implementations.</t>
<section anchor="setup"> <section anchor="setup">
<name>Setup</name> <name>Setup</name>
<t>EDHOC is run between an Initiator (I) and a Responder (R). The privat e/public key pairs and credentials of the Initiator and the Responder required t o produce the protocol messages are shown in the traces when needed for the calc ulations.</t> <t>EDHOC is run between an Initiator (I) and a Responder (R). The privat e/public key pairs and credentials of the Initiator and the Responder required t o produce the protocol messages are shown in the traces when needed for the calc ulations.</t>
<t>EDHOC messages and intermediate results are encoded in CBOR <xref tar get="RFC8949"/> and can therefore be displayed in CBOR diagnostic notation using , e.g., the CBOR playground <xref target="CborMe"/>, which makes them easy to pa rse for humans. Credentials can also be encoded in CBOR, e.g. CBOR Web Tokens (C WT) <xref target="RFC8392"/>.</t> <t>EDHOC messages and intermediate results are encoded in Concise Binary Object Representation (CBOR) <xref target="RFC8949"/> and can therefore be disp layed in CBOR diagnostic notation using, e.g., the CBOR playground <xref target= "CborMe"/>, which makes them easy to parse for humans. Credentials can also be e ncoded in CBOR, e.g., CBOR Web Tokens (CWTs) <xref target="RFC8392"/>.</t>
<t>The document contains two traces:</t> <t>The document contains two traces:</t>
<ul spacing="normal"> <ul spacing="normal">
<li> <li>
<xref target="sec-trace-1"/> - Authentication with signature keys id entified by the hash value of the X.509 certificates (provided in <xref target=" certs"/>). The endpoints use EdDSA <xref target="RFC8032"/> for authentication a nd X25519 <xref target="RFC7748"/> for ephemeral-ephemeral Diffie-Hellman key ex change.</li> <xref target="sec-trace-1"/> - Authentication with signature keys id entified by the hash value of the X.509 certificates (provided in <xref target=" certs"/>). The endpoints use Edwards-curve Digital Signature Algorithm (EdDSA) < xref target="RFC8032"/> for authentication and X25519 <xref target="RFC7748"/> f or ephemeral-ephemeral Diffie-Hellman (DH) key exchange.</li>
<li> <li>
<xref target="sec-trace-2"/> - Authentication with static Diffie-Hel lman keys identified by short key identifiers labelling CWT Claim Sets (CCSs) <x ref target="RFC8392"/>. The endpoints use NIST P-256 <xref target="SP-800-186"/> for both ephemeral-ephemeral and static-ephemeral Diffie-Hellman key exchange. This trace also illustrates the cipher suite negotiation, and provides an exampl e of low protocol overhead, with messages sizes of (39, 45, 19) bytes.</li> <xref target="sec-trace-2"/> - Authentication with static Diffie-Hel lman keys identified by short key identifiers labeling CWT Claims Sets (CCSs) <x ref target="RFC8392"/>. The endpoints use NIST P-256 <xref target="SP-800-186"/ > for both ephemeral-ephemeral and ephemeral-static DH key exchange. This trace also illustrates the cipher suite negotiation and provides an example of low pro tocol overhead with messages sizes of 39, 45, and 19 bytes.</li>
</ul> </ul>
<t>Examples of invalid EDHOC messages are found in <xref target="sec-tra ce-invalid"/>.</t> <t>Examples of invalid EDHOC messages are found in <xref target="sec-tra ce-invalid"/>.</t>
<t>NOTE 1. The same name is used for hexadecimal byte strings and their <ol type="Note %d.">
CBOR encodings. The traces contain both the raw byte strings and the correspondi <li>The same name is used for hexadecimal byte strings and their CBOR en
ng CBOR encoded data items.</t> codings. The traces contain both the raw byte strings and the corresponding CBOR
<t>NOTE 2. If not clear from the context, remember that CBOR sequences a -encoded data items.</li>
nd CBOR arrays assume CBOR encoded data items as elements.</t> <li>If not clear from the context, remember that CBOR sequences and CBOR
<t>NOTE 3. When the protocol transporting EDHOC messages does not inhere arrays assume CBOR-encoded data items as elements.</li>
ntly provide correlation across all messages, like CoAP <xref target="RFC7252"/> <li>When the protocol transporting EDHOC messages does not inherently pr
, then some messages typically are prepended with connection identifiers and pot ovide correlation across all messages, then some messages are typically prepende
entially a message_1 indicator (see Sections <xref target="I-D.ietf-lake-edhoc" d with connection identifiers and potentially a message_1 indicator (see Section
section="3.4.1" sectionFormat="bare"/> and <xref target="I-D.ietf-lake-edhoc" se <xref target="RFC9528" section="3.4.1" sectionFormat="bare"/> and Appendix <xre
ction="A.2" sectionFormat="bare"/> of <xref target="I-D.ietf-lake-edhoc"/>). Tho f target="RFC9528" section="A.2" sectionFormat="bare"/> of <xref target="RFC9528
se bytes are not included in the traces in this document.</t> "/>). Those bytes are not included in the traces in this document.</li>
</ol>
</section> </section>
<section anchor="term"> <section anchor="term">
<name>Terminology and Requirements Language</name> <name>Requirements Language</name>
<t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL <t>
NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp14>REQU
"MAY", and "OPTIONAL" in this document are to be interpreted as IRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL
described in BCP 14 <xref target="RFC2119"/> <xref target="RFC8174"/> when, and NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14>
only when, they RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
appear in all capitals, as shown here. "<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are to
<?line -6?> be interpreted as
described in BCP&nbsp;14 <xref target="RFC2119"/> <xref target="RFC8174"/>
when, and only when, they appear in all capitals, as shown here.
</t> </t>
</section> </section>
</section> </section>
<section anchor="sec-trace-1"> <section anchor="sec-trace-1">
<name>Authentication with Signatures, X.509 Certificates Identified by 'x5 <name>Authentication with Signatures, X.509 Identified by 'x5t'</name>
t'</name> <t>In this example, the Initiator (I) and Responder (R) are authenticated
<t>In this example the Initiator (I) and Responder (R) are authenticated w with digital signatures (METHOD = 0). Both the Initiator and the Responder suppo
ith digital signatures (METHOD = 0). Both the Initiator and the Responder suppor rt cipher suite 0, which determines the algorithms:</t>
t cipher suite 0, which determines the algorithms:</t>
<ul spacing="normal"> <ul spacing="normal">
<li>EDHOC AEAD algorithm = AES-CCM-16-64-128</li> <li>EDHOC AEAD algorithm = AES-CCM-16-64-128</li>
<li>EDHOC hash algorithm = SHA-256</li> <li>EDHOC hash algorithm = SHA-256</li>
<li>EDHOC MAC length in bytes (Static DH) = 8</li> <li>EDHOC Message Authentication Code (MAC) length in bytes (Static DH) = 8</li>
<li>EDHOC key exchange algorithm (ECDH curve) = X25519</li> <li>EDHOC key exchange algorithm (ECDH curve) = X25519</li>
<li>EDHOC signature algorithm = EdDSA</li> <li>EDHOC signature algorithm = EdDSA</li>
<li>Application AEAD algorithm = AES-CCM-16-64-128</li> <li>application AEAD algorithm = AES-CCM-16-64-128</li>
<li>Application hash algorithm = SHA-256</li> <li>application hash algorithm = SHA-256</li>
</ul> </ul>
<t>The public keys are represented with X.509 certificates identified by t he COSE header parameter 'x5t'.</t> <t>The public keys are represented with X.509 certificates identified by t he CBOR Object Signing and Encryption (COSE) header parameter 'x5t'.</t>
<section anchor="message1"> <section anchor="message1">
<name>message_1</name> <name>message_1</name>
<t>Both endpoints are authenticated with signatures, i.e., METHOD = 0:</ t> <t>Both endpoints are authenticated with signatures, i.e., METHOD = 0:</ t>
<artwork align="left"><![CDATA[ <artwork align="left"><![CDATA[
METHOD (CBOR Data Item) (1 byte) METHOD (CBOR Data Item) (1 byte)
00 00
]]></artwork> ]]></artwork>
<t>The Initiator selects cipher suite 0. A single cipher suite is encode d as an int:</t> <t>The Initiator selects cipher suite 0. A single cipher suite is encode d as an int:</t>
<artwork><![CDATA[ <artwork><![CDATA[
SUITES_I (CBOR Data Item) (1 byte) SUITES_I (CBOR Data Item) (1 byte)
skipping to change at line 147 skipping to change at line 155
G_X (Raw Value) (32 bytes) G_X (Raw Value) (32 bytes)
31 f8 2c 7b 5b 9c bb f0 f1 94 d9 13 cc 12 ef 15 32 d3 28 ef 32 63 2a 31 f8 2c 7b 5b 9c bb f0 f1 94 d9 13 cc 12 ef 15 32 d3 28 ef 32 63 2a
48 81 a1 c0 70 1e 23 7f 04 48 81 a1 c0 70 1e 23 7f 04
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Initiator's ephemeral public key Initiator's ephemeral public key
G_X (CBOR Data Item) (34 bytes) G_X (CBOR Data Item) (34 bytes)
58 20 31 f8 2c 7b 5b 9c bb f0 f1 94 d9 13 cc 12 ef 15 32 d3 28 ef 32 58 20 31 f8 2c 7b 5b 9c bb f0 f1 94 d9 13 cc 12 ef 15 32 d3 28 ef 32
63 2a 48 81 a1 c0 70 1e 23 7f 04 63 2a 48 81 a1 c0 70 1e 23 7f 04
]]></artwork> ]]></artwork>
<t>The Initiator selects its connection identifier C_I to be the byte st ring 0x2d, which since it is represented by the 1-byte CBOR int -14 is encoded a s 0x2d:</t> <t>The Initiator selects its connection identifier C_I to be the byte st ring 0x2d, which is encoded as 0x2d since it is represented by the 1-byte CBOR i nt -14:</t>
<artwork><![CDATA[ <artwork><![CDATA[
Connection identifier chosen by Initiator Connection identifier chosen by the Initiator
C_I (Raw Value) (1 byte) C_I (Raw Value) (1 byte)
2d 2d
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Connection identifier chosen by Initiator Connection identifier chosen by the Initiator
C_I (CBOR Data Item) (1 byte) C_I (CBOR Data Item) (1 byte)
2d 2d
]]></artwork> ]]></artwork>
<t>No external authorization data:</t> <t>No external authorization data:</t>
<artwork><![CDATA[ <artwork><![CDATA[
EAD_1 (CBOR Sequence) (0 bytes) EAD_1 (CBOR Sequence) (0 bytes)
]]></artwork> ]]></artwork>
<t>The Initiator constructs message_1:</t> <t>The Initiator constructs message_1:</t>
<artwork><![CDATA[ <artwork><![CDATA[
message_1 = message_1 =
( (
0, 0,
0, 0,
h'31f82c7b5b9cbbf0f194d913cc12ef1532d328ef32632a48 h'31f82c7b5b9cbbf0f194d913cc12ef1532d328ef32632a48
81a1c0701e237f04', 81a1c0701e237f04',
-14 -14
) )
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
message_1 (CBOR Sequence) (37 bytes) message_1 (CBOR Sequence) (37 bytes)
00 00 58 20 31 f8 2c 7b 5b 9c bb f0 f1 94 d9 13 cc 12 ef 15 32 d3 28 00 00 58 20 31 f8 2c 7b 5b 9c bb f0 f1 94 d9 13 cc 12 ef 15 32 d3 28
ef 32 63 2a 48 81 a1 c0 70 1e 23 7f 04 2d ef 32 63 2a 48 81 a1 c0 70 1e 23 7f 04 2d
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="message2"> <section anchor="message2">
<name>message_2</name> <name>message_2</name>
skipping to change at line 201 skipping to change at line 209
G_Y (Raw Value) (32 bytes) G_Y (Raw Value) (32 bytes)
dc 88 d2 d5 1d a5 ed 67 fc 46 16 35 6b c8 ca 74 ef 9e be 8b 38 7e 62 dc 88 d2 d5 1d a5 ed 67 fc 46 16 35 6b c8 ca 74 ef 9e be 8b 38 7e 62
3a 36 0b a4 80 b9 b2 9d 1c 3a 36 0b a4 80 b9 b2 9d 1c
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Responder's ephemeral public key Responder's ephemeral public key
G_Y (CBOR Data Item) (34 bytes) G_Y (CBOR Data Item) (34 bytes)
58 20 dc 88 d2 d5 1d a5 ed 67 fc 46 16 35 6b c8 ca 74 ef 9e be 8b 38 58 20 dc 88 d2 d5 1d a5 ed 67 fc 46 16 35 6b c8 ca 74 ef 9e be 8b 38
7e 62 3a 36 0b a4 80 b9 b2 9d 1c 7e 62 3a 36 0b a4 80 b9 b2 9d 1c
]]></artwork> ]]></artwork>
<t>The Responder selects its connection identifier C_R to be the byte st ring 0x18, which since it is not represented as a 1-byte CBOR int is encoded as h'18' = 0x4118:</t> <t>The Responder selects its connection identifier C_R to be the byte st ring 0x18, which is encoded as h'18' = 0x4118 since it is not represented by a 1 -byte CBOR int:</t>
<artwork><![CDATA[ <artwork><![CDATA[
Connection identifier chosen by Responder Connection identifier chosen by the Responder
C_R (Raw Value) (1 byte) C_R (Raw Value) (1 byte)
18 18
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Connection identifier chosen by Responder Connection identifier chosen by the Responder
C_R (CBOR Data Item) (2 bytes) C_R (CBOR Data Item) (2 bytes)
41 18 41 18
]]></artwork> ]]></artwork>
<t>The transcript hash TH_2 is calculated using the EDHOC hash algorithm :</t> <t>The transcript hash TH_2 is calculated using the EDHOC hash algorithm :</t>
<t>TH_2 = H( G_Y, H(message_1) )</t> <t>TH_2 = H( G_Y, H(message_1) )</t>
<artwork><![CDATA[ <artwork><![CDATA[
H(message_1) (Raw Value) (32 bytes) H(message_1) (Raw Value) (32 bytes)
c1 65 d6 a9 9d 1b ca fa ac 8d bf 2b 35 2a 6f 7d 71 a3 0b 43 9c 9d 64 c1 65 d6 a9 9d 1b ca fa ac 8d bf 2b 35 2a 6f 7d 71 a3 0b 43 9c 9d 64
d3 49 a2 38 48 03 8e d1 6b d3 49 a2 38 48 03 8e d1 6b
]]></artwork> ]]></artwork>
skipping to change at line 242 skipping to change at line 250
<artwork><![CDATA[ <artwork><![CDATA[
TH_2 (Raw Value) (32 bytes) TH_2 (Raw Value) (32 bytes)
c6 40 5c 15 4c 56 74 66 ab 1d f2 03 69 50 0e 54 0e 9f 14 bd 3a 79 6a c6 40 5c 15 4c 56 74 66 ab 1d f2 03 69 50 0e 54 0e 9f 14 bd 3a 79 6a
06 52 ca e6 6c 90 61 68 8d 06 52 ca e6 6c 90 61 68 8d
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
TH_2 (CBOR Data Item) (34 bytes) TH_2 (CBOR Data Item) (34 bytes)
58 20 c6 40 5c 15 4c 56 74 66 ab 1d f2 03 69 50 0e 54 0e 9f 14 bd 3a 58 20 c6 40 5c 15 4c 56 74 66 ab 1d f2 03 69 50 0e 54 0e 9f 14 bd 3a
79 6a 06 52 ca e6 6c 90 61 68 8d 79 6a 06 52 ca e6 6c 90 61 68 8d
]]></artwork> ]]></artwork>
<t>PRK_2e is specified in <xref section="4.1.1.1" sectionFormat="of" tar <t>PRK_2e is specified in <xref section="4.1.1.1" sectionFormat="of" tar
get="I-D.ietf-lake-edhoc"/>.</t> get="RFC9528"/>.</t>
<t>First, the ECDH shared secret G_XY is computed from G_X and Y, or G_Y <t>First, the Elliptic Curve Diffie-Hellman (ECDH) shared secret G_XY is
and X:</t> computed from G_X and Y or G_Y and X:</t>
<artwork><![CDATA[ <artwork><![CDATA[
G_XY (Raw Value) (ECDH shared secret) (32 bytes) G_XY (Raw Value) (ECDH shared secret) (32 bytes)
e5 cd f3 a9 86 cd ac 5b 7b f0 46 91 e2 b0 7c 08 e7 1f 53 99 8d 8f 84 e5 cd f3 a9 86 cd ac 5b 7b f0 46 91 e2 b0 7c 08 e7 1f 53 99 8d 8f 84
2b 7c 3f b4 d8 39 cf 7b 28 2b 7c 3f b4 d8 39 cf 7b 28
]]></artwork> ]]></artwork>
<t>Then, PRK_2e is calculated using EDHOC_Extract() determined by the ED HOC hash algorithm:</t> <t>Then, PRK_2e is calculated using EDHOC_Extract(), which is determined by the EDHOC hash algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_2e = EDHOC_Extract( salt, G_XY ) = PRK_2e = EDHOC_Extract( salt, G_XY )
= HMAC-SHA-256( salt, G_XY ) = HMAC-SHA-256( salt, G_XY )
]]></artwork> ]]></artwork>
<t>where salt is TH_2:</t> <t>where salt is TH_2:</t>
<artwork><![CDATA[ <artwork><![CDATA[
salt (Raw Value) (32 bytes) salt (Raw Value) (32 bytes)
c6 40 5c 15 4c 56 74 66 ab 1d f2 03 69 50 0e 54 0e 9f 14 bd 3a 79 6a c6 40 5c 15 4c 56 74 66 ab 1d f2 03 69 50 0e 54 0e 9f 14 bd 3a 79 6a
06 52 ca e6 6c 90 61 68 8d 06 52 ca e6 6c 90 61 68 8d
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_2e (Raw Value) (32 bytes) PRK_2e (Raw Value) (32 bytes)
d5 84 ac 2e 5d ad 5a 77 d1 4b 53 eb e7 2e f1 d5 da a8 86 0d 39 93 73 d5 84 ac 2e 5d ad 5a 77 d1 4b 53 eb e7 2e f1 d5 da a8 86 0d 39 93 73
bf 2c 24 0a fa 7b a8 04 da bf 2c 24 0a fa 7b a8 04 da
]]></artwork> ]]></artwork>
<t>Since METHOD = 0, the Responder authenticates using signatures. Since the selected cipher suite is 0, the EDHOC signature algorithm is EdDSA.</t> <t>Since METHOD = 0, the Responder authenticates using signatures. Since the selected cipher suite is 0, the EDHOC signature algorithm is EdDSA.</t>
<t>The Responder's signature key pair using EdDSA:</t> <t>The Responder's signature key pair uses EdDSA:</t>
<artwork><![CDATA[ <artwork><![CDATA[
Responder's private authentication key Responder's private authentication key
SK_R (Raw Value) (32 bytes) SK_R (Raw Value) (32 bytes)
ef 14 0f f9 00 b0 ab 03 f0 c0 8d 87 9c bb d4 b3 1e a7 1e 6e 7e e7 ff ef 14 0f f9 00 b0 ab 03 f0 c0 8d 87 9c bb d4 b3 1e a7 1e 6e 7e e7 ff
cb 7e 79 55 77 7a 33 27 99 cb 7e 79 55 77 7a 33 27 99
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Responder's public authentication key Responder's public authentication key
PK_R (Raw Value) (32 bytes) PK_R (Raw Value) (32 bytes)
a1 db 47 b9 51 84 85 4a d1 2a 0c 1a 35 4e 41 8a ac e3 3a a0 f2 c6 62 a1 db 47 b9 51 84 85 4a d1 2a 0c 1a 35 4e 41 8a ac e3 3a a0 f2 c6 62
c0 0b 3a c5 5d e9 2f 93 59 c0 0b 3a c5 5d e9 2f 93 59
]]></artwork> ]]></artwork>
<t>PRK_3e2m is specified in <xref section="4.1.1.2" sectionFormat="of" t <t>PRK_3e2m is specified in <xref section="4.1.1.2" sectionFormat="of" t
arget="I-D.ietf-lake-edhoc"/>.</t> arget="RFC9528"/>.</t>
<t>Since the Responder authenticates with signatures PRK_3e2m = PRK_2e.< <t>Since the Responder authenticates with signatures, PRK_3e2m = PRK_2e.
/t> </t>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_3e2m (Raw Value) (32 bytes) PRK_3e2m (Raw Value) (32 bytes)
d5 84 ac 2e 5d ad 5a 77 d1 4b 53 eb e7 2e f1 d5 da a8 86 0d 39 93 73 d5 84 ac 2e 5d ad 5a 77 d1 4b 53 eb e7 2e f1 d5 da a8 86 0d 39 93 73
bf 2c 24 0a fa 7b a8 04 da bf 2c 24 0a fa 7b a8 04 da
]]></artwork> ]]></artwork>
<t>The Responder constructs the remaining input needed to calculate MAC_ 2:</t> <t>The Responder constructs the remaining input needed to calculate MAC_ 2:</t>
<t>MAC_2 = EDHOC_KDF( PRK_3e2m, 2, context_2, mac_length_2 )</t> <t>MAC_2 = EDHOC_KDF( PRK_3e2m, 2, context_2, mac_length_2 )</t>
<t>context_2 = &lt;&lt; ID_CRED_R, TH_2, CRED_R, ? EAD_2 &gt;&gt;</t> <t>context_2 = &lt;&lt; C_R, ID_CRED_R, TH_2, CRED_R, ? EAD_2 &gt;&gt;</ t>
<t>CRED_R is identified by a 64-bit hash:</t> <t>CRED_R is identified by a 64-bit hash:</t>
<artwork><![CDATA[ <artwork><![CDATA[
ID_CRED_R = ID_CRED_R =
{ {
34 : [-15, h'79f2a41b510c1f9b'] 34 : [-15, h'79f2a41b510c1f9b']
} }
]]></artwork> ]]></artwork>
<t>where the COSE header value 34 ('x5t') indicates a hash of an X.509 c ertficate, <t>where the COSE header value 34 ('x5t') indicates a hash of an X.509 c ertificate,
and the COSE algorithm -15 indicates the hash algorithm SHA-256 truncated to 64 bits.</t> and the COSE algorithm -15 indicates the hash algorithm SHA-256 truncated to 64 bits.</t>
<artwork><![CDATA[ <artwork><![CDATA[
ID_CRED_R (CBOR Data Item) (14 bytes) ID_CRED_R (CBOR Data Item) (14 bytes)
a1 18 22 82 2e 48 79 f2 a4 1b 51 0c 1f 9b a1 18 22 82 2e 48 79 f2 a4 1b 51 0c 1f 9b
]]></artwork> ]]></artwork>
<t>CRED_R is a CBOR byte string of the DER encoding of the X.509 certifi cate in <xref target="resp-cer"/>:</t> <t>CRED_R is a CBOR byte string of the DER encoding of the X.509 certifi cate in <xref target="resp-cer"/>:</t>
<artwork><![CDATA[ <artwork><![CDATA[
CRED_R (Raw Value) (241 bytes) CRED_R (Raw Value) (241 bytes)
30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 9e c4 30 05 06 03 2b 65 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 9e c4 30 05 06 03 2b 65
70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 44 48 4f 43 20 52 6f 6f 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 44 48 4f 43 20 52 6f 6f
skipping to change at line 335 skipping to change at line 343
db 47 b9 51 84 85 4a d1 2a 0c 1a 35 4e 41 8a ac e3 3a a0 f2 c6 62 c0 db 47 b9 51 84 85 4a d1 2a 0c 1a 35 4e 41 8a ac e3 3a a0 f2 c6 62 c0
0b 3a c5 5d e9 2f 93 59 30 05 06 03 2b 65 70 03 41 00 b7 23 bc 01 ea 0b 3a c5 5d e9 2f 93 59 30 05 06 03 2b 65 70 03 41 00 b7 23 bc 01 ea
b0 92 8e 8b 2b 6c 98 de 19 cc 38 23 d4 6e 7d 69 87 b0 32 47 8f ec fa b0 92 8e 8b 2b 6c 98 de 19 cc 38 23 d4 6e 7d 69 87 b0 32 47 8f ec fa
f1 45 37 a1 af 14 cc 8b e8 29 c6 b7 30 44 10 18 37 eb 4a bc 94 95 65 f1 45 37 a1 af 14 cc 8b e8 29 c6 b7 30 44 10 18 37 eb 4a bc 94 95 65
d8 6d ce 51 cf ae 52 ab 82 c1 52 cb 02 d8 6d ce 51 cf ae 52 ab 82 c1 52 cb 02
]]></artwork> ]]></artwork>
<t>No external authorization data:</t> <t>No external authorization data:</t>
<artwork><![CDATA[ <artwork><![CDATA[
EAD_2 (CBOR Sequence) (0 bytes) EAD_2 (CBOR Sequence) (0 bytes)
]]></artwork> ]]></artwork>
<t>context_2 = &lt;&lt; ID_CRED_R, TH_2, CRED_R, ? EAD_2 &gt;&gt;</t> <t>context_2 = &lt;&lt; C_R, ID_CRED_R, TH_2, CRED_R, ? EAD_2 &gt;&gt;</ t>
<artwork><![CDATA[ <artwork><![CDATA[
context_2 (CBOR Sequence) (291 bytes) context_2 (CBOR Sequence) (293 bytes)
a1 18 22 82 2e 48 79 f2 a4 1b 51 0c 1f 9b 58 20 c6 40 5c 15 4c 56 74 41 18 a1 18 22 82 2e 48 79 f2 a4 1b 51 0c 1f 9b 58 20 c6 40 5c 15 4c
66 ab 1d f2 03 69 50 0e 54 0e 9f 14 bd 3a 79 6a 06 52 ca e6 6c 90 61 56 74 66 ab 1d f2 03 69 50 0e 54 0e 9f 14 bd 3a 79 6a 06 52 ca e6 6c
68 8d 58 f1 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 9e c4 30 05 90 61 68 8d 58 f1 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 9e c4
06 03 2b 65 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 44 48 4f 43 30 05 06 03 2b 65 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 44 48
20 52 6f 6f 74 20 45 64 32 35 35 31 39 30 1e 17 0d 32 32 30 33 31 36 4f 43 20 52 6f 6f 74 20 45 64 32 35 35 31 39 30 1e 17 0d 32 32 30 33
30 38 32 34 33 36 5a 17 0d 32 39 31 32 33 31 32 33 30 30 30 30 5a 30 31 36 30 38 32 34 33 36 5a 17 0d 32 39 31 32 33 31 32 33 30 30 30 30
22 31 20 30 1e 06 03 55 04 03 0c 17 45 44 48 4f 43 20 52 65 73 70 6f 5a 30 22 31 20 30 1e 06 03 55 04 03 0c 17 45 44 48 4f 43 20 52 65 73
6e 64 65 72 20 45 64 32 35 35 31 39 30 2a 30 05 06 03 2b 65 70 03 21 70 6f 6e 64 65 72 20 45 64 32 35 35 31 39 30 2a 30 05 06 03 2b 65 70
00 a1 db 47 b9 51 84 85 4a d1 2a 0c 1a 35 4e 41 8a ac e3 3a a0 f2 c6 03 21 00 a1 db 47 b9 51 84 85 4a d1 2a 0c 1a 35 4e 41 8a ac e3 3a a0
62 c0 0b 3a c5 5d e9 2f 93 59 30 05 06 03 2b 65 70 03 41 00 b7 23 bc f2 c6 62 c0 0b 3a c5 5d e9 2f 93 59 30 05 06 03 2b 65 70 03 41 00 b7
01 ea b0 92 8e 8b 2b 6c 98 de 19 cc 38 23 d4 6e 7d 69 87 b0 32 47 8f 23 bc 01 ea b0 92 8e 8b 2b 6c 98 de 19 cc 38 23 d4 6e 7d 69 87 b0 32
ec fa f1 45 37 a1 af 14 cc 8b e8 29 c6 b7 30 44 10 18 37 eb 4a bc 94 47 8f ec fa f1 45 37 a1 af 14 cc 8b e8 29 c6 b7 30 44 10 18 37 eb 4a
95 65 d8 6d ce 51 cf ae 52 ab 82 c1 52 cb 02 bc 94 95 65 d8 6d ce 51 cf ae 52 ab 82 c1 52 cb 02
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
context_2 (CBOR byte string) (294 bytes) context_2 (CBOR byte string) (296 bytes)
59 01 23 a1 18 22 82 2e 48 79 f2 a4 1b 51 0c 1f 9b 58 20 c6 40 5c 15 59 01 25 41 18 a1 18 22 82 2e 48 79 f2 a4 1b 51 0c 1f 9b 58 20 c6 40
4c 56 74 66 ab 1d f2 03 69 50 0e 54 0e 9f 14 bd 3a 79 6a 06 52 ca e6 5c 15 4c 56 74 66 ab 1d f2 03 69 50 0e 54 0e 9f 14 bd 3a 79 6a 06 52
6c 90 61 68 8d 58 f1 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 9e ca e6 6c 90 61 68 8d 58 f1 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62
c4 30 05 06 03 2b 65 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 44 31 9e c4 30 05 06 03 2b 65 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12
48 4f 43 20 52 6f 6f 74 20 45 64 32 35 35 31 39 30 1e 17 0d 32 32 30 45 44 48 4f 43 20 52 6f 6f 74 20 45 64 32 35 35 31 39 30 1e 17 0d 32
33 31 36 30 38 32 34 33 36 5a 17 0d 32 39 31 32 33 31 32 33 30 30 30 32 30 33 31 36 30 38 32 34 33 36 5a 17 0d 32 39 31 32 33 31 32 33 30
30 5a 30 22 31 20 30 1e 06 03 55 04 03 0c 17 45 44 48 4f 43 20 52 65 30 30 30 5a 30 22 31 20 30 1e 06 03 55 04 03 0c 17 45 44 48 4f 43 20
73 70 6f 6e 64 65 72 20 45 64 32 35 35 31 39 30 2a 30 05 06 03 2b 65 52 65 73 70 6f 6e 64 65 72 20 45 64 32 35 35 31 39 30 2a 30 05 06 03
70 03 21 00 a1 db 47 b9 51 84 85 4a d1 2a 0c 1a 35 4e 41 8a ac e3 3a 2b 65 70 03 21 00 a1 db 47 b9 51 84 85 4a d1 2a 0c 1a 35 4e 41 8a ac
a0 f2 c6 62 c0 0b 3a c5 5d e9 2f 93 59 30 05 06 03 2b 65 70 03 41 00 e3 3a a0 f2 c6 62 c0 0b 3a c5 5d e9 2f 93 59 30 05 06 03 2b 65 70 03
b7 23 bc 01 ea b0 92 8e 8b 2b 6c 98 de 19 cc 38 23 d4 6e 7d 69 87 b0 41 00 b7 23 bc 01 ea b0 92 8e 8b 2b 6c 98 de 19 cc 38 23 d4 6e 7d 69
32 47 8f ec fa f1 45 37 a1 af 14 cc 8b e8 29 c6 b7 30 44 10 18 37 eb 87 b0 32 47 8f ec fa f1 45 37 a1 af 14 cc 8b e8 29 c6 b7 30 44 10 18
4a bc 94 95 65 d8 6d ce 51 cf ae 52 ab 82 c1 52 cb 02 37 eb 4a bc 94 95 65 d8 6d ce 51 cf ae 52 ab 82 c1 52 cb 02
]]></artwork>
<t>MAC_2 is computed through EDHOC_Expand() using the EDHOC hash algorit
hm (see <xref section="4.1.2" sectionFormat="of" target="RFC9528"/>):</t>
<artwork><![CDATA[
MAC_2 = HKDF-Expand( PRK_3e2m, info, mac_length_2 )
]]></artwork>
<t>where</t>
<artwork><![CDATA[
info = ( 2, context_2, mac_length_2 )
]]></artwork> ]]></artwork>
<t>MAC_2 is computed through EDHOC_Expand() using the EDHOC hash algorit
hm, see <xref section="4.1.2" sectionFormat="of" target="I-D.ietf-lake-edhoc"/>:
</t>
<t>MAC_2 = HKDF-Expand(PRK_3e2m, info, mac_length_2), where</t>
<t>info = ( 2, context_2, mac_length_2 )</t>
<t>Since METHOD = 0, mac_length_2 is given by the EDHOC hash algorithm.< /t> <t>Since METHOD = 0, mac_length_2 is given by the EDHOC hash algorithm.< /t>
<t>info for MAC_2 is:</t> <t>info for MAC_2 is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
2, 2,
h'a11822822e4879f2a41b510c1f9b5820c6405c154c567466 h'4118a11822822e4879f2a41b510c1f9b5820c6405c154c56
ab1df20369500e540e9f14bd3a796a0652cae66c9061688d 7466ab1df20369500e540e9f14bd3a796a0652cae66c9061
58f13081ee3081a1a003020102020462319ec4300506032b 688d58f13081ee3081a1a003020102020462319ec4300506
6570301d311b301906035504030c124544484f4320526f6f 032b6570301d311b301906035504030c124544484f432052
742045643235353139301e170d3232303331363038323433 6f6f742045643235353139301e170d323230333136303832
365a170d3239313233313233303030305a30223120301e06 3433365a170d3239313233313233303030305a3022312030
035504030c174544484f4320526573706f6e646572204564 1e06035504030c174544484f4320526573706f6e64657220
3235353139302a300506032b6570032100a1db47b9518485 45643235353139302a300506032b6570032100a1db47b951
4ad12a0c1a354e418aace33aa0f2c662c00b3ac55de92f93 84854ad12a0c1a354e418aace33aa0f2c662c00b3ac55de9
59300506032b6570034100b723bc01eab0928e8b2b6c98de 2f9359300506032b6570034100b723bc01eab0928e8b2b6c
19cc3823d46e7d6987b032478fecfaf14537a1af14cc8be8 98de19cc3823d46e7d6987b032478fecfaf14537a1af14cc
29c6b73044101837eb4abc949565d86dce51cfae52ab82c1 8be829c6b73044101837eb4abc949565d86dce51cfae52ab
52cb02', 82c152cb02',
32 32
) )
]]></artwork> ]]></artwork>
<t>where the last value is the output size of the EDHOC hash algorithm i n bytes.</t> <t>where the last value is the output size of the EDHOC hash algorithm i n bytes.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for MAC_2 (CBOR Sequence) (297 bytes) info for MAC_2 (CBOR Sequence) (299 bytes)
02 59 01 23 a1 18 22 82 2e 48 79 f2 a4 1b 51 0c 1f 9b 58 20 c6 40 5c 02 59 01 25 41 18 a1 18 22 82 2e 48 79 f2 a4 1b 51 0c 1f 9b 58 20 c6
15 4c 56 74 66 ab 1d f2 03 69 50 0e 54 0e 9f 14 bd 3a 79 6a 06 52 ca 40 5c 15 4c 56 74 66 ab 1d f2 03 69 50 0e 54 0e 9f 14 bd 3a 79 6a 06
e6 6c 90 61 68 8d 58 f1 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 52 ca e6 6c 90 61 68 8d 58 f1 30 81 ee 30 81 a1 a0 03 02 01 02 02 04
9e c4 30 05 06 03 2b 65 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 62 31 9e c4 30 05 06 03 2b 65 70 30 1d 31 1b 30 19 06 03 55 04 03 0c
44 48 4f 43 20 52 6f 6f 74 20 45 64 32 35 35 31 39 30 1e 17 0d 32 32 12 45 44 48 4f 43 20 52 6f 6f 74 20 45 64 32 35 35 31 39 30 1e 17 0d
30 33 31 36 30 38 32 34 33 36 5a 17 0d 32 39 31 32 33 31 32 33 30 30 32 32 30 33 31 36 30 38 32 34 33 36 5a 17 0d 32 39 31 32 33 31 32 33
30 30 5a 30 22 31 20 30 1e 06 03 55 04 03 0c 17 45 44 48 4f 43 20 52 30 30 30 30 5a 30 22 31 20 30 1e 06 03 55 04 03 0c 17 45 44 48 4f 43
65 73 70 6f 6e 64 65 72 20 45 64 32 35 35 31 39 30 2a 30 05 06 03 2b 20 52 65 73 70 6f 6e 64 65 72 20 45 64 32 35 35 31 39 30 2a 30 05 06
65 70 03 21 00 a1 db 47 b9 51 84 85 4a d1 2a 0c 1a 35 4e 41 8a ac e3 03 2b 65 70 03 21 00 a1 db 47 b9 51 84 85 4a d1 2a 0c 1a 35 4e 41 8a
3a a0 f2 c6 62 c0 0b 3a c5 5d e9 2f 93 59 30 05 06 03 2b 65 70 03 41 ac e3 3a a0 f2 c6 62 c0 0b 3a c5 5d e9 2f 93 59 30 05 06 03 2b 65 70
00 b7 23 bc 01 ea b0 92 8e 8b 2b 6c 98 de 19 cc 38 23 d4 6e 7d 69 87 03 41 00 b7 23 bc 01 ea b0 92 8e 8b 2b 6c 98 de 19 cc 38 23 d4 6e 7d
b0 32 47 8f ec fa f1 45 37 a1 af 14 cc 8b e8 29 c6 b7 30 44 10 18 37 69 87 b0 32 47 8f ec fa f1 45 37 a1 af 14 cc 8b e8 29 c6 b7 30 44 10
eb 4a bc 94 95 65 d8 6d ce 51 cf ae 52 ab 82 c1 52 cb 02 18 20 18 37 eb 4a bc 94 95 65 d8 6d ce 51 cf ae 52 ab 82 c1 52 cb 02 18 20
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
MAC_2 (Raw Value) (32 bytes) MAC_2 (Raw Value) (32 bytes)
36 9c a4 39 2c 83 ed 63 d6 1a d2 18 42 0e a3 67 06 00 84 78 d5 bc 30 86 2a 7e 5e f1 47 f9 a5 f4 c5 12 e1 b6 62 3c d6 6c d1 7a 72 72 07 2b
49 fb 8c 59 42 44 4b 13 33 fe 5b 60 2f fe 30 7e e0 e9
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
MAC_2 (CBOR Data Item) (34 bytes) MAC_2 (CBOR Data Item) (34 bytes)
58 20 36 9c a4 39 2c 83 ed 63 d6 1a d2 18 42 0e a3 67 06 00 84 78 d5 58 20 86 2a 7e 5e f1 47 f9 a5 f4 c5 12 e1 b6 62 3c d6 6c d1 7a 72 72
bc 30 49 fb 8c 59 42 44 4b 13 33 07 2b fe 5b 60 2f fe 30 7e e0 e9
]]></artwork> ]]></artwork>
<t>Since METHOD = 0, Signature_or_MAC_2 is the 'signature' of the COSE_S ign1 object.</t> <t>Since METHOD = 0, Signature_or_MAC_2 is the 'signature' of the COSE_S ign1 object.</t>
<t>The Responder constructs the message to be signed:</t> <t>The Responder constructs the message to be signed:</t>
<artwork><![CDATA[ <artwork><![CDATA[
[ "Signature1", << ID_CRED_R >>, [
<< TH_2, CRED_R, ? EAD_2 >>, MAC_2 ] = "Signature1",
<< ID_CRED_R >>,
<< TH_2, CRED_R, ? EAD_2 >>,
MAC_2
] =
[ [
"Signature1", "Signature1",
h'a11822822e4879f2a41b510c1f9b', h'a11822822e4879f2a41b510c1f9b',
h'5820c6405c154c567466ab1df20369500e540e9f14bd3a79 h'5820c6405c154c567466ab1df20369500e540e9f14bd3a79
6a0652cae66c9061688d58f13081ee3081a1a00302010202 6a0652cae66c9061688d58f13081ee3081a1a00302010202
0462319ec4300506032b6570301d311b301906035504030c 0462319ec4300506032b6570301d311b301906035504030c
124544484f4320526f6f742045643235353139301e170d32 124544484f4320526f6f742045643235353139301e170d32
32303331363038323433365a170d32393132333132333030 32303331363038323433365a170d32393132333132333030
30305a30223120301e06035504030c174544484f43205265 30305a30223120301e06035504030c174544484f43205265
73706f6e6465722045643235353139302a300506032b6570 73706f6e6465722045643235353139302a300506032b6570
032100a1db47b95184854ad12a0c1a354e418aace33aa0f2 032100a1db47b95184854ad12a0c1a354e418aace33aa0f2
c662c00b3ac55de92f9359300506032b6570034100b723bc c662c00b3ac55de92f9359300506032b6570034100b723bc
01eab0928e8b2b6c98de19cc3823d46e7d6987b032478fec 01eab0928e8b2b6c98de19cc3823d46e7d6987b032478fec
faf14537a1af14cc8be829c6b73044101837eb4abc949565 faf14537a1af14cc8be829c6b73044101837eb4abc949565
d86dce51cfae52ab82c152cb02', d86dce51cfae52ab82c152cb02',
h'369ca4392c83ed63d61ad218420ea36706008478d5bc3049 h'862a7e5ef147f9a5f4c512e1b6623cd66cd17a7272072bfe
fb8c5942444b1333' 5b602ffe307ee0e9'
] ]
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Message to be signed 2 (CBOR Data Item) (341 bytes) Message to be signed in message_2 (CBOR Data Item) (341 bytes)
84 6a 53 69 67 6e 61 74 75 72 65 31 4e a1 18 22 82 2e 48 79 f2 a4 1b 84 6a 53 69 67 6e 61 74 75 72 65 31 4e a1 18 22 82 2e 48 79 f2 a4 1b
51 0c 1f 9b 59 01 15 58 20 c6 40 5c 15 4c 56 74 66 ab 1d f2 03 69 50 51 0c 1f 9b 59 01 15 58 20 c6 40 5c 15 4c 56 74 66 ab 1d f2 03 69 50
0e 54 0e 9f 14 bd 3a 79 6a 06 52 ca e6 6c 90 61 68 8d 58 f1 30 81 ee 0e 54 0e 9f 14 bd 3a 79 6a 06 52 ca e6 6c 90 61 68 8d 58 f1 30 81 ee
30 81 a1 a0 03 02 01 02 02 04 62 31 9e c4 30 05 06 03 2b 65 70 30 1d 30 81 a1 a0 03 02 01 02 02 04 62 31 9e c4 30 05 06 03 2b 65 70 30 1d
31 1b 30 19 06 03 55 04 03 0c 12 45 44 48 4f 43 20 52 6f 6f 74 20 45 31 1b 30 19 06 03 55 04 03 0c 12 45 44 48 4f 43 20 52 6f 6f 74 20 45
64 32 35 35 31 39 30 1e 17 0d 32 32 30 33 31 36 30 38 32 34 33 36 5a 64 32 35 35 31 39 30 1e 17 0d 32 32 30 33 31 36 30 38 32 34 33 36 5a
17 0d 32 39 31 32 33 31 32 33 30 30 30 30 5a 30 22 31 20 30 1e 06 03 17 0d 32 39 31 32 33 31 32 33 30 30 30 30 5a 30 22 31 20 30 1e 06 03
55 04 03 0c 17 45 44 48 4f 43 20 52 65 73 70 6f 6e 64 65 72 20 45 64 55 04 03 0c 17 45 44 48 4f 43 20 52 65 73 70 6f 6e 64 65 72 20 45 64
32 35 35 31 39 30 2a 30 05 06 03 2b 65 70 03 21 00 a1 db 47 b9 51 84 32 35 35 31 39 30 2a 30 05 06 03 2b 65 70 03 21 00 a1 db 47 b9 51 84
85 4a d1 2a 0c 1a 35 4e 41 8a ac e3 3a a0 f2 c6 62 c0 0b 3a c5 5d e9 85 4a d1 2a 0c 1a 35 4e 41 8a ac e3 3a a0 f2 c6 62 c0 0b 3a c5 5d e9
2f 93 59 30 05 06 03 2b 65 70 03 41 00 b7 23 bc 01 ea b0 92 8e 8b 2b 2f 93 59 30 05 06 03 2b 65 70 03 41 00 b7 23 bc 01 ea b0 92 8e 8b 2b
6c 98 de 19 cc 38 23 d4 6e 7d 69 87 b0 32 47 8f ec fa f1 45 37 a1 af 6c 98 de 19 cc 38 23 d4 6e 7d 69 87 b0 32 47 8f ec fa f1 45 37 a1 af
14 cc 8b e8 29 c6 b7 30 44 10 18 37 eb 4a bc 94 95 65 d8 6d ce 51 cf 14 cc 8b e8 29 c6 b7 30 44 10 18 37 eb 4a bc 94 95 65 d8 6d ce 51 cf
ae 52 ab 82 c1 52 cb 02 58 20 36 9c a4 39 2c 83 ed 63 d6 1a d2 18 42 ae 52 ab 82 c1 52 cb 02 58 20 86 2a 7e 5e f1 47 f9 a5 f4 c5 12 e1 b6
0e a3 67 06 00 84 78 d5 bc 30 49 fb 8c 59 42 44 4b 13 33 62 3c d6 6c d1 7a 72 72 07 2b fe 5b 60 2f fe 30 7e e0 e9
]]></artwork> ]]></artwork>
<t>The Responder signs using the private authentication key SK_R</t> <t>The Responder signs using the private authentication key SK_R.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Signature_or_MAC_2 (Raw Value) (64 bytes) Signature_or_MAC_2 (Raw Value) (64 bytes)
41 e6 91 27 5b 84 04 24 25 5a cb 87 e6 33 d7 5d da 71 50 2d a2 e3 da c3 b5 bd 44 d1 e4 4a 08 5c 03 d3 ae de 4e 1e 6c 11 c5 72 a1 96 8c c3
5f ce ee c4 e3 f7 60 74 48 6f 87 e6 6f 2a ca a1 bb d4 8c e0 e6 6a 5d 62 9b 50 5f 98 c6 81 60 8d 3d 1d e7 93 d1 c4 0e b5 dd 5d 89 ac f1 96
64 38 91 54 48 2f 9a 5e 57 22 70 63 31 59 f2 b1 7e 0e 6a ea 07 02 2b 48 cd c9 98 70 eb c4 03 74 e8 fa 6e 09
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Signature_or_MAC_2 (CBOR Data Item) (66 bytes) Signature_or_MAC_2 (CBOR Data Item) (66 bytes)
58 40 41 e6 91 27 5b 84 04 24 25 5a cb 87 e6 33 d7 5d da 71 50 2d a2 58 40 c3 b5 bd 44 d1 e4 4a 08 5c 03 d3 ae de 4e 1e 6c 11 c5 72 a1 96
e3 da 5f ce ee c4 e3 f7 60 74 48 6f 87 e6 6f 2a ca a1 bb d4 8c e0 e6 8c c3 62 9b 50 5f 98 c6 81 60 8d 3d 1d e7 93 d1 c4 0e b5 dd 5d 89 ac
6a 5d 64 38 91 54 48 2f 9a 5e 57 22 70 63 31 59 f2 b1 7e 0e f1 96 6a ea 07 02 2b 48 cd c9 98 70 eb c4 03 74 e8 fa 6e 09
]]></artwork> ]]></artwork>
<t>The Responder constructs PLAINTEXT_2:</t> <t>The Responder constructs PLAINTEXT_2:</t>
<artwork><![CDATA[ <artwork><![CDATA[
PLAINTEXT_2 = PLAINTEXT_2 =
( (
C_R, C_R,
ID_CRED_R / bstr / -24..23, ID_CRED_R / bstr / -24..23,
Signature_or_MAC_2, Signature_or_MAC_2,
? EAD_2 ? EAD_2
) )
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
PLAINTEXT_2 (CBOR Sequence) (82 bytes) PLAINTEXT_2 (CBOR Sequence) (82 bytes)
41 18 a1 18 22 82 2e 48 79 f2 a4 1b 51 0c 1f 9b 58 40 41 e6 91 27 5b 41 18 a1 18 22 82 2e 48 79 f2 a4 1b 51 0c 1f 9b 58 40 c3 b5 bd 44 d1
84 04 24 25 5a cb 87 e6 33 d7 5d da 71 50 2d a2 e3 da 5f ce ee c4 e3 e4 4a 08 5c 03 d3 ae de 4e 1e 6c 11 c5 72 a1 96 8c c3 62 9b 50 5f 98
f7 60 74 48 6f 87 e6 6f 2a ca a1 bb d4 8c e0 e6 6a 5d 64 38 91 54 48 c6 81 60 8d 3d 1d e7 93 d1 c4 0e b5 dd 5d 89 ac f1 96 6a ea 07 02 2b
2f 9a 5e 57 22 70 63 31 59 f2 b1 7e 0e 48 cd c9 98 70 eb c4 03 74 e8 fa 6e 09
]]></artwork> ]]></artwork>
<t>The input needed to calculate KEYSTREAM_2 is defined in <xref section ="4.1.2" sectionFormat="of" target="I-D.ietf-lake-edhoc"/>, using EDHOC_Expand() with the EDHOC hash algorithm:</t> <t>The input needed to calculate KEYSTREAM_2 is defined in <xref section ="4.1.2" sectionFormat="of" target="RFC9528"/>, using EDHOC_Expand() with the ED HOC hash algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
KEYSTREAM_2 = EDHOC_KDF( PRK_2e, 0, TH_2, plaintext_length ) = KEYSTREAM_2 = EDHOC_KDF( PRK_2e, 0, TH_2, plaintext_length )
= HKDF-Expand( PRK_2e, info, plaintext_length ) = HKDF-Expand( PRK_2e, info, plaintext_length )
]]></artwork> ]]></artwork>
<t>where plaintext_length is the length in bytes of PLAINTEXT_2 in bytes , and info for KEYSTREAM_2 is:</t> <t>where plaintext_length is the length in bytes of PLAINTEXT_2 in bytes and info for KEYSTREAM_2 is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
0, 0,
h'c6405c154c567466ab1df20369500e540e9f14bd3a796a06 h'c6405c154c567466ab1df20369500e540e9f14bd3a796a06
52cae66c9061688d', 52cae66c9061688d',
82 82
) )
]]></artwork> ]]></artwork>
<t>where the last value is the length in bytes of PLAINTEXT_2.</t> <t>where the last value is the length in bytes of PLAINTEXT_2.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for KEYSTREAM_2 (CBOR Sequence) (37 bytes) info for KEYSTREAM_2 (CBOR Sequence) (37 bytes)
00 58 20 c6 40 5c 15 4c 56 74 66 ab 1d f2 03 69 50 0e 54 0e 9f 14 bd 00 58 20 c6 40 5c 15 4c 56 74 66 ab 1d f2 03 69 50 0e 54 0e 9f 14 bd
3a 79 6a 06 52 ca e6 6c 90 61 68 8d 18 52 3a 79 6a 06 52 ca e6 6c 90 61 68 8d 18 52
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
KEYSTREAM_2 (Raw Value) (82 bytes) KEYSTREAM_2 (Raw Value) (82 bytes)
fd 3e 7c 3f 2d 6b ee 64 3d 3c 9d 2f 28 47 03 5d 73 e2 ec b0 f8 db 5c fd 3e 7c 3f 2d 6b ee 64 3d 3c 9d 2f 28 47 03 5d 73 e2 ec b0 f8 db 5c
d1 c6 85 4e 24 89 6a f2 11 88 b2 c4 34 4e 68 9e c2 98 42 83 d9 fb c6 d1 c6 85 4e 24 89 6a f2 11 88 b2 c4 34 4e 68 9e c2 98 42 83 d9 fb c6
9c e1 c5 db 10 dc ff f2 4d f9 a4 9a 04 a9 40 58 27 7b c7 fa 9a d6 c6 9c e1 c5 db 10 dc ff f2 4d f9 a4 9a 04 a9 40 58 27 7b c7 fa 9a d6 c6
b1 94 ab 32 8b 44 5e b0 80 49 0c d7 86 b1 94 ab 32 8b 44 5e b0 80 49 0c d7 86
]]></artwork> ]]></artwork>
<t>The Responder calculates CIPHERTEXT_2 as XOR between PLAINTEXT_2 and KEYSTREAM_2:</t> <t>The Responder calculates CIPHERTEXT_2 as XOR between PLAINTEXT_2 and KEYSTREAM_2:</t>
<artwork><![CDATA[ <artwork><![CDATA[
CIPHERTEXT_2 (Raw Value) (82 bytes) CIPHERTEXT_2 (Raw Value) (82 bytes)
bc 26 dd 27 0f e9 c0 2c 44 ce 39 34 79 4b 1c c6 2b a2 ad 56 69 fc 07 bc 26 dd 27 0f e9 c0 2c 44 ce 39 34 79 4b 1c c6 2b a2 2f 05 45 9f 8d
55 c2 a1 6b 7e 42 ed 14 22 5f ef 1e 45 1e 45 3c 21 42 1d 4d 37 3f 25 35 8c 8d 12 27 5a c4 2c 5f 96 de d5 f1 3c c9 08 4e 5b 20 18 89 a4 5e
6b 81 b1 93 7f 5b 19 9d 67 33 05 21 d0 25 a0 be 4d 26 a3 c2 0b 82 8e 5a 60 a5 56 2d c1 18 61 9c 3d aa 2f d9 f4 c9 f4 d6 ed ad 10 9d d4 ed
9e 0e f5 65 a9 34 3d 81 d9 bb bd a9 88 f9 59 62 aa fb af 9a b3 f4 a1 f6 b9 8f
]]></artwork> ]]></artwork>
<t>The Responder constructs message_2:</t> <t>The Responder constructs message_2:</t>
<artwork><![CDATA[ <artwork><![CDATA[
message_2 = message_2 =
( (
G_Y_CIPHERTEXT_2 G_Y_CIPHERTEXT_2
) )
]]></artwork> ]]></artwork>
<t>where G_Y_CIPHERTEXT_2 is the bstr encoding of the concatenation of <t>where G_Y_CIPHERTEXT_2 is the bstr encoding of the concatenation of
the raw values of G_Y and CIPHERTEXT_2.</t> the raw values of G_Y and CIPHERTEXT_2.</t>
<artwork><![CDATA[ <artwork><![CDATA[
message_2 (CBOR Sequence) (116 bytes) message_2 (CBOR Sequence) (116 bytes)
58 72 dc 88 d2 d5 1d a5 ed 67 fc 46 16 35 6b c8 ca 74 ef 9e be 8b 38 58 72 dc 88 d2 d5 1d a5 ed 67 fc 46 16 35 6b c8 ca 74 ef 9e be 8b 38
7e 62 3a 36 0b a4 80 b9 b2 9d 1c bc 26 dd 27 0f e9 c0 2c 44 ce 39 34 7e 62 3a 36 0b a4 80 b9 b2 9d 1c bc 26 dd 27 0f e9 c0 2c 44 ce 39 34
79 4b 1c c6 2b a2 ad 56 69 fc 07 55 c2 a1 6b 7e 42 ed 14 22 5f ef 1e 79 4b 1c c6 2b a2 2f 05 45 9f 8d 35 8c 8d 12 27 5a c4 2c 5f 96 de d5
45 1e 45 3c 21 42 1d 4d 37 3f 25 6b 81 b1 93 7f 5b 19 9d 67 33 05 21 f1 3c c9 08 4e 5b 20 18 89 a4 5e 5a 60 a5 56 2d c1 18 61 9c 3d aa 2f
d0 25 a0 be 4d 26 a3 c2 0b 82 8e 9e 0e f5 65 a9 34 3d 81 d9 bb bd a9 d9 f4 c9 f4 d6 ed ad 10 9d d4 ed f9 59 62 aa fb af 9a b3 f4 a1 f6 b9
88 8f
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="message3"> <section anchor="message3">
<name>message_3</name> <name>message_3</name>
<t>Since METHOD = 0, the Initiator authenticates using signatures. Since the selected cipher suite is 0, the EDHOC signature algorithm is EdDSA.</t> <t>Since METHOD = 0, the Initiator authenticates using signatures. Since the selected cipher suite is 0, the EDHOC signature algorithm is EdDSA.</t>
<t>The Initiator's signature key pair using EdDSA:</t> <t>The Initiator's signature key pair uses EdDSA:</t>
<artwork><![CDATA[ <artwork><![CDATA[
Initiator's private authentication key Initiator's private authentication key
SK_I (Raw Value) (32 bytes) SK_I (Raw Value) (32 bytes)
4c 5b 25 87 8f 50 7c 6b 9d ae 68 fb d4 fd 3f f9 97 53 3d b0 af 00 b2 4c 5b 25 87 8f 50 7c 6b 9d ae 68 fb d4 fd 3f f9 97 53 3d b0 af 00 b2
5d 32 4e a2 8e 6c 21 3b c8 5d 32 4e a2 8e 6c 21 3b c8
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Initiator's public authentication key Initiator's public authentication key
PK_I (Raw Value) (32 bytes) PK_I (Raw Value) (32 bytes)
ed 06 a8 ae 61 a8 29 ba 5f a5 45 25 c9 d0 7f 48 dd 44 a3 02 f4 3e 0f ed 06 a8 ae 61 a8 29 ba 5f a5 45 25 c9 d0 7f 48 dd 44 a3 02 f4 3e 0f
23 d8 cc 20 b7 30 85 14 1e 23 d8 cc 20 b7 30 85 14 1e
]]></artwork> ]]></artwork>
<t>PRK_4e3m is specified in <xref section="4.1.1.3" sectionFormat="of" t <t>PRK_4e3m is specified in <xref section="4.1.1.3" sectionFormat="of" t
arget="I-D.ietf-lake-edhoc"/>.</t> arget="RFC9528"/>.</t>
<t>Since the Initiator authenticates with signatures PRK_4e3m = PRK_3e2m <t>Since the Initiator authenticates with signatures, PRK_4e3m = PRK_3e2
.</t> m.</t>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_4e3m (Raw Value) (32 bytes) PRK_4e3m (Raw Value) (32 bytes)
d5 84 ac 2e 5d ad 5a 77 d1 4b 53 eb e7 2e f1 d5 da a8 86 0d 39 93 73 d5 84 ac 2e 5d ad 5a 77 d1 4b 53 eb e7 2e f1 d5 da a8 86 0d 39 93 73
bf 2c 24 0a fa 7b a8 04 da bf 2c 24 0a fa 7b a8 04 da
]]></artwork> ]]></artwork>
<t>The transcript hash TH_3 is calculated using the EDHOC hash algorithm :</t> <t>The transcript hash TH_3 is calculated using the EDHOC hash algorithm :</t>
<t>TH_3 = H(TH_2, PLAINTEXT_2, CRED_R)</t> <t>TH_3 = H( TH_2, PLAINTEXT_2, CRED_R )</t>
<artwork><![CDATA[ <artwork><![CDATA[
Input to calculate TH_3 (CBOR Sequence) (359 bytes) Input to calculate TH_3 (CBOR Sequence) (359 bytes)
58 20 c6 40 5c 15 4c 56 74 66 ab 1d f2 03 69 50 0e 54 0e 9f 14 bd 3a 58 20 c6 40 5c 15 4c 56 74 66 ab 1d f2 03 69 50 0e 54 0e 9f 14 bd 3a
79 6a 06 52 ca e6 6c 90 61 68 8d 41 18 a1 18 22 82 2e 48 79 f2 a4 1b 79 6a 06 52 ca e6 6c 90 61 68 8d 41 18 a1 18 22 82 2e 48 79 f2 a4 1b
51 0c 1f 9b 58 40 41 e6 91 27 5b 84 04 24 25 5a cb 87 e6 33 d7 5d da 51 0c 1f 9b 58 40 c3 b5 bd 44 d1 e4 4a 08 5c 03 d3 ae de 4e 1e 6c 11
71 50 2d a2 e3 da 5f ce ee c4 e3 f7 60 74 48 6f 87 e6 6f 2a ca a1 bb c5 72 a1 96 8c c3 62 9b 50 5f 98 c6 81 60 8d 3d 1d e7 93 d1 c4 0e b5
d4 8c e0 e6 6a 5d 64 38 91 54 48 2f 9a 5e 57 22 70 63 31 59 f2 b1 7e dd 5d 89 ac f1 96 6a ea 07 02 2b 48 cd c9 98 70 eb c4 03 74 e8 fa 6e
0e 58 f1 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 9e c4 30 05 06 09 58 f1 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 9e c4 30 05 06
03 2b 65 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 44 48 4f 43 20 03 2b 65 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 44 48 4f 43 20
52 6f 6f 74 20 45 64 32 35 35 31 39 30 1e 17 0d 32 32 30 33 31 36 30 52 6f 6f 74 20 45 64 32 35 35 31 39 30 1e 17 0d 32 32 30 33 31 36 30
38 32 34 33 36 5a 17 0d 32 39 31 32 33 31 32 33 30 30 30 30 5a 30 22 38 32 34 33 36 5a 17 0d 32 39 31 32 33 31 32 33 30 30 30 30 5a 30 22
31 20 30 1e 06 03 55 04 03 0c 17 45 44 48 4f 43 20 52 65 73 70 6f 6e 31 20 30 1e 06 03 55 04 03 0c 17 45 44 48 4f 43 20 52 65 73 70 6f 6e
64 65 72 20 45 64 32 35 35 31 39 30 2a 30 05 06 03 2b 65 70 03 21 00 64 65 72 20 45 64 32 35 35 31 39 30 2a 30 05 06 03 2b 65 70 03 21 00
a1 db 47 b9 51 84 85 4a d1 2a 0c 1a 35 4e 41 8a ac e3 3a a0 f2 c6 62 a1 db 47 b9 51 84 85 4a d1 2a 0c 1a 35 4e 41 8a ac e3 3a a0 f2 c6 62
c0 0b 3a c5 5d e9 2f 93 59 30 05 06 03 2b 65 70 03 41 00 b7 23 bc 01 c0 0b 3a c5 5d e9 2f 93 59 30 05 06 03 2b 65 70 03 41 00 b7 23 bc 01
ea b0 92 8e 8b 2b 6c 98 de 19 cc 38 23 d4 6e 7d 69 87 b0 32 47 8f ec ea b0 92 8e 8b 2b 6c 98 de 19 cc 38 23 d4 6e 7d 69 87 b0 32 47 8f ec
fa f1 45 37 a1 af 14 cc 8b e8 29 c6 b7 30 44 10 18 37 eb 4a bc 94 95 fa f1 45 37 a1 af 14 cc 8b e8 29 c6 b7 30 44 10 18 37 eb 4a bc 94 95
65 d8 6d ce 51 cf ae 52 ab 82 c1 52 cb 02 65 d8 6d ce 51 cf ae 52 ab 82 c1 52 cb 02
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
TH_3 (Raw Value) (32 bytes) TH_3 (Raw Value) (32 bytes)
e0 91 12 1a f5 ac 6c e2 14 5d 48 25 e0 90 12 f2 97 98 e8 f7 13 ac 98 5b 7d f9 b4 f5 8f 24 0c e0 41 8e 48 19 1b 5f ff 3a 22 b5 ca 57 f6 69
91 43 2d 22 56 b6 f6 78 e9 b1 67 77 99 65 92 e9 28 bc
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
TH_3 (CBOR Data Item) (34 bytes) TH_3 (CBOR Data Item) (34 bytes)
58 20 e0 91 12 1a f5 ac 6c e2 14 5d 48 25 e0 90 12 f2 97 98 e8 f7 13 58 20 5b 7d f9 b4 f5 8f 24 0c e0 41 8e 48 19 1b 5f ff 3a 22 b5 ca 57
ac 98 91 43 2d 22 56 b6 f6 78 e9 f6 69 b1 67 77 99 65 92 e9 28 bc
]]></artwork> ]]></artwork>
<t>The Initiator constructs the remaining input needed to calculate MAC_ 3:</t> <t>The Initiator constructs the remaining input needed to calculate MAC_ 3:</t>
<artwork><![CDATA[ <artwork><![CDATA[
MAC_3 = EDHOC_KDF( PRK_4e3m, 6, context_3, mac_length_3 ) MAC_3 = EDHOC_KDF( PRK_4e3m, 6, context_3, mac_length_3 )
]]></artwork> ]]></artwork>
<t>where</t> <t>where</t>
<artwork><![CDATA[ <artwork><![CDATA[
context_3 = << ID_CRED_I, TH_3, CRED_I, ? EAD_3 >> context_3 = << ID_CRED_I, TH_3, CRED_I, ? EAD_3 >>
]]></artwork> ]]></artwork>
<t>CRED_I is identified by a 64-bit hash:</t> <t>CRED_I is identified by a 64-bit hash:</t>
<artwork><![CDATA[ <artwork><![CDATA[
ID_CRED_I = ID_CRED_I =
{ {
34 : [-15, h'c24ab2fd7643c79f'] 34 : [-15, h'c24ab2fd7643c79f']
} }
]]></artwork> ]]></artwork>
<t>where the COSE header value 34 ('x5t') indicates a hash of an X.509 c ertficate, <t>where the COSE header value 34 ('x5t') indicates a hash of an X.509 c ertificate,
and the COSE algorithm -15 indicates the hash algorithm SHA-256 truncated to 64 bits.</t> and the COSE algorithm -15 indicates the hash algorithm SHA-256 truncated to 64 bits.</t>
<artwork><![CDATA[ <artwork><![CDATA[
ID_CRED_I (CBOR Data Item) (14 bytes) ID_CRED_I (CBOR Data Item) (14 bytes)
a1 18 22 82 2e 48 c2 4a b2 fd 76 43 c7 9f a1 18 22 82 2e 48 c2 4a b2 fd 76 43 c7 9f
]]></artwork> ]]></artwork>
<t>CRED_I is a CBOR byte string of the DER encoding of the X.509 certifi cate in <xref target="init-cer"/>:</t> <t>CRED_I is a CBOR byte string of the DER encoding of the X.509 certifi cate in <xref target="init-cer"/>:</t>
<artwork><![CDATA[ <artwork><![CDATA[
CRED_I (Raw Value) (241 bytes) CRED_I (Raw Value) (241 bytes)
30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 9e a0 30 05 06 03 2b 65 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 9e a0 30 05 06 03 2b 65
70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 44 48 4f 43 20 52 6f 6f 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 44 48 4f 43 20 52 6f 6f
skipping to change at line 659 skipping to change at line 676
ae 48 b7 56 01 59 81 85 0d 27 db 67 34 e3 7f 67 21 22 67 dd 05 ee ff ae 48 b7 56 01 59 81 85 0d 27 db 67 34 e3 7f 67 21 22 67 dd 05 ee ff
27 b9 e7 a8 13 fa 57 4b 72 a0 0b 43 0b 27 b9 e7 a8 13 fa 57 4b 72 a0 0b 43 0b
]]></artwork> ]]></artwork>
<t>No external authorization data:</t> <t>No external authorization data:</t>
<artwork><![CDATA[ <artwork><![CDATA[
EAD_3 (CBOR Sequence) (0 bytes) EAD_3 (CBOR Sequence) (0 bytes)
]]></artwork> ]]></artwork>
<t>context_3 = &lt;&lt; ID_CRED_I, TH_3, CRED_I, ? EAD_3 &gt;&gt;</t> <t>context_3 = &lt;&lt; ID_CRED_I, TH_3, CRED_I, ? EAD_3 &gt;&gt;</t>
<artwork><![CDATA[ <artwork><![CDATA[
context_3 (CBOR Sequence) (291 bytes) context_3 (CBOR Sequence) (291 bytes)
a1 18 22 82 2e 48 c2 4a b2 fd 76 43 c7 9f 58 20 e0 91 12 1a f5 ac 6c a1 18 22 82 2e 48 c2 4a b2 fd 76 43 c7 9f 58 20 5b 7d f9 b4 f5 8f 24
e2 14 5d 48 25 e0 90 12 f2 97 98 e8 f7 13 ac 98 91 43 2d 22 56 b6 f6 0c e0 41 8e 48 19 1b 5f ff 3a 22 b5 ca 57 f6 69 b1 67 77 99 65 92 e9
78 e9 58 f1 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 9e a0 30 05 28 bc 58 f1 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 9e a0 30 05
06 03 2b 65 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 44 48 4f 43 06 03 2b 65 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 44 48 4f 43
20 52 6f 6f 74 20 45 64 32 35 35 31 39 30 1e 17 0d 32 32 30 33 31 36 20 52 6f 6f 74 20 45 64 32 35 35 31 39 30 1e 17 0d 32 32 30 33 31 36
30 38 32 34 30 30 5a 17 0d 32 39 31 32 33 31 32 33 30 30 30 30 5a 30 30 38 32 34 30 30 5a 17 0d 32 39 31 32 33 31 32 33 30 30 30 30 5a 30
22 31 20 30 1e 06 03 55 04 03 0c 17 45 44 48 4f 43 20 49 6e 69 74 69 22 31 20 30 1e 06 03 55 04 03 0c 17 45 44 48 4f 43 20 49 6e 69 74 69
61 74 6f 72 20 45 64 32 35 35 31 39 30 2a 30 05 06 03 2b 65 70 03 21 61 74 6f 72 20 45 64 32 35 35 31 39 30 2a 30 05 06 03 2b 65 70 03 21
00 ed 06 a8 ae 61 a8 29 ba 5f a5 45 25 c9 d0 7f 48 dd 44 a3 02 f4 3e 00 ed 06 a8 ae 61 a8 29 ba 5f a5 45 25 c9 d0 7f 48 dd 44 a3 02 f4 3e
0f 23 d8 cc 20 b7 30 85 14 1e 30 05 06 03 2b 65 70 03 41 00 52 12 41 0f 23 d8 cc 20 b7 30 85 14 1e 30 05 06 03 2b 65 70 03 41 00 52 12 41
d8 b3 a7 70 99 6b cf c9 b9 ea d4 e7 e0 a1 c0 db 35 3a 3b df 29 10 b3 d8 b3 a7 70 99 6b cf c9 b9 ea d4 e7 e0 a1 c0 db 35 3a 3b df 29 10 b3
92 75 ae 48 b7 56 01 59 81 85 0d 27 db 67 34 e3 7f 67 21 22 67 dd 05 92 75 ae 48 b7 56 01 59 81 85 0d 27 db 67 34 e3 7f 67 21 22 67 dd 05
ee ff 27 b9 e7 a8 13 fa 57 4b 72 a0 0b 43 0b ee ff 27 b9 e7 a8 13 fa 57 4b 72 a0 0b 43 0b
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
context_3 (CBOR byte string) (294 bytes) context_3 (CBOR byte string) (294 bytes)
59 01 23 a1 18 22 82 2e 48 c2 4a b2 fd 76 43 c7 9f 58 20 e0 91 12 1a 59 01 23 a1 18 22 82 2e 48 c2 4a b2 fd 76 43 c7 9f 58 20 5b 7d f9 b4
f5 ac 6c e2 14 5d 48 25 e0 90 12 f2 97 98 e8 f7 13 ac 98 91 43 2d 22 f5 8f 24 0c e0 41 8e 48 19 1b 5f ff 3a 22 b5 ca 57 f6 69 b1 67 77 99
56 b6 f6 78 e9 58 f1 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 9e 65 92 e9 28 bc 58 f1 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 9e
a0 30 05 06 03 2b 65 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 44 a0 30 05 06 03 2b 65 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 44
48 4f 43 20 52 6f 6f 74 20 45 64 32 35 35 31 39 30 1e 17 0d 32 32 30 48 4f 43 20 52 6f 6f 74 20 45 64 32 35 35 31 39 30 1e 17 0d 32 32 30
33 31 36 30 38 32 34 30 30 5a 17 0d 32 39 31 32 33 31 32 33 30 30 30 33 31 36 30 38 32 34 30 30 5a 17 0d 32 39 31 32 33 31 32 33 30 30 30
30 5a 30 22 31 20 30 1e 06 03 55 04 03 0c 17 45 44 48 4f 43 20 49 6e 30 5a 30 22 31 20 30 1e 06 03 55 04 03 0c 17 45 44 48 4f 43 20 49 6e
69 74 69 61 74 6f 72 20 45 64 32 35 35 31 39 30 2a 30 05 06 03 2b 65 69 74 69 61 74 6f 72 20 45 64 32 35 35 31 39 30 2a 30 05 06 03 2b 65
70 03 21 00 ed 06 a8 ae 61 a8 29 ba 5f a5 45 25 c9 d0 7f 48 dd 44 a3 70 03 21 00 ed 06 a8 ae 61 a8 29 ba 5f a5 45 25 c9 d0 7f 48 dd 44 a3
02 f4 3e 0f 23 d8 cc 20 b7 30 85 14 1e 30 05 06 03 2b 65 70 03 41 00 02 f4 3e 0f 23 d8 cc 20 b7 30 85 14 1e 30 05 06 03 2b 65 70 03 41 00
52 12 41 d8 b3 a7 70 99 6b cf c9 b9 ea d4 e7 e0 a1 c0 db 35 3a 3b df 52 12 41 d8 b3 a7 70 99 6b cf c9 b9 ea d4 e7 e0 a1 c0 db 35 3a 3b df
29 10 b3 92 75 ae 48 b7 56 01 59 81 85 0d 27 db 67 34 e3 7f 67 21 22 29 10 b3 92 75 ae 48 b7 56 01 59 81 85 0d 27 db 67 34 e3 7f 67 21 22
67 dd 05 ee ff 27 b9 e7 a8 13 fa 57 4b 72 a0 0b 43 0b 67 dd 05 ee ff 27 b9 e7 a8 13 fa 57 4b 72 a0 0b 43 0b
]]></artwork> ]]></artwork>
<t>MAC_3 is computed through EDHOC_Expand() using the EDHOC hash algorit hm, see <xref section="4.1.2" sectionFormat="of" target="I-D.ietf-lake-edhoc"/>: </t> <t>MAC_3 is computed through EDHOC_Expand() using the EDHOC hash algorit hm (see <xref section="4.1.2" sectionFormat="of" target="RFC9528"/>):</t>
<artwork><![CDATA[ <artwork><![CDATA[
MAC_3 = HKDF-Expand(PRK_4e3m, info, mac_length_3), where MAC_3 = HKDF-Expand( PRK_4e3m, info, mac_length_3 )
]]></artwork>
<t>where</t>
<artwork><![CDATA[
info = ( 6, context_3, mac_length_3 )
]]></artwork>
<t>where</t>
<artwork><![CDATA[
context_3 = << ID_CRED_I, TH_3, CRED_I, ? EAD_3 >>
]]></artwork> ]]></artwork>
<t>info = ( 6, context_3, mac_length_3 )</t>
<t>where context_3 = &lt;&lt; ID_CRED_I, TH_3, CRED_I, ? EAD_3 &gt;&gt;<
/t>
<t>Since METHOD = 0, mac_length_3 is given by the EDHOC hash algorithm.< /t> <t>Since METHOD = 0, mac_length_3 is given by the EDHOC hash algorithm.< /t>
<t>info for MAC_3 is:</t> <t>info for MAC_3 is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
6, 6,
h'a11822822e48c24ab2fd7643c79f5820e091121af5ac6ce2 h'a11822822e48c24ab2fd7643c79f58205b7df9b4f58f240c
145d4825e09012f29798e8f713ac9891432d2256b6f678e9 e0418e48191b5fff3a22b5ca57f669b16777996592e928bc
58f13081ee3081a1a003020102020462319ea0300506032b 58f13081ee3081a1a003020102020462319ea0300506032b
6570301d311b301906035504030c124544484f4320526f6f 6570301d311b301906035504030c124544484f4320526f6f
742045643235353139301e170d3232303331363038323430 742045643235353139301e170d3232303331363038323430
305a170d3239313233313233303030305a30223120301e06 305a170d3239313233313233303030305a30223120301e06
035504030c174544484f4320496e69746961746f72204564 035504030c174544484f4320496e69746961746f72204564
3235353139302a300506032b6570032100ed06a8ae61a829 3235353139302a300506032b6570032100ed06a8ae61a829
ba5fa54525c9d07f48dd44a302f43e0f23d8cc20b7308514 ba5fa54525c9d07f48dd44a302f43e0f23d8cc20b7308514
1e300506032b6570034100521241d8b3a770996bcfc9b9ea 1e300506032b6570034100521241d8b3a770996bcfc9b9ea
d4e7e0a1c0db353a3bdf2910b39275ae48b756015981850d d4e7e0a1c0db353a3bdf2910b39275ae48b756015981850d
27db6734e37f67212267dd05eeff27b9e7a813fa574b72a0 27db6734e37f67212267dd05eeff27b9e7a813fa574b72a0
0b430b', 0b430b',
32 32
) )
]]></artwork> ]]></artwork>
<t>where the last value is the output size of the EDHOC hash algorithm i n bytes.</t> <t>where the last value is the output size of the EDHOC hash algorithm i n bytes.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for MAC_3 (CBOR Sequence) (297 bytes) info for MAC_3 (CBOR Sequence) (297 bytes)
06 59 01 23 a1 18 22 82 2e 48 c2 4a b2 fd 76 43 c7 9f 58 20 e0 91 12 06 59 01 23 a1 18 22 82 2e 48 c2 4a b2 fd 76 43 c7 9f 58 20 5b 7d f9
1a f5 ac 6c e2 14 5d 48 25 e0 90 12 f2 97 98 e8 f7 13 ac 98 91 43 2d b4 f5 8f 24 0c e0 41 8e 48 19 1b 5f ff 3a 22 b5 ca 57 f6 69 b1 67 77
22 56 b6 f6 78 e9 58 f1 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 99 65 92 e9 28 bc 58 f1 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31
9e a0 30 05 06 03 2b 65 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 9e a0 30 05 06 03 2b 65 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45
44 48 4f 43 20 52 6f 6f 74 20 45 64 32 35 35 31 39 30 1e 17 0d 32 32 44 48 4f 43 20 52 6f 6f 74 20 45 64 32 35 35 31 39 30 1e 17 0d 32 32
30 33 31 36 30 38 32 34 30 30 5a 17 0d 32 39 31 32 33 31 32 33 30 30 30 33 31 36 30 38 32 34 30 30 5a 17 0d 32 39 31 32 33 31 32 33 30 30
30 30 5a 30 22 31 20 30 1e 06 03 55 04 03 0c 17 45 44 48 4f 43 20 49 30 30 5a 30 22 31 20 30 1e 06 03 55 04 03 0c 17 45 44 48 4f 43 20 49
6e 69 74 69 61 74 6f 72 20 45 64 32 35 35 31 39 30 2a 30 05 06 03 2b 6e 69 74 69 61 74 6f 72 20 45 64 32 35 35 31 39 30 2a 30 05 06 03 2b
65 70 03 21 00 ed 06 a8 ae 61 a8 29 ba 5f a5 45 25 c9 d0 7f 48 dd 44 65 70 03 21 00 ed 06 a8 ae 61 a8 29 ba 5f a5 45 25 c9 d0 7f 48 dd 44
a3 02 f4 3e 0f 23 d8 cc 20 b7 30 85 14 1e 30 05 06 03 2b 65 70 03 41 a3 02 f4 3e 0f 23 d8 cc 20 b7 30 85 14 1e 30 05 06 03 2b 65 70 03 41
00 52 12 41 d8 b3 a7 70 99 6b cf c9 b9 ea d4 e7 e0 a1 c0 db 35 3a 3b 00 52 12 41 d8 b3 a7 70 99 6b cf c9 b9 ea d4 e7 e0 a1 c0 db 35 3a 3b
df 29 10 b3 92 75 ae 48 b7 56 01 59 81 85 0d 27 db 67 34 e3 7f 67 21 df 29 10 b3 92 75 ae 48 b7 56 01 59 81 85 0d 27 db 67 34 e3 7f 67 21
22 67 dd 05 ee ff 27 b9 e7 a8 13 fa 57 4b 72 a0 0b 43 0b 18 20 22 67 dd 05 ee ff 27 b9 e7 a8 13 fa 57 4b 72 a0 0b 43 0b 18 20
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
MAC_3 (Raw Value) (32 bytes) MAC_3 (Raw Value) (32 bytes)
51 c9 68 a7 f9 fd ea 19 c7 02 3f 70 22 b4 d9 f2 14 77 2e f5 88 59 05 39 b1 27 c1 30 12 9a fa 30 61 8c 75 13 29 e6 37 cc 37 34 27 0d 4b 01
24 05 76 f6 2d 03 6e 69 dc 25 84 45 a8 ee 02 da a3 bd
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
MAC_3 (CBOR Data Item) (34 bytes) MAC_3 (CBOR Data Item) (34 bytes)
58 20 51 c9 68 a7 f9 fd ea 19 c7 02 3f 70 22 b4 d9 f2 14 77 2e f5 88 58 20 39 b1 27 c1 30 12 9a fa 30 61 8c 75 13 29 e6 37 cc 37 34 27 0d
59 05 24 05 76 f6 2d 03 6e 69 dc 4b 01 25 84 45 a8 ee 02 da a3 bd
]]></artwork> ]]></artwork>
<t>Since METHOD = 0, Signature_or_MAC_3 is the 'signature' of the <t>Since METHOD = 0, Signature_or_MAC_3 is the 'signature' of the
COSE_Sign1 object.</t> COSE_Sign1 object.</t>
<t>The Initiator constructs the message to be signed:</t> <t>The Initiator constructs the message to be signed:</t>
<artwork><![CDATA[ <artwork><![CDATA[
[ "Signature1", << ID_CRED_I >>, [
<< TH_3, CRED_I, ? EAD_3 >>, MAC_3 ] = "Signature1",
<< ID_CRED_I >>,
<< TH_3, CRED_I, ? EAD_3 >>,
MAC_3
] =
[ [
"Signature1", "Signature1",
h'a11822822e48c24ab2fd7643c79f', h'a11822822e48c24ab2fd7643c79f',
h'5820e091121af5ac6ce2145d4825e09012f29798e8f713ac h'58205b7df9b4f58f240ce0418e48191b5fff3a22b5ca57f6
9891432d2256b6f678e958f13081ee3081a1a00302010202 69b16777996592e928bc58f13081ee3081a1a00302010202
0462319ea0300506032b6570301d311b301906035504030c 0462319ea0300506032b6570301d311b301906035504030c
124544484f4320526f6f742045643235353139301e170d32 124544484f4320526f6f742045643235353139301e170d32
32303331363038323430305a170d32393132333132333030 32303331363038323430305a170d32393132333132333030
30305a30223120301e06035504030c174544484f4320496e 30305a30223120301e06035504030c174544484f4320496e
69746961746f722045643235353139302a300506032b6570 69746961746f722045643235353139302a300506032b6570
032100ed06a8ae61a829ba5fa54525c9d07f48dd44a302f4 032100ed06a8ae61a829ba5fa54525c9d07f48dd44a302f4
3e0f23d8cc20b73085141e300506032b6570034100521241 3e0f23d8cc20b73085141e300506032b6570034100521241
d8b3a770996bcfc9b9ead4e7e0a1c0db353a3bdf2910b392 d8b3a770996bcfc9b9ead4e7e0a1c0db353a3bdf2910b392
75ae48b756015981850d27db6734e37f67212267dd05eeff 75ae48b756015981850d27db6734e37f67212267dd05eeff
27b9e7a813fa574b72a00b430b', 27b9e7a813fa574b72a00b430b',
h'51c968a7f9fdea19c7023f7022b4d9f214772ef588590524 h'39b127c130129afa30618c751329e637cc3734270d4b0125
0576f62d036e69dc' 8445a8ee02daa3bd'
] ]
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Message to be signed 3 (CBOR Data Item) (341 bytes) Message to be signed in message_3 (CBOR Data Item) (341 bytes)
84 6a 53 69 67 6e 61 74 75 72 65 31 4e a1 18 22 82 2e 48 c2 4a b2 fd 84 6a 53 69 67 6e 61 74 75 72 65 31 4e a1 18 22 82 2e 48 c2 4a b2 fd
76 43 c7 9f 59 01 15 58 20 e0 91 12 1a f5 ac 6c e2 14 5d 48 25 e0 90 76 43 c7 9f 59 01 15 58 20 5b 7d f9 b4 f5 8f 24 0c e0 41 8e 48 19 1b
12 f2 97 98 e8 f7 13 ac 98 91 43 2d 22 56 b6 f6 78 e9 58 f1 30 81 ee 5f ff 3a 22 b5 ca 57 f6 69 b1 67 77 99 65 92 e9 28 bc 58 f1 30 81 ee
30 81 a1 a0 03 02 01 02 02 04 62 31 9e a0 30 05 06 03 2b 65 70 30 1d 30 81 a1 a0 03 02 01 02 02 04 62 31 9e a0 30 05 06 03 2b 65 70 30 1d
31 1b 30 19 06 03 55 04 03 0c 12 45 44 48 4f 43 20 52 6f 6f 74 20 45 31 1b 30 19 06 03 55 04 03 0c 12 45 44 48 4f 43 20 52 6f 6f 74 20 45
64 32 35 35 31 39 30 1e 17 0d 32 32 30 33 31 36 30 38 32 34 30 30 5a 64 32 35 35 31 39 30 1e 17 0d 32 32 30 33 31 36 30 38 32 34 30 30 5a
17 0d 32 39 31 32 33 31 32 33 30 30 30 30 5a 30 22 31 20 30 1e 06 03 17 0d 32 39 31 32 33 31 32 33 30 30 30 30 5a 30 22 31 20 30 1e 06 03
55 04 03 0c 17 45 44 48 4f 43 20 49 6e 69 74 69 61 74 6f 72 20 45 64 55 04 03 0c 17 45 44 48 4f 43 20 49 6e 69 74 69 61 74 6f 72 20 45 64
32 35 35 31 39 30 2a 30 05 06 03 2b 65 70 03 21 00 ed 06 a8 ae 61 a8 32 35 35 31 39 30 2a 30 05 06 03 2b 65 70 03 21 00 ed 06 a8 ae 61 a8
29 ba 5f a5 45 25 c9 d0 7f 48 dd 44 a3 02 f4 3e 0f 23 d8 cc 20 b7 30 29 ba 5f a5 45 25 c9 d0 7f 48 dd 44 a3 02 f4 3e 0f 23 d8 cc 20 b7 30
85 14 1e 30 05 06 03 2b 65 70 03 41 00 52 12 41 d8 b3 a7 70 99 6b cf 85 14 1e 30 05 06 03 2b 65 70 03 41 00 52 12 41 d8 b3 a7 70 99 6b cf
c9 b9 ea d4 e7 e0 a1 c0 db 35 3a 3b df 29 10 b3 92 75 ae 48 b7 56 01 c9 b9 ea d4 e7 e0 a1 c0 db 35 3a 3b df 29 10 b3 92 75 ae 48 b7 56 01
59 81 85 0d 27 db 67 34 e3 7f 67 21 22 67 dd 05 ee ff 27 b9 e7 a8 13 59 81 85 0d 27 db 67 34 e3 7f 67 21 22 67 dd 05 ee ff 27 b9 e7 a8 13
fa 57 4b 72 a0 0b 43 0b 58 20 51 c9 68 a7 f9 fd ea 19 c7 02 3f 70 22 fa 57 4b 72 a0 0b 43 0b 58 20 39 b1 27 c1 30 12 9a fa 30 61 8c 75 13
b4 d9 f2 14 77 2e f5 88 59 05 24 05 76 f6 2d 03 6e 69 dc 29 e6 37 cc 37 34 27 0d 4b 01 25 84 45 a8 ee 02 da a3 bd
]]></artwork> ]]></artwork>
<t>The Initiator signs using the private authentication key SK_I:</t> <t>The Initiator signs using the private authentication key SK_I:</t>
<artwork><![CDATA[ <artwork><![CDATA[
Signature_or_MAC_3 (Raw Value) (64 bytes) Signature_or_MAC_3 (Raw Value) (64 bytes)
fc 10 7e c0 0f 74 ba 31 47 40 04 da 60 c5 b0 e1 eb 18 37 c0 f2 1e 00 96 e1 cd 5f ce ad fa c1 b5 af 81 94 43 f7 09 24 f5 71 99 55 95 7f d0
81 6f bd bb e9 75 a8 05 68 3d 12 69 5b 1f a4 dc 71 f6 4c 6e 9e e9 32 26 55 be b4 77 5e 1a 73 18 6a 0d 1d 3e a6 83 f0 8f 8d 03 dc ec b9 cf
0a 19 19 85 57 41 e2 7a 16 02 97 8a 13 4f 3e 57 4f 06 15 4e 1c 6f 55 5a 1e 12 ca 11 8c e4 2b db a6 87 89 07
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Signature_or_MAC_3 (CBOR Data Item) (66 bytes) Signature_or_MAC_3 (CBOR Data Item) (66 bytes)
58 40 fc 10 7e c0 0f 74 ba 31 47 40 04 da 60 c5 b0 e1 eb 18 37 c0 f2 58 40 96 e1 cd 5f ce ad fa c1 b5 af 81 94 43 f7 09 24 f5 71 99 55 95
1e 00 81 6f bd bb e9 75 a8 05 68 3d 12 69 5b 1f a4 dc 71 f6 4c 6e 9e 7f d0 26 55 be b4 77 5e 1a 73 18 6a 0d 1d 3e a6 83 f0 8f 8d 03 dc ec
e9 32 0a 19 19 85 57 41 e2 7a 16 02 97 8a 13 4f 3e 57 4f 06 b9 cf 15 4e 1c 6f 55 5a 1e 12 ca 11 8c e4 2b db a6 87 89 07
]]></artwork> ]]></artwork>
<t>The Initiator constructs PLAINTEXT_3:</t> <t>The Initiator constructs PLAINTEXT_3:</t>
<artwork><![CDATA[ <artwork><![CDATA[
PLAINTEXT_3 = PLAINTEXT_3 =
( (
ID_CRED_I / bstr / -24..23, ID_CRED_I / bstr / -24..23,
Signature_or_MAC_3, Signature_or_MAC_3,
? EAD_3 ? EAD_3
) )
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
PLAINTEXT_3 (CBOR Sequence) (80 bytes) PLAINTEXT_3 (CBOR Sequence) (80 bytes)
a1 18 22 82 2e 48 c2 4a b2 fd 76 43 c7 9f 58 40 fc 10 7e c0 0f 74 ba a1 18 22 82 2e 48 c2 4a b2 fd 76 43 c7 9f 58 40 96 e1 cd 5f ce ad fa
31 47 40 04 da 60 c5 b0 e1 eb 18 37 c0 f2 1e 00 81 6f bd bb e9 75 a8 c1 b5 af 81 94 43 f7 09 24 f5 71 99 55 95 7f d0 26 55 be b4 77 5e 1a
05 68 3d 12 69 5b 1f a4 dc 71 f6 4c 6e 9e e9 32 0a 19 19 85 57 41 e2 73 18 6a 0d 1d 3e a6 83 f0 8f 8d 03 dc ec b9 cf 15 4e 1c 6f 55 5a 1e
7a 16 02 97 8a 13 4f 3e 57 4f 06 12 ca 11 8c e4 2b db a6 87 89 07
]]></artwork> ]]></artwork>
<t>The Initiator constructs the associated data for message_3:</t> <t>The Initiator constructs the associated data for message_3:</t>
<artwork><![CDATA[ <artwork><![CDATA[
A_3 = A_3 =
[ [
"Encrypt0", "Encrypt0",
h'', h'',
h'e091121af5ac6ce2145d4825e09012f29798e8f713ac9891 h'5b7df9b4f58f240ce0418e48191b5fff3a22b5ca57f669b1
432d2256b6f678e9' 6777996592e928bc'
] ]
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
A_3 (CBOR Data Item) (45 bytes) A_3 (CBOR Data Item) (45 bytes)
83 68 45 6e 63 72 79 70 74 30 40 58 20 e0 91 12 1a f5 ac 6c e2 14 5d 83 68 45 6e 63 72 79 70 74 30 40 58 20 5b 7d f9 b4 f5 8f 24 0c e0 41
48 25 e0 90 12 f2 97 98 e8 f7 13 ac 98 91 43 2d 22 56 b6 f6 78 e9 8e 48 19 1b 5f ff 3a 22 b5 ca 57 f6 69 b1 67 77 99 65 92 e9 28 bc
]]></artwork> ]]></artwork>
<t>The Initiator constructs the input needed to derive the key K_3, see <xref section="4.1.2" sectionFormat="of" target="I-D.ietf-lake-edhoc"/>, using t he EDHOC hash algorithm:</t> <t>The Initiator constructs the input needed to derive the key K_3 (see <xref section="4.1.2" sectionFormat="of" target="RFC9528"/>) using the EDHOC has h algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
K_3 = EDHOC_KDF( PRK_3e2m, 3, TH_3, key_length ) K_3 = EDHOC_KDF( PRK_3e2m, 3, TH_3, key_length )
= HKDF-Expand( PRK_3e2m, info, key_length ), = HKDF-Expand( PRK_3e2m, info, key_length )
]]></artwork> ]]></artwork>
<t>where key_length is the key length in bytes for the EDHOC AEAD algori thm, and info for K_3 is:</t> <t>where key_length is the key length in bytes for the EDHOC Authenticat ed Encryption with Associated Data (AEAD) algorithm, and info for K_3 is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
3, 3,
h'e091121af5ac6ce2145d4825e09012f29798e8f713ac9891 h'5b7df9b4f58f240ce0418e48191b5fff3a22b5ca57f669b1
432d2256b6f678e9', 6777996592e928bc',
16 16
) )
]]></artwork> ]]></artwork>
<t>where the last value is the key length in bytes for the EDHOC AEAD al gorithm.</t> <t>where the last value is the key length in bytes for the EDHOC AEAD al gorithm.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for K_3 (CBOR Sequence) (36 bytes) info for K_3 (CBOR Sequence) (36 bytes)
03 58 20 e0 91 12 1a f5 ac 6c e2 14 5d 48 25 e0 90 12 f2 97 98 e8 f7 03 58 20 5b 7d f9 b4 f5 8f 24 0c e0 41 8e 48 19 1b 5f ff 3a 22 b5 ca
13 ac 98 91 43 2d 22 56 b6 f6 78 e9 10 57 f6 69 b1 67 77 99 65 92 e9 28 bc 10
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
K_3 (Raw Value) (16 bytes) K_3 (Raw Value) (16 bytes)
95 65 a2 09 f6 7f d0 e1 62 9e 6f e7 c0 cc 3e 4a da 19 5e 5f 64 8a c6 3b 0e 8f b0 c4 55 20 51 39
]]></artwork> ]]></artwork>
<t>The Initiator constructs the input needed to derive the nonce IV_3, s ee <xref section="4.1.2" sectionFormat="of" target="I-D.ietf-lake-edhoc"/>, usin g the EDHOC hash algorithm:</t> <t>The Initiator constructs the input needed to derive the nonce IV_3 (s ee <xref section="4.1.2" sectionFormat="of" target="RFC9528"/>) using the EDHOC hash algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
IV_3 = EDHOC_KDF( PRK_3e2m, 4, TH_3, iv_length ) IV_3 = EDHOC_KDF( PRK_3e2m, 4, TH_3, iv_length )
= HKDF-Expand( PRK_3e2m, info, iv_length ), = HKDF-Expand( PRK_3e2m, info, iv_length )
]]></artwork> ]]></artwork>
<t>where iv_length is the nonce length in bytes for the EDHOC AEAD algor ithm, and info for IV_3 is:</t> <t>where iv_length is the nonce length in bytes for the EDHOC AEAD algor ithm, and info for IV_3 is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
4, 4,
h'e091121af5ac6ce2145d4825e09012f29798e8f713ac9891 h'5b7df9b4f58f240ce0418e48191b5fff3a22b5ca57f669b1
432d2256b6f678e9', 6777996592e928bc',
13 13
) )
]]></artwork> ]]></artwork>
<t>where the last value is the nonce length in bytes for the EDHOC AEAD algorithm.</t> <t>where the last value is the nonce length in bytes for the EDHOC AEAD algorithm.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for IV_3 (CBOR Sequence) (36 bytes) info for IV_3 (CBOR Sequence) (36 bytes)
04 58 20 e0 91 12 1a f5 ac 6c e2 14 5d 48 25 e0 90 12 f2 97 98 e8 f7 04 58 20 5b 7d f9 b4 f5 8f 24 0c e0 41 8e 48 19 1b 5f ff 3a 22 b5 ca
13 ac 98 91 43 2d 22 56 b6 f6 78 e9 0d 57 f6 69 b1 67 77 99 65 92 e9 28 bc 0d
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
IV_3 (Raw Value) (13 bytes) IV_3 (Raw Value) (13 bytes)
b6 a7 79 c4 b0 e7 40 fd 8d 77 4d 0a d6 38 d8 c6 4c 56 25 5a ff a4 49 f4 be d7
]]></artwork> ]]></artwork>
<t>The Initiator calculates CIPHERTEXT_3 as 'ciphertext' of COSE_Encrypt 0 applied <t>The Initiator calculates CIPHERTEXT_3 as 'ciphertext' of COSE_Encrypt 0 applied
using the EDHOC AEAD algorithm with plaintext PLAINTEXT_3, additional data using the EDHOC AEAD algorithm with plaintext PLAINTEXT_3, additional data
A_3, key K_3 and nonce IV_3.</t> A_3, key K_3, and nonce IV_3.</t>
<artwork><![CDATA[ <artwork><![CDATA[
CIPHERTEXT_3 (Raw Value) (88 bytes) CIPHERTEXT_3 (Raw Value) (88 bytes)
aa 96 6a 1a a4 fa 44 9a 17 2a 16 0b 96 e6 44 f6 a3 33 29 f2 7c 6a f5 25 c3 45 88 4a aa eb 22 c5 27 f9 b1 d2 b6 78 72 07 e0 16 3c 69 b6 2a
bb ef c6 11 58 d0 ad dd 99 06 9b 9a 19 7f f7 c9 0e 62 f3 b5 56 64 c5 0d 43 92 81 50 42 72 03 c3 16 74 e4 51 4e a6 e3 83 b5 66 eb 29 76 3e
83 74 7b 9a 40 2c cd 68 90 7f e4 58 b1 6a d5 2d 63 a0 0e 5a 85 df 95 fe b0 af a5 18 77 6a e1 c6 5f 85 6d 84 bf 32 af 3a 78 36 97 04 66 dc
ee 7b 1b 49 8a c9 83 42 00 8c 04 71 c1 ae 8d 75 82 50 44 b7 1f 76 74 5d 39 d3 02 5e 77 03 e0 c0 32 eb ad 51 94 7c
]]></artwork> ]]></artwork>
<t>message_3 is the CBOR bstr encoding of CIPHERTEXT_3:</t> <t>message_3 is the CBOR bstr encoding of CIPHERTEXT_3:</t>
<artwork><![CDATA[ <artwork><![CDATA[
message_3 (CBOR Sequence) (90 bytes) message_3 (CBOR Sequence) (90 bytes)
58 58 aa 96 6a 1a a4 fa 44 9a 17 2a 16 0b 96 e6 44 f6 a3 33 29 f2 7c 58 58 25 c3 45 88 4a aa eb 22 c5 27 f9 b1 d2 b6 78 72 07 e0 16 3c 69
6a f5 bb ef c6 11 58 d0 ad dd 99 06 9b 9a 19 7f f7 c9 0e 62 f3 b5 56 b6 2a 0d 43 92 81 50 42 72 03 c3 16 74 e4 51 4e a6 e3 83 b5 66 eb 29
64 c5 83 74 7b 9a 40 2c cd 68 90 7f e4 58 b1 6a d5 2d 63 a0 0e 5a 85 76 3e fe b0 af a5 18 77 6a e1 c6 5f 85 6d 84 bf 32 af 3a 78 36 97 04
df 95 ee 7b 1b 49 8a c9 83 42 00 8c 04 71 c1 ae 8d 75 82 50 44 66 dc b7 1f 76 74 5d 39 d3 02 5e 77 03 e0 c0 32 eb ad 51 94 7c
]]></artwork> ]]></artwork>
<t>The transcript hash TH_4 is calculated using the EDHOC hash algorithm :</t> <t>The transcript hash TH_4 is calculated using the EDHOC hash algorithm :</t>
<t>TH_4 = H( TH_3, PLAINTEXT_3, CRED_I )</t> <t>TH_4 = H( TH_3, PLAINTEXT_3, CRED_I )</t>
<artwork><![CDATA[ <artwork><![CDATA[
Input to calculate TH_4 (CBOR Sequence) (357 bytes) Input to calculate TH_4 (CBOR Sequence) (357 bytes)
58 20 e0 91 12 1a f5 ac 6c e2 14 5d 48 25 e0 90 12 f2 97 98 e8 f7 13 58 20 5b 7d f9 b4 f5 8f 24 0c e0 41 8e 48 19 1b 5f ff 3a 22 b5 ca 57
ac 98 91 43 2d 22 56 b6 f6 78 e9 a1 18 22 82 2e 48 c2 4a b2 fd 76 43 f6 69 b1 67 77 99 65 92 e9 28 bc a1 18 22 82 2e 48 c2 4a b2 fd 76 43
c7 9f 58 40 fc 10 7e c0 0f 74 ba 31 47 40 04 da 60 c5 b0 e1 eb 18 37 c7 9f 58 40 96 e1 cd 5f ce ad fa c1 b5 af 81 94 43 f7 09 24 f5 71 99
c0 f2 1e 00 81 6f bd bb e9 75 a8 05 68 3d 12 69 5b 1f a4 dc 71 f6 4c 55 95 7f d0 26 55 be b4 77 5e 1a 73 18 6a 0d 1d 3e a6 83 f0 8f 8d 03
6e 9e e9 32 0a 19 19 85 57 41 e2 7a 16 02 97 8a 13 4f 3e 57 4f 06 58 dc ec b9 cf 15 4e 1c 6f 55 5a 1e 12 ca 11 8c e4 2b db a6 87 89 07 58
f1 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 9e a0 30 05 06 03 2b f1 30 81 ee 30 81 a1 a0 03 02 01 02 02 04 62 31 9e a0 30 05 06 03 2b
65 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 44 48 4f 43 20 52 6f 65 70 30 1d 31 1b 30 19 06 03 55 04 03 0c 12 45 44 48 4f 43 20 52 6f
6f 74 20 45 64 32 35 35 31 39 30 1e 17 0d 32 32 30 33 31 36 30 38 32 6f 74 20 45 64 32 35 35 31 39 30 1e 17 0d 32 32 30 33 31 36 30 38 32
34 30 30 5a 17 0d 32 39 31 32 33 31 32 33 30 30 30 30 5a 30 22 31 20 34 30 30 5a 17 0d 32 39 31 32 33 31 32 33 30 30 30 30 5a 30 22 31 20
30 1e 06 03 55 04 03 0c 17 45 44 48 4f 43 20 49 6e 69 74 69 61 74 6f 30 1e 06 03 55 04 03 0c 17 45 44 48 4f 43 20 49 6e 69 74 69 61 74 6f
72 20 45 64 32 35 35 31 39 30 2a 30 05 06 03 2b 65 70 03 21 00 ed 06 72 20 45 64 32 35 35 31 39 30 2a 30 05 06 03 2b 65 70 03 21 00 ed 06
a8 ae 61 a8 29 ba 5f a5 45 25 c9 d0 7f 48 dd 44 a3 02 f4 3e 0f 23 d8 a8 ae 61 a8 29 ba 5f a5 45 25 c9 d0 7f 48 dd 44 a3 02 f4 3e 0f 23 d8
cc 20 b7 30 85 14 1e 30 05 06 03 2b 65 70 03 41 00 52 12 41 d8 b3 a7 cc 20 b7 30 85 14 1e 30 05 06 03 2b 65 70 03 41 00 52 12 41 d8 b3 a7
70 99 6b cf c9 b9 ea d4 e7 e0 a1 c0 db 35 3a 3b df 29 10 b3 92 75 ae 70 99 6b cf c9 b9 ea d4 e7 e0 a1 c0 db 35 3a 3b df 29 10 b3 92 75 ae
48 b7 56 01 59 81 85 0d 27 db 67 34 e3 7f 67 21 22 67 dd 05 ee ff 27 48 b7 56 01 59 81 85 0d 27 db 67 34 e3 7f 67 21 22 67 dd 05 ee ff 27
b9 e7 a8 13 fa 57 4b 72 a0 0b 43 0b b9 e7 a8 13 fa 57 4b 72 a0 0b 43 0b
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
TH_4 (Raw Value) (32 bytes) TH_4 (Raw Value) (32 bytes)
6b 13 32 5a 49 bd 9f 97 0d 31 91 ee 31 79 62 df 1d 44 38 c6 64 15 ea 0e b8 68 f2 63 cf 35 55 dc cd 39 6d d8 de c2 9d 37 50 d5 99 be 42 d5
a4 ce dd 62 b5 b4 9d 7b b7 a4 1a 5a 37 c8 96 f2 94 ac
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
TH_4 (CBOR Data Item) (34 bytes) TH_4 (CBOR Data Item) (34 bytes)
58 20 6b 13 32 5a 49 bd 9f 97 0d 31 91 ee 31 79 62 df 1d 44 38 c6 64 58 20 0e b8 68 f2 63 cf 35 55 dc cd 39 6d d8 de c2 9d 37 50 d5 99 be
15 ea a4 ce dd 62 b5 b4 9d 7b b7 42 d5 a4 1a 5a 37 c8 96 f2 94 ac
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="message4"> <section anchor="message4">
<name>message_4</name> <name>message_4</name>
<t>No external authorization data:</t> <t>No external authorization data:</t>
<artwork><![CDATA[ <artwork><![CDATA[
EAD_4 (CBOR Sequence) (0 bytes) EAD_4 (CBOR Sequence) (0 bytes)
]]></artwork> ]]></artwork>
<t>The Responder constructs PLAINTEXT_4:</t> <t>The Responder constructs PLAINTEXT_4:</t>
<artwork><![CDATA[ <artwork><![CDATA[
PLAINTEXT_4 = PLAINTEXT_4 =
( (
? EAD_4 ? EAD_4
) )
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
PLAINTEXT_4 (CBOR Sequence) (0 bytes) PLAINTEXT_4 (CBOR Sequence) (0 bytes)
]]></artwork> ]]></artwork>
<t>The Responder constructs the associated data for message_4:</t> <t>The Responder constructs the associated data for message_4:</t>
<artwork><![CDATA[ <artwork><![CDATA[
A_4 = A_4 =
[ [
"Encrypt0", "Encrypt0",
h'', h'',
h'6b13325a49bd9f970d3191ee317962df1d4438c66415eaa4 h'0eb868f263cf3555dccd396dd8dec29d3750d599be42d5a4
cedd62b5b49d7bb7' 1a5a37c896f294ac'
] ]
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
A_4 (CBOR Data Item) (45 bytes) A_4 (CBOR Data Item) (45 bytes)
83 68 45 6e 63 72 79 70 74 30 40 58 20 6b 13 32 5a 49 bd 9f 97 0d 31 83 68 45 6e 63 72 79 70 74 30 40 58 20 0e b8 68 f2 63 cf 35 55 dc cd
91 ee 31 79 62 df 1d 44 38 c6 64 15 ea a4 ce dd 62 b5 b4 9d 7b b7 39 6d d8 de c2 9d 37 50 d5 99 be 42 d5 a4 1a 5a 37 c8 96 f2 94 ac
]]></artwork> ]]></artwork>
<t>The Responder constructs the input needed to derive the EDHOC message _4 key, see <xref section="4.1.2" sectionFormat="of" target="I-D.ietf-lake-edhoc "/>, using the EDHOC hash algorithm:</t> <t>The Responder constructs the input needed to derive the EDHOC message _4 key (see <xref section="4.1.2" sectionFormat="of" target="RFC9528"/>) using t he EDHOC hash algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
K_4 = EDHOC_KDF( PRK_4e3m, 8, TH_4, key_length ) K_4 = EDHOC_KDF( PRK_4e3m, 8, TH_4, key_length )
= HKDF-Expand( PRK_4x3m, info, key_length ) = HKDF-Expand( PRK_4e3m, info, key_length )
]]></artwork> ]]></artwork>
<t>where key_length is the key length in bytes for the EDHOC AEAD algori thm, <t>where key_length is the key length in bytes for the EDHOC AEAD algori thm,
and info for K_4 is:</t> and info for K_4 is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
8, 8,
h'6b13325a49bd9f970d3191ee317962df1d4438c66415eaa4 h'0eb868f263cf3555dccd396dd8dec29d3750d599be42d5a4
cedd62b5b49d7bb7', 1a5a37c896f294ac',
16 16
) )
]]></artwork> ]]></artwork>
<t>where the last value is the key length in bytes for the EDHOC AEAD al gorithm.</t> <t>where the last value is the key length in bytes for the EDHOC AEAD al gorithm.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for K_4 (CBOR Sequence) (36 bytes) info for K_4 (CBOR Sequence) (36 bytes)
08 58 20 6b 13 32 5a 49 bd 9f 97 0d 31 91 ee 31 79 62 df 1d 44 38 c6 08 58 20 0e b8 68 f2 63 cf 35 55 dc cd 39 6d d8 de c2 9d 37 50 d5 99
64 15 ea a4 ce dd 62 b5 b4 9d 7b b7 10 be 42 d5 a4 1a 5a 37 c8 96 f2 94 ac 10
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
K_4 (Raw Value) (16 bytes) K_4 (Raw Value) (16 bytes)
c9 f5 87 9d dd 4e 25 68 f6 94 46 c3 06 52 5f ef df 8c b5 86 1e 1f df ed d3 b2 30 15 a3 9d 1e 2e
]]></artwork> ]]></artwork>
<t>The Responder constructs the input needed to derive the EDHOC message _4 nonce, see <xref section="4.1.2" sectionFormat="of" target="I-D.ietf-lake-edh oc"/>, using the EDHOC hash algorithm:</t> <t>The Responder constructs the input needed to derive the EDHOC message _4 nonce (see <xref section="4.1.2" sectionFormat="of" target="RFC9528"/>) using the EDHOC hash algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
IV_4 = EDHOC_KDF( PRK_4e3m, 9, TH_4, iv_length ) IV_4 = EDHOC_KDF( PRK_4e3m, 9, TH_4, iv_length )
= HKDF-Expand( PRK_4x3m, info, iv_length ) = HKDF-Expand( PRK_4e3m, info, iv_length )
]]></artwork> ]]></artwork>
<t>where length is the nonce length in bytes for the EDHOC AEAD algorith m, <t>where length is the nonce length in bytes for the EDHOC AEAD algorith m,
and info for IV_4 is:</t> and info for IV_4 is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
9, 9,
h'6b13325a49bd9f970d3191ee317962df1d4438c66415eaa4 h'0eb868f263cf3555dccd396dd8dec29d3750d599be42d5a4
cedd62b5b49d7bb7', 1a5a37c896f294ac',
13 13
) )
]]></artwork> ]]></artwork>
<t>where the last value is the nonce length in bytes for the EDHOC AEAD algorithm.</t> <t>where the last value is the nonce length in bytes for the EDHOC AEAD algorithm.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for IV_4 (CBOR Sequence) (36 bytes) info for IV_4 (CBOR Sequence) (36 bytes)
09 58 20 6b 13 32 5a 49 bd 9f 97 0d 31 91 ee 31 79 62 df 1d 44 38 c6 09 58 20 0e b8 68 f2 63 cf 35 55 dc cd 39 6d d8 de c2 9d 37 50 d5 99
64 15 ea a4 ce dd 62 b5 b4 9d 7b b7 0d be 42 d5 a4 1a 5a 37 c8 96 f2 94 ac 0d
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
IV_4 (Raw Value) (13 bytes) IV_4 (Raw Value) (13 bytes)
a8 e0 4c e7 56 ee 38 e8 23 b7 7b 3e e0 12 8e c6 58 d9 70 d7 38 0f 74 fc 6c 27
]]></artwork> ]]></artwork>
<t>The Responder calculates CIPHERTEXT_4 as 'ciphertext' of COSE_Encrypt 0 applied <t>The Responder calculates CIPHERTEXT_4 as 'ciphertext' of COSE_Encrypt 0 applied
using the EDHOC AEAD algorithm with plaintext PLAINTEXT_4, additional data using the EDHOC AEAD algorithm with plaintext PLAINTEXT_4, additional data
A_4, key K_4 and nonce IV_4.</t> A_4, key K_4, and nonce IV_4.</t>
<artwork><![CDATA[ <artwork><![CDATA[
CIPHERTEXT_4 (8 bytes) CIPHERTEXT_4 (8 bytes)
ee 12 0e 8b 5e 2a 00 8f 4f 0e de e3 66 e5 c8 83
]]></artwork> ]]></artwork>
<t>message_4 is the CBOR bstr encoding of CIPHERTEXT_4:</t> <t>message_4 is the CBOR bstr encoding of CIPHERTEXT_4:</t>
<artwork><![CDATA[ <artwork><![CDATA[
message_4 (CBOR Sequence) (9 bytes) message_4 (CBOR Sequence) (9 bytes)
48 ee 12 0e 8b 5e 2a 00 8f 48 4f 0e de e3 66 e5 c8 83
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="out-and-exporter1"> <section anchor="out-and-exporter1">
<name>PRK_out and PRK_exporter</name> <name>PRK_out and PRK_exporter</name>
<t>PRK_out is specified in <xref section="4.1.3" sectionFormat="of" targ et="I-D.ietf-lake-edhoc"/>.</t> <t>PRK_out is specified in <xref section="4.1.3" sectionFormat="of" targ et="RFC9528"/>.</t>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_out = EDHOC_KDF( PRK_4e3m, 7, TH_4, hash_length ) = PRK_out = EDHOC_KDF( PRK_4e3m, 7, TH_4, hash_length )
= HKDF-Expand( PRK_4e3m, info, hash_length ) = HKDF-Expand( PRK_4e3m, info, hash_length )
]]></artwork> ]]></artwork>
<t>where hash_length is the length in bytes of the output of the EDHOC h ash algorithm, and info for PRK_out is:</t> <t>where hash_length is the length in bytes of the output of the EDHOC h ash algorithm, and info for PRK_out is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
7, 7,
h'6b13325a49bd9f970d3191ee317962df1d4438c66415eaa4 h'0eb868f263cf3555dccd396dd8dec29d3750d599be42d5a4
cedd62b5b49d7bb7', 1a5a37c896f294ac',
32 32
) )
]]></artwork> ]]></artwork>
<t>where the last value is the length in bytes of the output of the EDHO C hash algorithm.</t> <t>where the last value is the length in bytes of the output of the EDHO C hash algorithm.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for PRK_out (CBOR Sequence) (37 bytes) info for PRK_out (CBOR Sequence) (37 bytes)
07 58 20 6b 13 32 5a 49 bd 9f 97 0d 31 91 ee 31 79 62 df 1d 44 38 c6 07 58 20 0e b8 68 f2 63 cf 35 55 dc cd 39 6d d8 de c2 9d 37 50 d5 99
64 15 ea a4 ce dd 62 b5 b4 9d 7b b7 18 20 be 42 d5 a4 1a 5a 37 c8 96 f2 94 ac 18 20
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_out (Raw Value) (32 bytes) PRK_out (Raw Value) (32 bytes)
45 06 92 9a d5 95 d5 d4 e5 9b 5f 21 ea b6 7d ea b6 4a 3b d2 c7 d9 d6 b7 44 cb 7d 8a 87 cc 04 47 c3 35 0e 16 5b 25 0d ab 12 ec 45 33 25 ab
87 7d 60 61 81 9c 2d 02 0d b9 22 b3 03 07 e5 c3 68 f0
]]></artwork> ]]></artwork>
<t>The OSCORE Master Secret and OSCORE Master Salt are derived with the EDHOC_Exporter as specified in <xref section="4.2.1" sectionFormat="of" target=" I-D.ietf-lake-edhoc"/>.</t> <t>The Object Security for Constrained RESTful Environments (OSCORE) Mas ter Secret and OSCORE Master Salt are derived with the EDHOC_Exporter as specifi ed in <xref section="4.2.1" sectionFormat="of" target="RFC9528"/>.</t>
<artwork><![CDATA[ <artwork><![CDATA[
EDHOC_Exporter( label, context, length ) EDHOC_Exporter( exporter_label, context, length )
= EDHOC_KDF( PRK_exporter, label, context, length ) = EDHOC_KDF( PRK_exporter, exporter_label, context, length )
]]></artwork> ]]></artwork>
<t>where PRK_exporter is derived from PRK_out:</t> <t>where PRK_exporter is derived from PRK_out:</t>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_exporter = EDHOC_KDF( PRK_out, 10, h'', hash_length ) = PRK_exporter = EDHOC_KDF( PRK_out, 10, h'', hash_length )
= HKDF-Expand( PRK_out, info, hash_length ) = HKDF-Expand( PRK_out, info, hash_length )
]]></artwork> ]]></artwork>
<t>where hash_length is the length in bytes of the output of the EDHOC h ash algorithm, and info for the PRK_exporter is:</t> <t>where hash_length is the length in bytes of the output of the EDHOC h ash algorithm, and info for the PRK_exporter is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
10, 10,
h'', h'',
32 32
) )
]]></artwork> ]]></artwork>
<t>where the last value is the length in bytes of the output of the EDHO C hash algorithm.</t> <t>where the last value is the length in bytes of the output of the EDHO C hash algorithm.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for PRK_exporter (CBOR Sequence) (4 bytes) info for PRK_exporter (CBOR Sequence) (4 bytes)
0a 40 18 20 0a 40 18 20
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_exporter (Raw Value) (32 bytes) PRK_exporter (Raw Value) (32 bytes)
ad 33 a8 f2 e0 6f ff 3e 5d 7e e1 10 9e db f2 b6 d2 56 4c b3 f4 08 68 2a ae c8 fc 4a b3 bc 32 95 de f6 b5 51 05 1a 2f a5 61 42 4d b3 01 fa
e6 46 11 e4 20 92 4c e4 09 84 f6 42 f5 57 8a 6d f5 1a
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="oscore-param"> <section anchor="oscore-param">
<name>OSCORE Parameters</name> <name>OSCORE Parameters</name>
<t>The derivation of OSCORE parameters is specified in <xref section="A. <t>The derivation of OSCORE parameters is specified in <xref section="A.
1" sectionFormat="of" target="I-D.ietf-lake-edhoc"/>.</t> 1" sectionFormat="of" target="RFC9528"/>.</t>
<t>The AEAD and Hash algorithms to use in OSCORE are given by the select <t>The AEAD and hash algorithms to use in OSCORE are given by the select
ed cipher suite:</t> ed cipher suite:</t>
<artwork><![CDATA[ <artwork><![CDATA[
Application AEAD Algorithm (int) Application AEAD Algorithm (int)
10 10
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Application Hash Algorithm (int) Application Hash Algorithm (int)
-16 -16
]]></artwork> ]]></artwork>
<t>The mapping from EDHOC connection identifiers to OSCORE Sender/Recipi ent IDs is defined in <xref section="3.3.3" sectionFormat="of" target="I-D.ietf- lake-edhoc"/>.</t> <t>The mapping from EDHOC connection identifiers to OSCORE Sender/Recipi ent IDs is defined in <xref section="3.3.3" sectionFormat="of" target="RFC9528"/ >.</t>
<t>C_R is mapped to the Recipient ID of the server, i.e., the Sender ID of the client. The byte string 0x18, which as C_R is encoded as the CBOR byte st ring 0x4118, is converted to the server Recipient ID 0x18.</t> <t>C_R is mapped to the Recipient ID of the server, i.e., the Sender ID of the client. The byte string 0x18, which as C_R is encoded as the CBOR byte st ring 0x4118, is converted to the server Recipient ID 0x18.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Client's OSCORE Sender ID (Raw Value) (1 byte) Client's OSCORE Sender ID (Raw Value) (1 byte)
18 18
]]></artwork> ]]></artwork>
<t>C_I is mapped to the Recipient ID of the client, i.e., the Sender ID of the server. The byte string 0x2d, which as C_I is encoded as the CBOR integer 0x2d is converted to the client Recipient ID 0x2d.</t> <t>C_I is mapped to the Recipient ID of the client, i.e., the Sender ID of the server. The byte string 0x2d, which as C_I is encoded as the CBOR integer 0x2d, is converted to the client Recipient ID 0x2d.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Server's OSCORE Sender ID (Raw Value) (1 byte) Server's OSCORE Sender ID (Raw Value) (1 byte)
2d 2d
]]></artwork> ]]></artwork>
<t>The OSCORE Master Secret is computed through EDHOC_Expand() using the <t>The OSCORE Master Secret is computed through EDHOC_Expand() using the
Application hash algorithm, see <xref section="A.1" sectionFormat="of" target="I -D.ietf-lake-edhoc"/>:</t> application hash algorithm (see <xref section="A.1" sectionFormat="of" target="R FC9528"/>):</t>
<artwork><![CDATA[ <artwork><![CDATA[
OSCORE Master Secret = EDHOC_Exporter( 0, h'', oscore_key_length ) OSCORE Master Secret = EDHOC_Exporter( 0, h'', oscore_key_length )
= EDHOC_KDF( PRK_exporter, 0, h'', oscore_key_length ) = EDHOC_KDF( PRK_exporter, 0, h'', oscore_key_length )
= HKDF-Expand( PRK_exporter, info, oscore_key_length ) = HKDF-Expand( PRK_exporter, info, oscore_key_length )
]]></artwork> ]]></artwork>
<t>where oscore_key_length is by default the key length in bytes for the <t>where oscore_key_length is the key length in bytes for the applicatio
Application AEAD n AEAD
algorithm, and info for the OSCORE Master Secret is:</t> algorithm by default, and info for the OSCORE Master Secret is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
0, 0,
h'', h'',
16 16
) )
]]></artwork> ]]></artwork>
<t>where the last value is the key length in bytes for the Application A EAD algorithm.</t> <t>where the last value is the key length in bytes for the application A EAD algorithm.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for OSCORE Master Secret (CBOR Sequence) (3 bytes) info for OSCORE Master Secret (CBOR Sequence) (3 bytes)
00 40 10 00 40 10
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
OSCORE Master Secret (Raw Value) (16 bytes) OSCORE Master Secret (Raw Value) (16 bytes)
fc 9c fb 05 63 ca 3e 28 f8 80 48 3b 9c 06 bd 03 1e 1c 6b ea c3 a8 a1 ca c4 35 de 7e 2f 9a e7 ff
]]></artwork> ]]></artwork>
<t>The OSCORE Master Salt is computed through EDHOC_Expand() using the A pplication hash algorithm, see <xref section="4.2" sectionFormat="of" target="I- D.ietf-lake-edhoc"/>:</t> <t>The OSCORE Master Salt is computed through EDHOC_Expand() using the a pplication hash algorithm (see <xref section="4.2" sectionFormat="of" target="RF C9528"/>):</t>
<artwork><![CDATA[ <artwork><![CDATA[
OSCORE Master Salt = EDHOC_Exporter( 1, h'', oscore_salt_length ) OSCORE Master Salt = EDHOC_Exporter( 1, h'', oscore_salt_length )
= EDHOC_KDF( PRK_exporter, 1, h'', oscore_salt_length ) = EDHOC_KDF( PRK_exporter, 1, h'', oscore_salt_length )
= HKDF-Expand( PRK_4x3m, info, oscore_salt_length ) = HKDF-Expand( PRK_exporter, info, oscore_salt_length )
]]></artwork> ]]></artwork>
<t>where oscore_salt_length is the length in bytes of the OSCORE Master Salt, and info for the OSCORE Master Salt is:</t> <t>where oscore_salt_length is the length in bytes of the OSCORE Master Salt, and info for the OSCORE Master Salt is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
1, 1,
h'', h'',
8 8
) )
]]></artwork> ]]></artwork>
<t>where the last value is the length in bytes of the OSCORE Master Salt .</t> <t>where the last value is the length in bytes of the OSCORE Master Salt .</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for OSCORE Master Salt (CBOR Sequence) (3 bytes) info for OSCORE Master Salt (CBOR Sequence) (3 bytes)
01 40 08 01 40 08
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
OSCORE Master Salt (Raw Value) (8 bytes) OSCORE Master Salt (Raw Value) (8 bytes)
0e c0 9d 45 3b 08 98 34 ce 7a b8 44 c0 10 6d 73
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="key-update"> <section anchor="key-update">
<name>Key Update</name> <name>Key Update</name>
<t>Key update is defined in <xref section="H" sectionFormat="of" target= "I-D.ietf-lake-edhoc"/>.</t> <t>Key update is defined in <xref section="H" sectionFormat="of" target= "RFC9528"/>.</t>
<artwork><![CDATA[ <artwork><![CDATA[
EDHOC_KeyUpdate( context ): EDHOC_KeyUpdate( context ):
PRK_out = EDHOC_KDF( PRK_out, 11, context, hash_length ) PRK_out = EDHOC_KDF( PRK_out, 11, context, hash_length )
= HKDF-Expand( PRK_out, info, hash_length ) = HKDF-Expand( PRK_out, info, hash_length )
]]></artwork> ]]></artwork>
<t>where hash_length is the length in bytes of the output of the EDHOC h ash function, and context for KeyUpdate is</t> <t>where hash_length is the length in bytes of the output of the EDHOC h ash function, and the context for KeyUpdate is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
context for KeyUpdate (Raw Value) (16 bytes) context for KeyUpdate (Raw Value) (16 bytes)
d6 be 16 96 02 b8 bc ea a0 11 58 fd b8 20 89 0c d6 be 16 96 02 b8 bc ea a0 11 58 fd b8 20 89 0c
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
context for KeyUpdate (CBOR Data Item) (17 bytes) context for KeyUpdate (CBOR Data Item) (17 bytes)
50 d6 be 16 96 02 b8 bc ea a0 11 58 fd b8 20 89 0c 50 d6 be 16 96 02 b8 bc ea a0 11 58 fd b8 20 89 0c
]]></artwork> ]]></artwork>
<t>and where info for key update is:</t> <t>where info for KeyUpdate is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
11, 11,
h'd6be169602b8bceaa01158fdb820890c', h'd6be169602b8bceaa01158fdb820890c',
32 32
) )
]]></artwork>
<artwork><![CDATA[
info for KeyUpdate (CBOR Sequence) (20 bytes)
0b 50 d6 be 16 96 02 b8 bc ea a0 11 58 fd b8 20 89 0c 18 20
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_out after KeyUpdate (Raw Value) (32 bytes) PRK_out after KeyUpdate (Raw Value) (32 bytes)
0c 1d e2 f0 6d 9a d7 5a 21 32 90 5f 95 c6 96 40 42 76 af 81 f1 14 4a da 6e ac d9 a9 85 f4 fb a9 ae c2 a9 29 90 22 97 6b 25 b1 4e 89 fa 15
a7 61 af bf 78 d6 8c a1 b4 97 94 f2 8d 82 fa f2 da ad
]]></artwork> ]]></artwork>
<t>After key update, the PRK_exporter needs to be derived anew:</t> <t>After the key update, the PRK_exporter needs to be derived anew:</t>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_exporter = EDHOC_KDF( PRK_out, 10, h'', hash_length ) = PRK_exporter = EDHOC_KDF( PRK_out, 10, h'', hash_length )
= HKDF-Expand( PRK_out, info, hash_length ) = HKDF-Expand( PRK_out, info, hash_length )
]]></artwork> ]]></artwork>
<t>where info and hash_length are unchanged as in <xref target="out-and- exporter1"/>.</t> <t>where info and hash_length are unchanged as in <xref target="out-and- exporter1"/>.</t>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_exporter (Raw Value) (32 bytes) PRK_exporter after KeyUpdate (Raw Value) (32 bytes)
f0 4e 4c 40 1d e8 db 34 f7 b5 06 b2 33 10 9a 24 c4 9c 4b 09 65 d0 7c 00 14 d2 52 5e e0 d8 e2 13 ea 59 08 02 8e 9a 1c e9 a0 1c 30 54 6f 09
6e 47 7b 23 a3 7b 53 c2 35 30 c0 44 d3 8d b5 36 2c 05
]]></artwork> ]]></artwork>
<t>The OSCORE Master Secret is derived with the updated PRK_exporter:</t > <t>The OSCORE Master Secret is derived with the updated PRK_exporter:</t >
<artwork><![CDATA[ <artwork><![CDATA[
OSCORE Master Secret = OSCORE Master Secret
= HKDF-Expand(PRK_exporter, info, oscore_key_length) = HKDF-Expand( PRK_exporter, info, oscore_key_length )
]]></artwork> ]]></artwork>
<t>where info and key_length are unchanged as in <xref target="oscore-pa ram"/>.</t> <t>where info and oscore_key_length are unchanged as in <xref target="os core-param"/>.</t>
<artwork><![CDATA[ <artwork><![CDATA[
OSCORE Master Secret after KeyUpdate (Raw Value) (16 bytes) OSCORE Master Secret after KeyUpdate (Raw Value) (16 bytes)
50 48 6d 75 82 3a 59 2d 1e fd 28 6a 70 7f e8 7d ee 0f f5 42 c4 7e b0 e0 9c 69 30 76 49 bd bb e5
]]></artwork> ]]></artwork>
<t>The OSCORE Master Salt is derived with the updated PRK_exporter:</t> <t>The OSCORE Master Salt is derived with the updated PRK_exporter:</t>
<artwork><![CDATA[ <artwork><![CDATA[
OSCORE Master Salt = HKDF-Expand(PRK_exporter, info, salt_length) OSCORE Master Salt = HKDF-Expand( PRK_exporter, info, oscore_salt_length )
]]></artwork> ]]></artwork>
<t>where info and salt_length are unchanged as in <xref target="oscore-p aram"/>.</t> <t>where info and oscore_salt_length are unchanged as in <xref target="o score-param"/>.</t>
<artwork><![CDATA[ <artwork><![CDATA[
OSCORE Master Salt after KeyUpdate (Raw Value) (8 bytes) OSCORE Master Salt after KeyUpdate (Raw Value) (8 bytes)
61 95 cb b1 ce 03 1c ae 80 ce de 2a 1e 5a ab 48
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="certs"> <section anchor="certs">
<name>Certificates</name> <name>Certificates</name>
<section anchor="resp-cer"> <section anchor="resp-cer">
<name>Responder Certificate</name> <name>Responder Certificate</name>
<artwork><![CDATA[ <artwork><![CDATA[
Version: 3 (0x2) Version: 3 (0x2)
Serial Number: 1647419076 (0x62319ec4) Serial Number: 1647419076 (0x62319ec4)
Signature Algorithm: ED25519 Signature Algorithm: ED25519
skipping to change at line 1311 skipping to change at line 1342
4b b5 2b bf 15 39 b7 1a 4a af 42 97 78 f2 9e da 7e 81 4b b5 2b bf 15 39 b7 1a 4a af 42 97 78 f2 9e da 7e 81
46 80 69 8f 16 c4 8f 2a 6f a4 db e8 25 41 c5 82 07 ba 46 80 69 8f 16 c4 8f 2a 6f a4 db e8 25 41 c5 82 07 ba
1b c9 cd b0 c2 fa 94 7f fb f0 f0 ec 0e e9 1a 7f f3 7a 1b c9 cd b0 c2 fa 94 7f fb f0 f0 ec 0e e9 1a 7f f3 7a
94 d9 25 1f a5 cd f1 e6 7a 0f 94 d9 25 1f a5 cd f1 e6 7a 0f
]]></artwork> ]]></artwork>
</section> </section>
</section> </section>
</section> </section>
<section anchor="sec-trace-2"> <section anchor="sec-trace-2">
<name>Authentication with Static DH, CCS Identified by 'kid'</name> <name>Authentication with Static DH, CCS Identified by 'kid'</name>
<t>In this example the Initiator and the Responder are authenticated with ephemeral-static Diffie-Hellman (METHOD = 3). The Initiator supports cipher suit es 6 and 2 (in order of preference) and the Responder only supports cipher suite 2. After an initial negotiation message exchange, cipher suite 2 is used, which determines the algorithms:</t> <t>In this example, the Initiator and the Responder are authenticated with ephemeral-static Diffie-Hellman (METHOD = 3). The Initiator supports cipher sui tes 6 and 2 (in order of preference), and the Responder only supports cipher sui te 2. After an initial negotiation message exchange, cipher suite 2 is used, whi ch determines the algorithms:</t>
<ul spacing="normal"> <ul spacing="normal">
<li>EDHOC AEAD algorithm = AES-CCM-16-64-128</li> <li>EDHOC AEAD algorithm = AES-CCM-16-64-128</li>
<li>EDHOC hash algorithm = SHA-256</li> <li>EDHOC hash algorithm = SHA-256</li>
<li>EDHOC MAC length in bytes (Static DH) = 8</li> <li>EDHOC MAC length in bytes (Static DH) = 8</li>
<li>EDHOC key exchange algorithm (ECDH curve) = P-256</li> <li>EDHOC key exchange algorithm (ECDH curve) = P-256</li>
<li>EDHOC signature algorithm = ES256</li> <li>EDHOC signature algorithm = ES256</li>
<li>Application AEAD algorithm = AES-CCM-16-64-128</li> <li>application AEAD algorithm = AES-CCM-16-64-128</li>
<li>Application hash algorithm = SHA-256</li> <li>application hash algorithm = SHA-256</li>
</ul> </ul>
<t>The public keys are represented as raw public keys (RPK), encoded in a CWT Claims Set (CCS) and identified by the COSE header parameter 'kid'.</t> <t>The public keys are represented as raw public keys (RPKs), encoded in a CWT Claims Set (CCS) and identified by the COSE header parameter 'kid'.</t>
<section anchor="m1_1"> <section anchor="m1_1">
<name>message_1 (first time)</name> <name>message_1 (First Time)</name>
<t>Both endpoints are authenticated with static DH, i.e., METHOD = 3:</t > <t>Both endpoints are authenticated with static DH, i.e., METHOD = 3:</t >
<artwork><![CDATA[ <artwork><![CDATA[
METHOD (CBOR Data Item) (1 byte) METHOD (CBOR Data Item) (1 byte)
03 03
]]></artwork> ]]></artwork>
<t>The Initiator selects its preferred cipher suite 6. A single cipher s uite is encoded as an int:</t> <t>The Initiator selects its preferred cipher suite 6. A single cipher s uite is encoded as an int:</t>
<artwork><![CDATA[ <artwork><![CDATA[
SUITES_I (CBOR Data Item) (1 byte) SUITES_I (CBOR Data Item) (1 byte)
06 06
]]></artwork> ]]></artwork>
skipping to change at line 1353 skipping to change at line 1384
G_X (Raw Value) (32 bytes) G_X (Raw Value) (32 bytes)
74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b ea 5b 3d 8f 65 f3 26 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b ea 5b 3d 8f 65 f3 26
20 b7 49 be e8 d2 78 ef a9 20 b7 49 be e8 d2 78 ef a9
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Initiator's ephemeral public key, 'x'-coordinate Initiator's ephemeral public key, 'x'-coordinate
G_X (CBOR Data Item) (34 bytes) G_X (CBOR Data Item) (34 bytes)
58 20 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b ea 5b 3d 8f 65 58 20 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b ea 5b 3d 8f 65
f3 26 20 b7 49 be e8 d2 78 ef a9 f3 26 20 b7 49 be e8 d2 78 ef a9
]]></artwork> ]]></artwork>
<t>The Initiator selects its connection identifier C_I to be the byte st ring 0x0e, which since it is represented by the 1-byte CBOR int 14 is encoded as 0x0e:</t> <t>The Initiator selects its connection identifier C_I to be the byte st ring 0x0e, which is encoded as 0x0e since it is represented by the 1-byte CBOR i nt 14:</t>
<artwork><![CDATA[ <artwork><![CDATA[
Connection identifier chosen by Initiator Connection identifier chosen by the Initiator
C_I (Raw Value) (1 byte) C_I (Raw Value) (1 byte)
0e 0e
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Connection identifier chosen by Initiator Connection identifier chosen by the Initiator
C_I (CBOR Data Item) (1 byte) C_I (CBOR Data Item) (1 byte)
0e 0e
]]></artwork> ]]></artwork>
<t>No external authorization data:</t> <t>No external authorization data:</t>
<t>EAD_1 (CBOR Sequence) (0 bytes)</t> <artwork><![CDATA[
EAD_1 (CBOR Sequence) (0 bytes)
]]></artwork>
<t>The Initiator constructs message_1:</t> <t>The Initiator constructs message_1:</t>
<artwork><![CDATA[ <artwork><![CDATA[
message_1 = message_1 =
( (
3, 3,
6, 6,
h'741a13d7ba048fbb615e94386aa3b61bea5b3d8f65f32620 h'741a13d7ba048fbb615e94386aa3b61bea5b3d8f65f32620
b749bee8d278efa9', b749bee8d278efa9',
14 14
) )
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
message_1 (CBOR Sequence) (37 bytes) message_1 (CBOR Sequence) (37 bytes)
03 06 58 20 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b ea 5b 3d 03 06 58 20 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b ea 5b 3d
8f 65 f3 26 20 b7 49 be e8 d2 78 ef a9 0e 8f 65 f3 26 20 b7 49 be e8 d2 78 ef a9 0e
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="error"> <section anchor="error">
<name>error</name> <name>error</name>
skipping to change at line 1396 skipping to change at line 1429
<artwork><![CDATA[ <artwork><![CDATA[
SUITES_R SUITES_R
02 02
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
error (CBOR Sequence) (2 bytes) error (CBOR Sequence) (2 bytes)
02 02 02 02
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="message1-second-time"> <section anchor="message1-second-time">
<name>message_1 (second time)</name> <name>message_1 (Second Time)</name>
<t>Same steps are performed as for message_1 the first time, <xref targe <t>Same steps are performed as for message_1 the first time (<xref targe
t="m1_1"/>, but with updated SUITES_I.</t> t="m1_1"/>) but with SUITES_I updated.</t>
<t>Both endpoints are authenticated with static DH, i.e., METHOD = 3:</t > <t>Both endpoints are authenticated with static DH, i.e., METHOD = 3:</t >
<artwork align="left"><![CDATA[ <artwork align="left"><![CDATA[
METHOD (CBOR Data Item) (1 byte) METHOD (CBOR Data Item) (1 byte)
03 03
]]></artwork> ]]></artwork>
<t>The Initiator selects cipher suite 2 and indicates the more preferred cipher suite(s), in this case 6, all encoded as the array [6, 2]:</t> <t>The Initiator selects cipher suite 2 and indicates the more preferred cipher suite(s), in this case 6, all encoded as the array [6, 2]:</t>
<artwork><![CDATA[ <artwork><![CDATA[
SUITES_I (CBOR Data Item) (3 bytes) SUITES_I (CBOR Data Item) (3 bytes)
82 06 02 82 06 02
]]></artwork> ]]></artwork>
skipping to change at line 1433 skipping to change at line 1466
(Raw Value) (32 bytes) (Raw Value) (32 bytes)
51 e8 af 6c 6e db 78 16 01 ad 1d 9c 5f a8 bf 7a a1 57 16 c7 c0 6a 5d 51 e8 af 6c 6e db 78 16 01 ad 1d 9c 5f a8 bf 7a a1 57 16 c7 c0 6a 5d
03 85 03 c6 14 ff 80 c9 b3 03 85 03 c6 14 ff 80 c9 b3
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Initiator's ephemeral public key, 'x'-coordinate Initiator's ephemeral public key, 'x'-coordinate
G_X (CBOR Data Item) (34 bytes) G_X (CBOR Data Item) (34 bytes)
58 20 8a f6 f4 30 eb e1 8d 34 18 40 17 a9 a1 1b f5 11 c8 df f8 f8 34 58 20 8a f6 f4 30 eb e1 8d 34 18 40 17 a9 a1 1b f5 11 c8 df f8 f8 34
73 0b 96 c1 b7 c8 db ca 2f c3 b6 73 0b 96 c1 b7 c8 db ca 2f c3 b6
]]></artwork> ]]></artwork>
<t>The Initiator selects its connection identifier C_I to be the byte st ring 0x37, which since it is represented by the 1-byte CBOR int -24 is encoded a s 0x37:</t> <t>The Initiator selects its connection identifier C_I to be the byte st ring 0x37, which is encoded as 0x37 since it is represented by the 1-byte CBOR i nt -24:</t>
<artwork><![CDATA[ <artwork><![CDATA[
Connection identifier chosen by Initiator Connection identifier chosen by the Initiator
C_I (Raw Value) (1 byte) C_I (Raw Value) (1 byte)
37 37
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Connection identifier chosen by Initiator Connection identifier chosen by the Initiator
C_I (CBOR Data Item) (1 byte) C_I (CBOR Data Item) (1 byte)
37 37
]]></artwork> ]]></artwork>
<t>No external authorization data:</t> <t>No external authorization data:</t>
<artwork><![CDATA[ <artwork><![CDATA[
EAD_1 (CBOR Sequence) (0 bytes) EAD_1 (CBOR Sequence) (0 bytes)
]]></artwork> ]]></artwork>
<t>The Initiator constructs message_1:</t> <t>The Initiator constructs message_1:</t>
<artwork><![CDATA[ <artwork><![CDATA[
message_1 = message_1 =
( (
3, 3,
[6, 2], [6, 2],
h'8af6f430ebe18d34184017a9a11bf511c8dff8f834730b96 h'8af6f430ebe18d34184017a9a11bf511c8dff8f834730b96
c1b7c8dbca2fc3b6', c1b7c8dbca2fc3b6',
-24 -24
) )
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
message_1 (CBOR Sequence) (39 bytes) message_1 (CBOR Sequence) (39 bytes)
03 82 06 02 58 20 8a f6 f4 30 eb e1 8d 34 18 40 17 a9 a1 1b f5 11 c8 03 82 06 02 58 20 8a f6 f4 30 eb e1 8d 34 18 40 17 a9 a1 1b f5 11 c8
df f8 f8 34 73 0b 96 c1 b7 c8 db ca 2f c3 b6 37 df f8 f8 34 73 0b 96 c1 b7 c8 db ca 2f c3 b6 37
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="message2-1"> <section anchor="message2-1">
<name>message_2</name> <name>message_2</name>
<t>The Responder supports the selected cipher suite 2 and not the by the Initiator more preferred cipher suite(s) 6, so SUITES_I is acceptable.</t> <t>The Responder supports the selected cipher suite 2 and not the Initia tor's more preferred cipher suite(s) 6, so SUITES_I is acceptable.</t>
<t>The Responder creates an ephemeral key pair for use with the EDHOC ke y exchange algorithm:</t> <t>The Responder creates an ephemeral key pair for use with the EDHOC ke y exchange algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
Responder's ephemeral private key Responder's ephemeral private key
Y (Raw Value) (32 bytes) Y (Raw Value) (32 bytes)
e2 f4 12 67 77 20 5e 85 3b 43 7d 6e ac a1 e1 f7 53 cd cc 3e 2c 69 fa e2 f4 12 67 77 20 5e 85 3b 43 7d 6e ac a1 e1 f7 53 cd cc 3e 2c 69 fa
88 4b 0a 1a 64 09 77 e4 18 88 4b 0a 1a 64 09 77 e4 18
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Responder's ephemeral public key, 'x'-coordinate Responder's ephemeral public key, 'x'-coordinate
G_Y (Raw Value) (32 bytes) G_Y (Raw Value) (32 bytes)
skipping to change at line 1493 skipping to change at line 1526
(Raw Value) (32 bytes) (Raw Value) (32 bytes)
5e 4f 0d d8 a3 da 0b aa 16 b9 d3 ad 56 a0 c1 86 0a 94 0a f8 59 14 91 5e 4f 0d d8 a3 da 0b aa 16 b9 d3 ad 56 a0 c1 86 0a 94 0a f8 59 14 91
5e 25 01 9b 40 24 17 e9 9d 5e 25 01 9b 40 24 17 e9 9d
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Responder's ephemeral public key, 'x'-coordinate Responder's ephemeral public key, 'x'-coordinate
G_Y (CBOR Data Item) (34 bytes) G_Y (CBOR Data Item) (34 bytes)
58 20 41 97 01 d7 f0 0a 26 c2 dc 58 7a 36 dd 75 25 49 f3 37 63 c8 93 58 20 41 97 01 d7 f0 0a 26 c2 dc 58 7a 36 dd 75 25 49 f3 37 63 c8 93
42 2c 8e a0 f9 55 a1 3a 4f f5 d5 42 2c 8e a0 f9 55 a1 3a 4f f5 d5
]]></artwork> ]]></artwork>
<t>The Responder selects its connection identifier C_R to be the byte st ring 0x27, which since it is represented by the 1-byte CBOR int -8 is encoded as 0x27:</t> <t>The Responder selects its connection identifier C_R to be the byte st ring 0x27, which is encoded as 0x27 since it is represented by the 1-byte CBOR i nt -8:</t>
<artwork><![CDATA[ <artwork><![CDATA[
Connection identifier chosen by Responder Connection identifier chosen by the Responder
C_R (raw value) (1 byte) C_R (raw value) (1 byte)
27 27
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Connection identifier chosen by Responder Connection identifier chosen by the Responder
C_R (CBOR Data Item) (1 byte) C_R (CBOR Data Item) (1 byte)
27 27
]]></artwork> ]]></artwork>
<t>The transcript hash TH_2 is calculated using the EDHOC hash algorithm :</t> <t>The transcript hash TH_2 is calculated using the EDHOC hash algorithm :</t>
<t>TH_2 = H( G_Y, H(message_1) )</t> <t>TH_2 = H( G_Y, H(message_1) )</t>
<artwork><![CDATA[ <artwork><![CDATA[
H(message_1) (Raw Value) (32 bytes) H(message_1) (Raw Value) (32 bytes)
ca 02 ca bd a5 a8 90 27 49 b4 2f 71 10 50 bb 4d bd 52 15 3e 87 52 75 ca 02 ca bd a5 a8 90 27 49 b4 2f 71 10 50 bb 4d bd 52 15 3e 87 52 75
94 b3 9f 50 cd f0 19 88 8c 94 b3 9f 50 cd f0 19 88 8c
]]></artwork> ]]></artwork>
skipping to change at line 1534 skipping to change at line 1567
<artwork><![CDATA[ <artwork><![CDATA[
TH_2 (Raw Value) (32 bytes) TH_2 (Raw Value) (32 bytes)
35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8 3f f4 c6 b1 6e 57 02 8f f3 35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8 3f f4 c6 b1 6e 57 02 8f f3
9d 52 36 c1 82 b2 02 08 4b 9d 52 36 c1 82 b2 02 08 4b
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
TH_2 (CBOR Data Item) (34 bytes) TH_2 (CBOR Data Item) (34 bytes)
58 20 35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8 3f f4 c6 b1 6e 57 02 58 20 35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8 3f f4 c6 b1 6e 57 02
8f f3 9d 52 36 c1 82 b2 02 08 4b 8f f3 9d 52 36 c1 82 b2 02 08 4b
]]></artwork> ]]></artwork>
<t>PRK_2e is specified in <xref section="4.1.1.1" sectionFormat="of" tar <t>PRK_2e is specified in <xref section="4.1.1.1" sectionFormat="of" tar
get="I-D.ietf-lake-edhoc"/>.</t> get="RFC9528"/>.</t>
<t>First, the ECDH shared secret G_XY is computed from G_X and Y, or G_Y <t>First, the ECDH shared secret G_XY is computed from G_X and Y or G_Y
and X:</t> and X:</t>
<artwork><![CDATA[ <artwork><![CDATA[
G_XY (Raw Value) (ECDH shared secret) (32 bytes) G_XY (Raw Value) (ECDH shared secret) (32 bytes)
2f 0c b7 e8 60 ba 53 8f bf 5c 8b de d0 09 f6 25 9b 4b 62 8f e1 eb 7d 2f 0c b7 e8 60 ba 53 8f bf 5c 8b de d0 09 f6 25 9b 4b 62 8f e1 eb 7d
be 93 78 e5 ec f7 a8 24 ba be 93 78 e5 ec f7 a8 24 ba
]]></artwork> ]]></artwork>
<t>Then, PRK_2e is calculated using EDHOC_Extract() determined by the ED HOC hash algorithm:</t> <t>Then, PRK_2e is calculated using EDHOC_Extract(), which is determined by the EDHOC hash algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_2e = EDHOC_Extract( salt, G_XY ) = PRK_2e = EDHOC_Extract( salt, G_XY )
= HMAC-SHA-256( salt, G_XY ) = HMAC-SHA-256( salt, G_XY )
]]></artwork> ]]></artwork>
<t>where salt is TH_2:</t> <t>where salt is TH_2:</t>
<artwork><![CDATA[ <artwork><![CDATA[
salt (Raw Value) (32 bytes) salt (Raw Value) (32 bytes)
35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8 3f f4 c6 b1 6e 57 02 8f f3 35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8 3f f4 c6 b1 6e 57 02 8f f3
9d 52 36 c1 82 b2 02 08 4b 9d 52 36 c1 82 b2 02 08 4b
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_2e (Raw Value) (32 bytes) PRK_2e (Raw Value) (32 bytes)
5a a0 d6 9f 3e 3d 1e 0c 47 9f 0b 8a 48 66 90 c9 80 26 30 c3 46 6b 1d 5a a0 d6 9f 3e 3d 1e 0c 47 9f 0b 8a 48 66 90 c9 80 26 30 c3 46 6b 1d
c9 23 71 c9 82 56 31 70 b5 c9 23 71 c9 82 56 31 70 b5
]]></artwork> ]]></artwork>
<t>Since METHOD = 3, the Responder authenticates using static DH. The ED HOC key exchange algorithm is based on the same curve as for the ephemeral keys, which is P-256, since the selected cipher suite is 2.</t> <t>Since METHOD = 3, the Responder authenticates using static DH. The ED HOC key exchange algorithm is based on the same curve as for the ephemeral keys, which is P-256, since the selected cipher suite is 2.</t>
<t>The Responder's static Diffie-Hellman P-256 key pair:</t> <t>The Responder's static Diffie-Hellman P-256 key pair consists of a pr ivate key and a public key.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Responder's private authentication key Responder's private authentication key
SK_R (Raw Value) (32 bytes) SK_R (Raw Value) (32 bytes)
72 cc 47 61 db d4 c7 8f 75 89 31 aa 58 9d 34 8d 1e f8 74 a7 e3 03 ed 72 cc 47 61 db d4 c7 8f 75 89 31 aa 58 9d 34 8d 1e f8 74 a7 e3 03 ed
e2 f1 40 dc f3 e6 aa 4a ac e2 f1 40 dc f3 e6 aa 4a ac
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Responder's public authentication key, 'x'-coordinate Responder's public authentication key, 'x'-coordinate
(Raw Value) (32 bytes) (Raw Value) (32 bytes)
bb c3 49 60 52 6e a4 d3 2e 94 0c ad 2a 23 41 48 dd c2 17 91 a1 2a fb bb c3 49 60 52 6e a4 d3 2e 94 0c ad 2a 23 41 48 dd c2 17 91 a1 2a fb
cb ac 93 62 20 46 dd 44 f0 cb ac 93 62 20 46 dd 44 f0
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Responder's public authentication key, 'y'-coordinate Responder's public authentication key, 'y'-coordinate
(Raw Value) (32 bytes) (Raw Value) (32 bytes)
45 19 e2 57 23 6b 2a 0c e2 02 3f 09 31 f1 f3 86 ca 7a fd a6 4f cd e0 45 19 e2 57 23 6b 2a 0c e2 02 3f 09 31 f1 f3 86 ca 7a fd a6 4f cd e0
10 8c 22 4c 51 ea bf 60 72 10 8c 22 4c 51 ea bf 60 72
]]></artwork> ]]></artwork>
<t>Since the Responder authenticates with static DH (METHOD = 3), PRK_3e 2m is derived <t>Since the Responder authenticates with static DH (METHOD = 3), PRK_3e 2m is derived
from SALT_3e2m and G_RX.</t> from SALT_3e2m and G_RX.</t>
<t>The input needed to calculate SALT_3e2m is defined in <xref section=" 4.1.2" sectionFormat="of" target="I-D.ietf-lake-edhoc"/>, using EDHOC_Expand() w ith the EDHOC hash algorithm:</t> <t>The input needed to calculate SALT_3e2m is defined in <xref section=" 4.1.2" sectionFormat="of" target="RFC9528"/>, using EDHOC_Expand() with the EDHO C hash algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
SALT_3e2m = EDHOC_KDF( PRK_2e, 1, TH_2, hash_length ) = SALT_3e2m = EDHOC_KDF( PRK_2e, 1, TH_2, hash_length )
= HKDF-Expand( PRK_2e, info, hash_length ) = HKDF-Expand( PRK_2e, info, hash_length )
]]></artwork> ]]></artwork>
<t>where hash_length is the length in bytes of the output of the EDHOC h ash algorithm, and info for SALT_3e2m is:</t> <t>where hash_length is the length in bytes of the output of the EDHOC h ash algorithm, and info for SALT_3e2m is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
1, 1,
h'356efd53771425e008f3fe3a86c83ff4c6b16e57028ff39d h'356efd53771425e008f3fe3a86c83ff4c6b16e57028ff39d
5236c182b202084b', 5236c182b202084b',
32 32
) )
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
info for SALT_3e2m (CBOR Sequence) (37 bytes) info for SALT_3e2m (CBOR Sequence) (37 bytes)
01 58 20 35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8 3f f4 c6 b1 6e 57 01 58 20 35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8 3f f4 c6 b1 6e 57
02 8f f3 9d 52 36 c1 82 b2 02 08 4b 18 20 02 8f f3 9d 52 36 c1 82 b2 02 08 4b 18 20
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
SALT_3e2m (Raw Value) (32 bytes) SALT_3e2m (Raw Value) (32 bytes)
af 4e 10 3a 47 cb 3c f3 25 70 d5 c2 5a d2 77 32 bd 8d 81 78 e9 a6 9d af 4e 10 3a 47 cb 3c f3 25 70 d5 c2 5a d2 77 32 bd 8d 81 78 e9 a6 9d
06 1c 31 a2 7f 8e 3c a9 26 06 1c 31 a2 7f 8e 3c a9 26
]]></artwork> ]]></artwork>
<t>PRK_3e2m is specified in <xref section="4.1.1.2" sectionFormat="of" t arget="I-D.ietf-lake-edhoc"/>.</t> <t>PRK_3e2m is specified in <xref section="4.1.1.2" sectionFormat="of" t arget="RFC9528"/>.</t>
<t>PRK_3e2m is derived from G_RX using EDHOC_Extract() with the EDHOC ha sh algorithm:</t> <t>PRK_3e2m is derived from G_RX using EDHOC_Extract() with the EDHOC ha sh algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_3e2m = EDHOC_Extract( SALT_3e2m, G_RX ) = PRK_3e2m = EDHOC_Extract( SALT_3e2m, G_RX )
= HMAC-SHA-256( SALT_3e2m, G_RX ) = HMAC-SHA-256( SALT_3e2m, G_RX )
]]></artwork> ]]></artwork>
<t>where G_RX is the ECDH shared secret calculated from G_X and R, or G_ R and X.</t> <t>where G_RX is the ECDH shared secret calculated from G_X and R, or G_ R and X.</t>
<artwork><![CDATA[ <artwork><![CDATA[
G_RX (Raw Value) (ECDH shared secret) (32 bytes) G_RX (Raw Value) (ECDH shared secret) (32 bytes)
f2 b6 ee a0 22 20 b9 5e ee 5a 0b c7 01 f0 74 e0 0a 84 3e a0 24 22 f6 f2 b6 ee a0 22 20 b9 5e ee 5a 0b c7 01 f0 74 e0 0a 84 3e a0 24 22 f6
08 25 fb 26 9b 3e 16 14 23 08 25 fb 26 9b 3e 16 14 23
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_3e2m (Raw Value) (32 bytes) PRK_3e2m (Raw Value) (32 bytes)
0c a3 d3 39 82 96 b3 c0 39 00 98 76 20 c1 1f 6f ce 70 78 1c 1d 12 19 0c a3 d3 39 82 96 b3 c0 39 00 98 76 20 c1 1f 6f ce 70 78 1c 1d 12 19
72 0f 9e c0 8c 12 2d 84 34 72 0f 9e c0 8c 12 2d 84 34
]]></artwork> ]]></artwork>
<t>The Responder constructs the remaining input needed to calculate MAC_ 2:</t> <t>The Responder constructs the remaining input needed to calculate MAC_ 2:</t>
<t>MAC_2 = EDHOC_KDF( PRK_3e2m, 2, context_2, mac_length_2 )</t> <t>MAC_2 = EDHOC_KDF( PRK_3e2m, 2, context_2, mac_length_2 )</t>
<t>context_2 = &lt;&lt; ID_CRED_R, TH_2, CRED_R, ? EAD_2 &gt;&gt;</t> <t>context_2 = &lt;&lt; C_R, ID_CRED_R, TH_2, CRED_R, ? EAD_2 &gt;&gt;</ t>
<t>CRED_R is identified by a 'kid' with byte string value 0x32:</t> <t>CRED_R is identified by a 'kid' with byte string value 0x32:</t>
<artwork><![CDATA[ <artwork><![CDATA[
ID_CRED_R = ID_CRED_R =
{ {
4 : h'32' 4 : h'32'
} }
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
ID_CRED_R (CBOR Data Item) (4 bytes) ID_CRED_R (CBOR Data Item) (4 bytes)
a1 04 41 32 a1 04 41 32
]]></artwork> ]]></artwork>
<t>CRED_R is an RPK encoded as a CCS:</t> <t>CRED_R is an RPK encoded as a CCS:</t>
<artwork><![CDATA[ <artwork><![CDATA[
{ /CCS/ { /CCS/
2 : "example.edu", /sub/ 2 : "example.edu", /sub/
8 : { /cnf/ 8 : { /cnf/
1 : { /COSE_Key/ 1 : { /COSE_Key/
1 : 2, /kty/ 1 : 2, /kty/
2 : h'32', /kid/ 2 : h'32', /kid/
-1 : 1, /crv/ -1 : 1, /crv/
-2 : h'BBC34960526EA4D32E940CAD2A234148 -2 : h'bbc34960526ea4d32e940cad2a234148
DDC21791A12AFBCBAC93622046DD44F0', /x/ ddc21791a12afbcbac93622046dd44f0', /x/
-3 : h'4519E257236B2A0CE2023F0931F1F386 -3 : h'4519e257236b2a0ce2023f0931f1f386
CA7AFDA64FCDE0108C224C51EABF6072' /y/ ca7afda64fcde0108c224c51eabf6072' /y/
} }
} }
} }
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
CRED_R (CBOR Data Item) (95 bytes) CRED_R (CBOR Data Item) (95 bytes)
a2 02 6b 65 78 61 6d 70 6c 65 2e 65 64 75 08 a1 01 a5 01 02 02 41 32 a2 02 6b 65 78 61 6d 70 6c 65 2e 65 64 75 08 a1 01 a5 01 02 02 41 32
20 01 21 58 20 bb c3 49 60 52 6e a4 d3 2e 94 0c ad 2a 23 41 48 dd c2 20 01 21 58 20 bb c3 49 60 52 6e a4 d3 2e 94 0c ad 2a 23 41 48 dd c2
17 91 a1 2a fb cb ac 93 62 20 46 dd 44 f0 22 58 20 45 19 e2 57 23 6b 17 91 a1 2a fb cb ac 93 62 20 46 dd 44 f0 22 58 20 45 19 e2 57 23 6b
2a 0c e2 02 3f 09 31 f1 f3 86 ca 7a fd a6 4f cd e0 10 8c 22 4c 51 ea 2a 0c e2 02 3f 09 31 f1 f3 86 ca 7a fd a6 4f cd e0 10 8c 22 4c 51 ea
bf 60 72 bf 60 72
]]></artwork> ]]></artwork>
<t>No external authorization data:</t> <t>No external authorization data:</t>
<artwork><![CDATA[ <artwork><![CDATA[
EAD_2 (CBOR Sequence) (0 bytes) EAD_2 (CBOR Sequence) (0 bytes)
]]></artwork> ]]></artwork>
<t>context_2 = &lt;&lt; ID_CRED_R, TH_2, CRED_R, ? EAD_2 &gt;&gt;</t> <t>context_2 = &lt;&lt; C_R, ID_CRED_R, TH_2, CRED_R, ? EAD_2 &gt;&gt;</ t>
<artwork><![CDATA[ <artwork><![CDATA[
context_2 (CBOR Sequence) (133 bytes) context_2 (CBOR Sequence) (134 bytes)
a1 04 41 32 58 20 35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8 3f f4 c6 27 a1 04 41 32 58 20 35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8 3f f4
b1 6e 57 02 8f f3 9d 52 36 c1 82 b2 02 08 4b a2 02 6b 65 78 61 6d 70 c6 b1 6e 57 02 8f f3 9d 52 36 c1 82 b2 02 08 4b a2 02 6b 65 78 61 6d
6c 65 2e 65 64 75 08 a1 01 a5 01 02 02 41 32 20 01 21 58 20 bb c3 49 70 6c 65 2e 65 64 75 08 a1 01 a5 01 02 02 41 32 20 01 21 58 20 bb c3
60 52 6e a4 d3 2e 94 0c ad 2a 23 41 48 dd c2 17 91 a1 2a fb cb ac 93 49 60 52 6e a4 d3 2e 94 0c ad 2a 23 41 48 dd c2 17 91 a1 2a fb cb ac
62 20 46 dd 44 f0 22 58 20 45 19 e2 57 23 6b 2a 0c e2 02 3f 09 31 f1 93 62 20 46 dd 44 f0 22 58 20 45 19 e2 57 23 6b 2a 0c e2 02 3f 09 31
f3 86 ca 7a fd a6 4f cd e0 10 8c 22 4c 51 ea bf 60 72 f1 f3 86 ca 7a fd a6 4f cd e0 10 8c 22 4c 51 ea bf 60 72
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
context_2 (CBOR byte string) (135 bytes) context_2 (CBOR byte string) (136 bytes)
58 85 a1 04 41 32 58 20 35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8 3f 58 86 27 a1 04 41 32 58 20 35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8
f4 c6 b1 6e 57 02 8f f3 9d 52 36 c1 82 b2 02 08 4b a2 02 6b 65 78 61 3f f4 c6 b1 6e 57 02 8f f3 9d 52 36 c1 82 b2 02 08 4b a2 02 6b 65 78
6d 70 6c 65 2e 65 64 75 08 a1 01 a5 01 02 02 41 32 20 01 21 58 20 bb 61 6d 70 6c 65 2e 65 64 75 08 a1 01 a5 01 02 02 41 32 20 01 21 58 20
c3 49 60 52 6e a4 d3 2e 94 0c ad 2a 23 41 48 dd c2 17 91 a1 2a fb cb bb c3 49 60 52 6e a4 d3 2e 94 0c ad 2a 23 41 48 dd c2 17 91 a1 2a fb
ac 93 62 20 46 dd 44 f0 22 58 20 45 19 e2 57 23 6b 2a 0c e2 02 3f 09 cb ac 93 62 20 46 dd 44 f0 22 58 20 45 19 e2 57 23 6b 2a 0c e2 02 3f
31 f1 f3 86 ca 7a fd a6 4f cd e0 10 8c 22 4c 51 ea bf 60 72 09 31 f1 f3 86 ca 7a fd a6 4f cd e0 10 8c 22 4c 51 ea bf 60 72
]]></artwork>
<t>MAC_2 is computed through EDHOC_Expand() using the EDHOC hash algorit
hm (see <xref section="4.1.2" sectionFormat="of" target="RFC9528"/>):</t>
<artwork><![CDATA[
MAC_2 = HKDF-Expand( PRK_3e2m, info, mac_length_2 )
]]></artwork>
<t>where</t>
<artwork><![CDATA[
info = ( 2, context_2, mac_length_2 )
]]></artwork> ]]></artwork>
<t>MAC_2 is computed through EDHOC_Expand() using the EDHOC hash algorit
hm, see <xref section="4.1.2" sectionFormat="of" target="I-D.ietf-lake-edhoc"/>:
</t>
<t>MAC_2 = HKDF-Expand(PRK_3e2m, info, mac_length_2), where</t>
<t>info = ( 2, context_2, mac_length_2 )</t>
<t>Since METHOD = 3, mac_length_2 is given by the EDHOC MAC length.</t> <t>Since METHOD = 3, mac_length_2 is given by the EDHOC MAC length.</t>
<t>info for MAC_2 is:</t> <t>info for MAC_2 is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
2, 2,
h'a10441325820356efd53771425e008f3fe3a86c83ff4c6b1 h'27a10441325820356efd53771425e008f3fe3a86c83ff4c6
6e57028ff39d5236c182b202084ba2026b6578616d706c65 b16e57028ff39d5236c182b202084ba2026b6578616d706c
2e65647508a101a501020241322001215820bbc34960526e 652e65647508a101a501020241322001215820bbc3496052
a4d32e940cad2a234148ddc21791a12afbcbac93622046dd 6ea4d32e940cad2a234148ddc21791a12afbcbac93622046
44f02258204519e257236b2a0ce2023f0931f1f386ca7afd dd44f02258204519e257236b2a0ce2023f0931f1f386ca7a
a64fcde0108c224c51eabf6072', fda64fcde0108c224c51eabf6072',
8 8
) )
]]></artwork> ]]></artwork>
<t>where the last value is the EDHOC MAC length in bytes.</t> <t>where the last value is the EDHOC MAC length in bytes.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for MAC_2 (CBOR Sequence) (137 bytes) info for MAC_2 (CBOR Sequence) (138 bytes)
02 58 85 a1 04 41 32 58 20 35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8 02 58 86 27 a1 04 41 32 58 20 35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86
3f f4 c6 b1 6e 57 02 8f f3 9d 52 36 c1 82 b2 02 08 4b a2 02 6b 65 78 c8 3f f4 c6 b1 6e 57 02 8f f3 9d 52 36 c1 82 b2 02 08 4b a2 02 6b 65
61 6d 70 6c 65 2e 65 64 75 08 a1 01 a5 01 02 02 41 32 20 01 21 58 20 78 61 6d 70 6c 65 2e 65 64 75 08 a1 01 a5 01 02 02 41 32 20 01 21 58
bb c3 49 60 52 6e a4 d3 2e 94 0c ad 2a 23 41 48 dd c2 17 91 a1 2a fb 20 bb c3 49 60 52 6e a4 d3 2e 94 0c ad 2a 23 41 48 dd c2 17 91 a1 2a
cb ac 93 62 20 46 dd 44 f0 22 58 20 45 19 e2 57 23 6b 2a 0c e2 02 3f fb cb ac 93 62 20 46 dd 44 f0 22 58 20 45 19 e2 57 23 6b 2a 0c e2 02
09 31 f1 f3 86 ca 7a fd a6 4f cd e0 10 8c 22 4c 51 ea bf 60 72 08 3f 09 31 f1 f3 86 ca 7a fd a6 4f cd e0 10 8c 22 4c 51 ea bf 60 72 08
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
MAC_2 (Raw Value) (8 bytes) MAC_2 (Raw Value) (8 bytes)
fa 5e fa 2e bf 92 0b f3 09 43 30 5c 89 9f 5c 54
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
MAC_2 (CBOR Data Item) (9 bytes) MAC_2 (CBOR Data Item) (9 bytes)
48 fa 5e fa 2e bf 92 0b f3 48 09 43 30 5c 89 9f 5c 54
]]></artwork> ]]></artwork>
<t>Since METHOD = 3, Signature_or_MAC_2 is MAC_2:</t> <t>Since METHOD = 3, Signature_or_MAC_2 is MAC_2:</t>
<artwork><![CDATA[ <artwork><![CDATA[
Signature_or_MAC_2 (Raw Value) (8 bytes) Signature_or_MAC_2 (Raw Value) (8 bytes)
fa 5e fa 2e bf 92 0b f3 09 43 30 5c 89 9f 5c 54
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Signature_or_MAC_2 (CBOR Data Item) (9 bytes) Signature_or_MAC_2 (CBOR Data Item) (9 bytes)
48 fa 5e fa 2e bf 92 0b f3 48 09 43 30 5c 89 9f 5c 54
]]></artwork> ]]></artwork>
<t>The Responder constructs PLAINTEXT_2:</t> <t>The Responder constructs PLAINTEXT_2:</t>
<artwork><![CDATA[ <artwork><![CDATA[
PLAINTEXT_2 = PLAINTEXT_2 =
( (
C_R, C_R,
ID_CRED_R / bstr / -24..23, ID_CRED_R / bstr / -24..23,
Signature_or_MAC_2, Signature_or_MAC_2,
? EAD_2 ? EAD_2
) )
]]></artwork> ]]></artwork>
<t>Since ID_CRED_R contains a single 'kid' parameter, only the byte stri ng value is included in the plaintext, represented as described in <xref section ="3.3.2" sectionFormat="of" target="I-D.ietf-lake-edhoc"/>. The CBOR map { 4 : h '32' } is thus replaced, not by the CBOR byte string 0x4132, but by the CBOR int 0x32, since that is a one byte encoding of a CBOR integer (-19).</t> <t>Since ID_CRED_R contains a single 'kid' parameter, only the byte stri ng value is included in the plaintext, represented as described in <xref section ="3.3.2" sectionFormat="of" target="RFC9528"/>. The CBOR map { 4 : h'32' } is th us replaced, not by the CBOR byte string 0x4132, but by the CBOR int 0x32, since that is a one-byte encoding of a CBOR integer (-19).</t>
<artwork><![CDATA[ <artwork><![CDATA[
PLAINTEXT_2 (CBOR Sequence) (11 bytes) PLAINTEXT_2 (CBOR Sequence) (11 bytes)
27 32 48 fa 5e fa 2e bf 92 0b f3 27 32 48 09 43 30 5c 89 9f 5c 54
]]></artwork> ]]></artwork>
<t>The input needed to calculate KEYSTREAM_2 is defined in <xref section ="4.1.2" sectionFormat="of" target="I-D.ietf-lake-edhoc"/>, using EDHOC_Expand() with the EDHOC hash algorithm:</t> <t>The input needed to calculate KEYSTREAM_2 is defined in <xref section ="4.1.2" sectionFormat="of" target="RFC9528"/>, using EDHOC_Expand() with the ED HOC hash algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
KEYSTREAM_2 = EDHOC_KDF( PRK_2e, 0, TH_2, plaintext_length ) = KEYSTREAM_2 = EDHOC_KDF( PRK_2e, 0, TH_2, plaintext_length )
= HKDF-Expand( PRK_2e, info, plaintext_length ) = HKDF-Expand( PRK_2e, info, plaintext_length )
]]></artwork> ]]></artwork>
<t>where plaintext_length is the length in bytes of PLAINTEXT_2, and inf o for KEYSTREAM_2 is:</t> <t>where plaintext_length is the length in bytes of PLAINTEXT_2, and inf o for KEYSTREAM_2 is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
0, 0,
h'356efd53771425e008f3fe3a86c83ff4c6b16e57028ff39d h'356efd53771425e008f3fe3a86c83ff4c6b16e57028ff39d
5236c182b202084b', 5236c182b202084b',
11 11
) )
]]></artwork> ]]></artwork>
<t>where the last value is the length in bytes of PLAINTEXT_2.</t> <t>where the last value is the length in bytes of PLAINTEXT_2.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for KEYSTREAM_2 (CBOR Sequence) (36 bytes) info for KEYSTREAM_2 (CBOR Sequence) (36 bytes)
00 58 20 35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8 3f f4 c6 b1 6e 57 00 58 20 35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8 3f f4 c6 b1 6e 57
02 8f f3 9d 52 36 c1 82 b2 02 08 4b 0b 02 8f f3 9d 52 36 c1 82 b2 02 08 4b 0b
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
KEYSTREAM_2 (Raw Value) (11 bytes) KEYSTREAM_2 (Raw Value) (11 bytes)
bf 50 e9 e7 ba d0 bb 68 17 33 99 bf 50 e9 e7 ba d0 bb 68 17 33 99
]]></artwork> ]]></artwork>
<t>The Responder calculates CIPHERTEXT_2 as XOR between PLAINTEXT_2 and KEYSTREAM_2:</t> <t>The Responder calculates CIPHERTEXT_2 as XOR between PLAINTEXT_2 and KEYSTREAM_2:</t>
<artwork><![CDATA[ <artwork><![CDATA[
CIPHERTEXT_2 (Raw Value) (11 bytes) CIPHERTEXT_2 (Raw Value) (11 bytes)
98 62 a1 1d e4 2a 95 d7 85 38 6a 98 62 a1 ee f9 e0 e7 e1 88 6f cd
]]></artwork> ]]></artwork>
<t>The Responder constructs message_2:</t> <t>The Responder constructs message_2:</t>
<artwork><![CDATA[ <artwork><![CDATA[
message_2 = message_2 =
( (
G_Y_CIPHERTEXT_2, G_Y_CIPHERTEXT_2
) )
]]></artwork> ]]></artwork>
<t>where G_Y_CIPHERTEXT_2 is the bstr encoding of the concatenation of <t>where G_Y_CIPHERTEXT_2 is the bstr encoding of the concatenation of
the raw values of G_Y and CIPHERTEXT_2.</t> the raw values of G_Y and CIPHERTEXT_2.</t>
<artwork><![CDATA[ <artwork><![CDATA[
message_2 (CBOR Sequence) (45 bytes) message_2 (CBOR Sequence) (45 bytes)
58 2b 41 97 01 d7 f0 0a 26 c2 dc 58 7a 36 dd 75 25 49 f3 37 63 c8 93 58 2b 41 97 01 d7 f0 0a 26 c2 dc 58 7a 36 dd 75 25 49 f3 37 63 c8 93
42 2c 8e a0 f9 55 a1 3a 4f f5 d5 98 62 a1 1d e4 2a 95 d7 85 38 6a 42 2c 8e a0 f9 55 a1 3a 4f f5 d5 98 62 a1 ee f9 e0 e7 e1 88 6f cd
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="message3-1"> <section anchor="message3-1">
<name>message_3</name> <name>message_3</name>
<t>The transcript hash TH_3 is calculated using the EDHOC hash algorithm :</t> <t>The transcript hash TH_3 is calculated using the EDHOC hash algorithm :</t>
<t>TH_3 = H( TH_2, PLAINTEXT_2, CRED_R )</t> <t>TH_3 = H( TH_2, PLAINTEXT_2, CRED_R )</t>
<artwork><![CDATA[ <artwork><![CDATA[
Input to calculate TH_3 (CBOR Sequence) (140 bytes) Input to calculate TH_3 (CBOR Sequence) (140 bytes)
58 20 35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8 3f f4 c6 b1 6e 57 02 58 20 35 6e fd 53 77 14 25 e0 08 f3 fe 3a 86 c8 3f f4 c6 b1 6e 57 02
8f f3 9d 52 36 c1 82 b2 02 08 4b 27 32 48 fa 5e fa 2e bf 92 0b f3 a2 8f f3 9d 52 36 c1 82 b2 02 08 4b 27 32 48 09 43 30 5c 89 9f 5c 54 a2
02 6b 65 78 61 6d 70 6c 65 2e 65 64 75 08 a1 01 a5 01 02 02 41 32 20 02 6b 65 78 61 6d 70 6c 65 2e 65 64 75 08 a1 01 a5 01 02 02 41 32 20
01 21 58 20 bb c3 49 60 52 6e a4 d3 2e 94 0c ad 2a 23 41 48 dd c2 17 01 21 58 20 bb c3 49 60 52 6e a4 d3 2e 94 0c ad 2a 23 41 48 dd c2 17
91 a1 2a fb cb ac 93 62 20 46 dd 44 f0 22 58 20 45 19 e2 57 23 6b 2a 91 a1 2a fb cb ac 93 62 20 46 dd 44 f0 22 58 20 45 19 e2 57 23 6b 2a
0c e2 02 3f 09 31 f1 f3 86 ca 7a fd a6 4f cd e0 10 8c 22 4c 51 ea bf 0c e2 02 3f 09 31 f1 f3 86 ca 7a fd a6 4f cd e0 10 8c 22 4c 51 ea bf
60 72 60 72
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
TH_3 (Raw Value) (32 bytes) TH_3 (Raw Value) (32 bytes)
df e5 b0 65 e6 4c 72 d2 26 d5 00 c1 2d 49 be e6 dc 48 81 de d0 96 5e ad af 67 a7 8a 4b cc 91 e0 18 f8 88 27 62 a7 22 00 0b 25 07 03 9d f0
9b df 89 d2 4a 54 f2 e5 9a bc 1b bf 0c 16 1b b3 15 5c
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
TH_3 (CBOR Data Item) (34 bytes) TH_3 (CBOR Data Item) (34 bytes)
58 20 df e5 b0 65 e6 4c 72 d2 26 d5 00 c1 2d 49 be e6 dc 48 81 de d0 58 20 ad af 67 a7 8a 4b cc 91 e0 18 f8 88 27 62 a7 22 00 0b 25 07 03
96 5e 9b df 89 d2 4a 54 f2 e5 9a 9d f0 bc 1b bf 0c 16 1b b3 15 5c
]]></artwork> ]]></artwork>
<t>Since METHOD = 3, the Initiator authenticates using static DH. The ED HOC key exchange algorithm is based on the same curve as for the ephemeral keys, which is P-256, since the selected cipher suite is 2.</t> <t>Since METHOD = 3, the Initiator authenticates using static DH. The ED HOC key exchange algorithm is based on the same curve as for the ephemeral keys, which is P-256, since the selected cipher suite is 2.</t>
<t>The Initiator's static Diffie-Hellman P-256 key pair:</t> <t>The Initiator's static Diffie-Hellman P-256 key pair consists of a pr ivate key and a public key:</t>
<artwork><![CDATA[ <artwork><![CDATA[
Initiator's private authentication key Initiator's private authentication key
SK_I (Raw Value) (32 bytes) SK_I (Raw Value) (32 bytes)
fb 13 ad eb 65 18 ce e5 f8 84 17 66 08 41 14 2e 83 0a 81 fe 33 43 80 fb 13 ad eb 65 18 ce e5 f8 84 17 66 08 41 14 2e 83 0a 81 fe 33 43 80
a9 53 40 6a 13 05 e8 70 6b a9 53 40 6a 13 05 e8 70 6b
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Initiator's public authentication key, 'x'-coordinate Initiator's public authentication key, 'x'-coordinate
(Raw Value) (32 bytes) (Raw Value) (32 bytes)
ac 75 e9 ec e3 e5 0b fc 8e d6 03 99 88 95 22 40 5c 47 bf 16 df 96 66 ac 75 e9 ec e3 e5 0b fc 8e d6 03 99 88 95 22 40 5c 47 bf 16 df 96 66
0a 41 29 8c b4 30 7f 7e b6 0a 41 29 8c b4 30 7f 7e b6
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Initiator's public authentication key, 'y'-coordinate Initiator's public authentication key, 'y'-coordinate
(Raw Value) (32 bytes) (Raw Value) (32 bytes)
6e 5d e6 11 38 8a 4b 8a 82 11 33 4a c7 d3 7e cb 52 a3 87 d2 57 e6 db 6e 5d e6 11 38 8a 4b 8a 82 11 33 4a c7 d3 7e cb 52 a3 87 d2 57 e6 db
3c 2a 93 df 21 ff 3a ff c8 3c 2a 93 df 21 ff 3a ff c8
]]></artwork> ]]></artwork>
<t>Since I authenticates with static DH (METHOD = 3), PRK_4e3m is derive d <t>Since I authenticates with static DH (METHOD = 3), PRK_4e3m is derive d
from SALT_4e3m and G_IY.</t> from SALT_4e3m and G_IY.</t>
<t>The input needed to calculate SALT_4e3m is defined in <xref section=" 4.1.2" sectionFormat="of" target="I-D.ietf-lake-edhoc"/>, using EDHOC_Expand() w ith the EDHOC hash algorithm:</t> <t>The input needed to calculate SALT_4e3m is defined in <xref section=" 4.1.2" sectionFormat="of" target="RFC9528"/>, using EDHOC_Expand() with the EDHO C hash algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
SALT_4e3m = EDHOC_KDF( PRK_3e2m, 5, TH_3, hash_length ) = SALT_4e3m = EDHOC_KDF( PRK_3e2m, 5, TH_3, hash_length )
= HKDF-Expand( PRK_3e2m, info, hash_length ) = HKDF-Expand( PRK_3e2m, info, hash_length )
]]></artwork> ]]></artwork>
<t>where hash_length is the length in bytes of the output of the EDHOC h ash algorithm, and info for SALT_4e3m is:</t> <t>where hash_length is the length in bytes of the output of the EDHOC h ash algorithm, and info for SALT_4e3m is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
5, 5,
h'dfe5b065e64c72d226d500c12d49bee6dc4881ded0965e9b h'adaf67a78a4bcc91e018f8882762a722000b2507039df0bc
df89d24a54f2e59a', 1bbf0c161bb3155c',
32 32
) )
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
info for SALT_4e3m (CBOR Sequence) (37 bytes) info for SALT_4e3m (CBOR Sequence) (37 bytes)
05 58 20 df e5 b0 65 e6 4c 72 d2 26 d5 00 c1 2d 49 be e6 dc 48 81 de 05 58 20 ad af 67 a7 8a 4b cc 91 e0 18 f8 88 27 62 a7 22 00 0b 25 07
d0 96 5e 9b df 89 d2 4a 54 f2 e5 9a 18 20 03 9d f0 bc 1b bf 0c 16 1b b3 15 5c 18 20
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
SALT_4e3m (Raw Value) (32 bytes) SALT_4e3m (Raw Value) (32 bytes)
84 f8 a2 a9 53 4d dd 78 dc c7 e7 6e 0d 4d f6 0b fa d7 cd 3a d6 e1 d5 cf dd f9 51 5a 7e 46 e7 b4 db ff 31 cb d5 6c d0 4b a3 32 25 0d e9 ea
31 c7 f3 73 a7 ed a5 2d 1c 5d e1 ca f9 f6 d1 39 14 a7
]]></artwork> ]]></artwork>
<t>PRK_4e3m is specified in <xref section="4.1.1.3" sectionFormat="of" t arget="I-D.ietf-lake-edhoc"/>.</t> <t>PRK_4e3m is specified in <xref section="4.1.1.3" sectionFormat="of" t arget="RFC9528"/>.</t>
<t>Since I authenticates with static DH (METHOD = 3), PRK_4e3m is derive d <t>Since I authenticates with static DH (METHOD = 3), PRK_4e3m is derive d
from G_IY using EDHOC_Extract() with the EDHOC hash algorithm:</t> from G_IY using EDHOC_Extract() with the EDHOC hash algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_4e3m = EDHOC_Extract(SALT_4e3m, G_IY) = PRK_4e3m = EDHOC_Extract(SALT_4e3m, G_IY)
= HMAC-SHA-256(SALT_4e3m, G_IY) = HMAC-SHA-256(SALT_4e3m, G_IY)
]]></artwork> ]]></artwork>
<t>where G_IY is the ECDH shared secret calculated from G_I and Y, or G_ Y and I.</t> <t>where G_IY is the ECDH shared secret calculated from G_I and Y, or G_ Y and I.</t>
<artwork><![CDATA[ <artwork><![CDATA[
G_IY (Raw Value) (ECDH shared secret) (32 bytes) G_IY (Raw Value) (ECDH shared secret) (32 bytes)
08 0f 42 50 85 bc 62 49 08 9e ac 8f 10 8e a6 23 26 85 7e 12 ab 07 d7 08 0f 42 50 85 bc 62 49 08 9e ac 8f 10 8e a6 23 26 85 7e 12 ab 07 d7
20 28 ca 1b 5f 36 e0 04 b3 20 28 ca 1b 5f 36 e0 04 b3
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_4e3m (Raw Value) (32 bytes) PRK_4e3m (Raw Value) (32 bytes)
e9 cb 83 2a 24 00 95 d3 d0 64 3d be 12 e9 e2 e7 b1 8f 03 60 a3 17 2c 81 cc 8a 29 8e 35 70 44 e3 c4 66 bb 5c 0a 1e 50 7e 01 d4 92 38 ae ba
ea 7a c0 01 3e e2 40 e0 72 13 8d f9 46 35 40 7c 0f f7
]]></artwork> ]]></artwork>
<t>The Initiator constructs the remaining input needed to calculate MAC_ 3:</t> <t>The Initiator constructs the remaining input needed to calculate MAC_ 3:</t>
<t>MAC_3 = EDHOC_KDF( PRK_4e3m, 6, context_3, mac_length_3 )</t> <t>MAC_3 = EDHOC_KDF( PRK_4e3m, 6, context_3, mac_length_3 )</t>
<t>context_3 = &lt;&lt; ID_CRED_I, TH_3, CRED_I, ? EAD_3 &gt;&gt;</t> <t>context_3 = &lt;&lt; ID_CRED_I, TH_3, CRED_I, ? EAD_3 &gt;&gt;</t>
<t>CRED_I is identified by a 'kid' with byte string value 0x2b:</t> <t>CRED_I is identified by a 'kid' with byte string value 0x2b:</t>
<artwork><![CDATA[ <artwork><![CDATA[
ID_CRED_I = ID_CRED_I =
{ {
4 : h'2b' 4 : h'2b'
} }
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
ID_CRED_I (CBOR Data Item) (4 bytes) ID_CRED_I (CBOR Data Item) (4 bytes)
a1 04 41 2b a1 04 41 2b
]]></artwork> ]]></artwork>
<t>CRED_I is an RPK encoded as a CCS:</t> <t>CRED_I is an RPK encoded as a CCS:</t>
<artwork><![CDATA[ <artwork><![CDATA[
{ /CCS/ { /CCS/
2 : "42-50-31-FF-EF-37-32-39", /sub/ 2 : "42-50-31-FF-EF-37-32-39", /sub/
8 : { /cnf/ 8 : { /cnf/
1 : { /COSE_Key/ 1 : { /COSE_Key/
1 : 2, /kty/ 1 : 2, /kty/
2 : h'2b', /kid/ 2 : h'2b', /kid/
-1 : 1, /crv/ -1 : 1, /crv/
-2 : h'AC75E9ECE3E50BFC8ED6039988952240 -2 : h'ac75e9ece3e50bfc8ed6039988952240
5C47BF16DF96660A41298CB4307F7EB6' /x/ 5c47bf16df96660a41298cb4307f7eb6' /x/
-3 : h'6E5DE611388A4B8A8211334AC7D37ECB -3 : h'6e5de611388a4b8a8211334ac7d37ecb
52A387D257E6DB3C2A93DF21FF3AFFC8' /y/ 52a387d257e6db3c2a93df21ff3affc8' /y/
} }
} }
} }
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
CRED_I (CBOR Data Item) (107 bytes) CRED_I (CBOR Data Item) (107 bytes)
a2 02 77 34 32 2d 35 30 2d 33 31 2d 46 46 2d 45 46 2d 33 37 2d 33 32 a2 02 77 34 32 2d 35 30 2d 33 31 2d 46 46 2d 45 46 2d 33 37 2d 33 32
2d 33 39 08 a1 01 a5 01 02 02 41 2b 20 01 21 58 20 ac 75 e9 ec e3 e5 2d 33 39 08 a1 01 a5 01 02 02 41 2b 20 01 21 58 20 ac 75 e9 ec e3 e5
0b fc 8e d6 03 99 88 95 22 40 5c 47 bf 16 df 96 66 0a 41 29 8c b4 30 0b fc 8e d6 03 99 88 95 22 40 5c 47 bf 16 df 96 66 0a 41 29 8c b4 30
7f 7e b6 22 58 20 6e 5d e6 11 38 8a 4b 8a 82 11 33 4a c7 d3 7e cb 52 7f 7e b6 22 58 20 6e 5d e6 11 38 8a 4b 8a 82 11 33 4a c7 d3 7e cb 52
a3 87 d2 57 e6 db 3c 2a 93 df 21 ff 3a ff c8 a3 87 d2 57 e6 db 3c 2a 93 df 21 ff 3a ff c8
]]></artwork> ]]></artwork>
<t>No external authorization data:</t> <t>No external authorization data:</t>
<artwork><![CDATA[ <artwork><![CDATA[
EAD_3 (CBOR Sequence) (0 bytes) EAD_3 (CBOR Sequence) (0 bytes)
]]></artwork> ]]></artwork>
<t>context_3 = &lt;&lt; ID_CRED_I, TH_3, CRED_I, ? EAD_3 &gt;&gt;</t> <t>context_3 = &lt;&lt; ID_CRED_I, TH_3, CRED_I, ? EAD_3 &gt;&gt;</t>
<artwork><![CDATA[ <artwork><![CDATA[
context_3 (CBOR Sequence) (145 bytes) context_3 (CBOR Sequence) (145 bytes)
a1 04 41 2b 58 20 df e5 b0 65 e6 4c 72 d2 26 d5 00 c1 2d 49 be e6 dc a1 04 41 2b 58 20 ad af 67 a7 8a 4b cc 91 e0 18 f8 88 27 62 a7 22 00
48 81 de d0 96 5e 9b df 89 d2 4a 54 f2 e5 9a a2 02 77 34 32 2d 35 30 0b 25 07 03 9d f0 bc 1b bf 0c 16 1b b3 15 5c a2 02 77 34 32 2d 35 30
2d 33 31 2d 46 46 2d 45 46 2d 33 37 2d 33 32 2d 33 39 08 a1 01 a5 01 2d 33 31 2d 46 46 2d 45 46 2d 33 37 2d 33 32 2d 33 39 08 a1 01 a5 01
02 02 41 2b 20 01 21 58 20 ac 75 e9 ec e3 e5 0b fc 8e d6 03 99 88 95 02 02 41 2b 20 01 21 58 20 ac 75 e9 ec e3 e5 0b fc 8e d6 03 99 88 95
22 40 5c 47 bf 16 df 96 66 0a 41 29 8c b4 30 7f 7e b6 22 58 20 6e 5d 22 40 5c 47 bf 16 df 96 66 0a 41 29 8c b4 30 7f 7e b6 22 58 20 6e 5d
e6 11 38 8a 4b 8a 82 11 33 4a c7 d3 7e cb 52 a3 87 d2 57 e6 db 3c 2a e6 11 38 8a 4b 8a 82 11 33 4a c7 d3 7e cb 52 a3 87 d2 57 e6 db 3c 2a
93 df 21 ff 3a ff c8 93 df 21 ff 3a ff c8
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
context_3 (CBOR byte string) (147 bytes) context_3 (CBOR byte string) (147 bytes)
58 91 a1 04 41 2b 58 20 df e5 b0 65 e6 4c 72 d2 26 d5 00 c1 2d 49 be 58 91 a1 04 41 2b 58 20 ad af 67 a7 8a 4b cc 91 e0 18 f8 88 27 62 a7
e6 dc 48 81 de d0 96 5e 9b df 89 d2 4a 54 f2 e5 9a a2 02 77 34 32 2d 22 00 0b 25 07 03 9d f0 bc 1b bf 0c 16 1b b3 15 5c a2 02 77 34 32 2d
35 30 2d 33 31 2d 46 46 2d 45 46 2d 33 37 2d 33 32 2d 33 39 08 a1 01 35 30 2d 33 31 2d 46 46 2d 45 46 2d 33 37 2d 33 32 2d 33 39 08 a1 01
a5 01 02 02 41 2b 20 01 21 58 20 ac 75 e9 ec e3 e5 0b fc 8e d6 03 99 a5 01 02 02 41 2b 20 01 21 58 20 ac 75 e9 ec e3 e5 0b fc 8e d6 03 99
88 95 22 40 5c 47 bf 16 df 96 66 0a 41 29 8c b4 30 7f 7e b6 22 58 20 88 95 22 40 5c 47 bf 16 df 96 66 0a 41 29 8c b4 30 7f 7e b6 22 58 20
6e 5d e6 11 38 8a 4b 8a 82 11 33 4a c7 d3 7e cb 52 a3 87 d2 57 e6 db 6e 5d e6 11 38 8a 4b 8a 82 11 33 4a c7 d3 7e cb 52 a3 87 d2 57 e6 db
3c 2a 93 df 21 ff 3a ff c8 3c 2a 93 df 21 ff 3a ff c8
]]></artwork> ]]></artwork>
<t>MAC_3 is computed through EDHOC_Expand() using the EDHOC hash algorit hm, see <xref section="4.1.2" sectionFormat="of" target="I-D.ietf-lake-edhoc"/>: </t> <t>MAC_3 is computed through EDHOC_Expand() using the EDHOC hash algorit hm (see <xref section="4.1.2" sectionFormat="of" target="RFC9528"/>):</t>
<artwork><![CDATA[ <artwork><![CDATA[
MAC_3 = HKDF-Expand(PRK_4e3m, info, mac_length_3), where MAC_3 = HKDF-Expand( PRK_4e3m, info, mac_length_3 )
]]></artwork>
<t>where</t>
<artwork><![CDATA[
info = ( 6, context_3, mac_length_3 )
]]></artwork> ]]></artwork>
<t>info = ( 6, context_3, mac_length_3 )</t>
<t>Since METHOD = 3, mac_length_3 is given by the EDHOC MAC length.</t> <t>Since METHOD = 3, mac_length_3 is given by the EDHOC MAC length.</t>
<t>info for MAC_3 is:</t> <t>info for MAC_3 is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
6, 6,
h'a104412b5820dfe5b065e64c72d226d500c12d49bee6dc48 h'a104412b5820adaf67a78a4bcc91e018f8882762a722000b
81ded0965e9bdf89d24a54f2e59aa2027734322d35302d33 2507039df0bc1bbf0c161bb3155ca2027734322d35302d33
312d46462d45462d33372d33322d333908a101a501020241 312d46462d45462d33372d33322d333908a101a501020241
2b2001215820ac75e9ece3e50bfc8ed60399889522405c47 2b2001215820ac75e9ece3e50bfc8ed60399889522405c47
bf16df96660a41298cb4307f7eb62258206e5de611388a4b bf16df96660a41298cb4307f7eb62258206e5de611388a4b
8a8211334ac7d37ecb52a387d257e6db3c2a93df21ff3aff 8a8211334ac7d37ecb52a387d257e6db3c2a93df21ff3aff
c8', c8',
8 8
) )
]]></artwork> ]]></artwork>
<t>where the last value is the EDHOC MAC length in bytes.</t> <t>where the last value is the EDHOC MAC length in bytes.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for MAC_3 (CBOR Sequence) (149 bytes) info for MAC_3 (CBOR Sequence) (149 bytes)
06 58 91 a1 04 41 2b 58 20 df e5 b0 65 e6 4c 72 d2 26 d5 00 c1 2d 49 06 58 91 a1 04 41 2b 58 20 ad af 67 a7 8a 4b cc 91 e0 18 f8 88 27 62
be e6 dc 48 81 de d0 96 5e 9b df 89 d2 4a 54 f2 e5 9a a2 02 77 34 32 a7 22 00 0b 25 07 03 9d f0 bc 1b bf 0c 16 1b b3 15 5c a2 02 77 34 32
2d 35 30 2d 33 31 2d 46 46 2d 45 46 2d 33 37 2d 33 32 2d 33 39 08 a1 2d 35 30 2d 33 31 2d 46 46 2d 45 46 2d 33 37 2d 33 32 2d 33 39 08 a1
01 a5 01 02 02 41 2b 20 01 21 58 20 ac 75 e9 ec e3 e5 0b fc 8e d6 03 01 a5 01 02 02 41 2b 20 01 21 58 20 ac 75 e9 ec e3 e5 0b fc 8e d6 03
99 88 95 22 40 5c 47 bf 16 df 96 66 0a 41 29 8c b4 30 7f 7e b6 22 58 99 88 95 22 40 5c 47 bf 16 df 96 66 0a 41 29 8c b4 30 7f 7e b6 22 58
20 6e 5d e6 11 38 8a 4b 8a 82 11 33 4a c7 d3 7e cb 52 a3 87 d2 57 e6 20 6e 5d e6 11 38 8a 4b 8a 82 11 33 4a c7 d3 7e cb 52 a3 87 d2 57 e6
db 3c 2a 93 df 21 ff 3a ff c8 08 db 3c 2a 93 df 21 ff 3a ff c8 08
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
MAC_3 (Raw Value) (8 bytes) MAC_3 (Raw Value) (8 bytes)
a5 ee b9 ef fd ab fc 39 62 3c 91 df 41 e3 4c 2f
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
MAC_3 (CBOR Data Item) (9 bytes) MAC_3 (CBOR Data Item) (9 bytes)
48 a5 ee b9 ef fd ab fc 39 48 62 3c 91 df 41 e3 4c 2f
]]></artwork> ]]></artwork>
<t>Since METHOD = 3, Signature_or_MAC_3 is MAC_3:</t> <t>Since METHOD = 3, Signature_or_MAC_3 is MAC_3:</t>
<artwork><![CDATA[ <artwork><![CDATA[
Signature_or_MAC_3 (Raw Value) (8 bytes) Signature_or_MAC_3 (Raw Value) (8 bytes)
a5 ee b9 ef fd ab fc 39 62 3c 91 df 41 e3 4c 2f
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Signature_or_MAC_3 (CBOR Data Item) (9 bytes) Signature_or_MAC_3 (CBOR Data Item) (9 bytes)
48 a5 ee b9 ef fd ab fc 39 48 62 3c 91 df 41 e3 4c 2f
]]></artwork> ]]></artwork>
<t>The Initiator constructs PLAINTEXT_3:</t> <t>The Initiator constructs PLAINTEXT_3:</t>
<artwork><![CDATA[ <artwork><![CDATA[
PLAINTEXT_3 = PLAINTEXT_3 =
( (
ID_CRED_I / bstr / -24..23, ID_CRED_I / bstr / -24..23,
Signature_or_MAC_3, Signature_or_MAC_3,
? EAD_3 ? EAD_3
) )
]]></artwork> ]]></artwork>
<t>Since ID_CRED_I contains a single 'kid' parameter, only the byte stri ng value is included in the plaintext, represented as described in <xref section ="3.3.2" sectionFormat="of" target="I-D.ietf-lake-edhoc"/>. The CBOR map { 4 : h '2b' } is thus replaced, not by the CBOR byte string 0x412b, but by the CBOR int 0x2b, since that is a one byte encoding of a CBOR integer (-12).</t> <t>Since ID_CRED_I contains a single 'kid' parameter, only the byte stri ng value is included in the plaintext, represented as described in <xref section ="3.3.2" sectionFormat="of" target="RFC9528"/>. The CBOR map { 4 : h'2b' } is th us replaced, not by the CBOR byte string 0x412b, but by the CBOR int 0x2b, since that is a one-byte encoding of a CBOR integer (-12).</t>
<artwork><![CDATA[ <artwork><![CDATA[
PLAINTEXT_3 (CBOR Sequence) (10 bytes) PLAINTEXT_3 (CBOR Sequence) (10 bytes)
2b 48 a5 ee b9 ef fd ab fc 39 2b 48 62 3c 91 df 41 e3 4c 2f
]]></artwork> ]]></artwork>
<t>The Initiator constructs the associated data for message_3:</t> <t>The Initiator constructs the associated data for message_3:</t>
<artwork><![CDATA[ <artwork><![CDATA[
A_3 = A_3 =
[ [
"Encrypt0", "Encrypt0",
h'', h'',
h'dfe5b065e64c72d226d500c12d49bee6dc4881ded0965e9b h'adaf67a78a4bcc91e018f8882762a722000b2507039df0bc
df89d24a54f2e59a' 1bbf0c161bb3155c'
] ]
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
A_3 (CBOR Data Item) (45 bytes) A_3 (CBOR Data Item) (45 bytes)
83 68 45 6e 63 72 79 70 74 30 40 58 20 df e5 b0 65 e6 4c 72 d2 26 d5 83 68 45 6e 63 72 79 70 74 30 40 58 20 ad af 67 a7 8a 4b cc 91 e0 18
00 c1 2d 49 be e6 dc 48 81 de d0 96 5e 9b df 89 d2 4a 54 f2 e5 9a f8 88 27 62 a7 22 00 0b 25 07 03 9d f0 bc 1b bf 0c 16 1b b3 15 5c
]]></artwork> ]]></artwork>
<t>The Initiator constructs the input needed to derive the key K_3, see <xref section="4.1.2" sectionFormat="of" target="I-D.ietf-lake-edhoc"/>, using t he EDHOC hash algorithm:</t> <t>The Initiator constructs the input needed to derive the key K_3 (see <xref section="4.1.2" sectionFormat="of" target="RFC9528"/>) using the EDHOC has h algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
K_3 = EDHOC_KDF( PRK_3e2m, 3, TH_3, key_length ) K_3 = EDHOC_KDF( PRK_3e2m, 3, TH_3, key_length )
= HKDF-Expand( PRK_3e2m, info, key_length ), = HKDF-Expand( PRK_3e2m, info, key_length )
]]></artwork> ]]></artwork>
<t>where key_length is the key length in bytes for the EDHOC AEAD algori thm, and info for K_3 is:</t> <t>where key_length is the key length in bytes for the EDHOC AEAD algori thm, and info for K_3 is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
3, 3,
h'dfe5b065e64c72d226d500c12d49bee6dc4881ded0965e9b h'adaf67a78a4bcc91e018f8882762a722000b2507039df0bc
df89d24a54f2e59a', 1bbf0c161bb3155c',
16 16
) )
]]></artwork> ]]></artwork>
<t>where the last value is the key length in bytes for the EDHOC AEAD al gorithm.</t> <t>where the last value is the key length in bytes for the EDHOC AEAD al gorithm.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for K_3 (CBOR Sequence) (36 bytes) info for K_3 (CBOR Sequence) (36 bytes)
03 58 20 df e5 b0 65 e6 4c 72 d2 26 d5 00 c1 2d 49 be e6 dc 48 81 de 03 58 20 ad af 67 a7 8a 4b cc 91 e0 18 f8 88 27 62 a7 22 00 0b 25 07
d0 96 5e 9b df 89 d2 4a 54 f2 e5 9a 10 03 9d f0 bc 1b bf 0c 16 1b b3 15 5c 10
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
K_3 (Raw Value) (16 bytes) K_3 (Raw Value) (16 bytes)
ab 3b 2b 52 a0 4b 6a a3 2f 96 31 19 16 88 3a dd 8e 7a 30 04 20 00 f7 90 0e 81 74 13 1f 75 f3 ed
]]></artwork> ]]></artwork>
<t>The Initiator constructs the input needed to derive the nonce IV_3, s ee <xref section="4.1.2" sectionFormat="of" target="I-D.ietf-lake-edhoc"/>, usin g the EDHOC hash algorithm:</t> <t>The Initiator constructs the input needed to derive the nonce IV_3 (s ee <xref section="4.1.2" sectionFormat="of" target="RFC9528"/>) using the EDHOC hash algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
IV_3 = EDHOC_KDF( PRK_3e2m, 4, TH_3, iv_length ) IV_3 = EDHOC_KDF( PRK_3e2m, 4, TH_3, iv_length )
= HKDF-Expand( PRK_3e2m, info, iv_length ), = HKDF-Expand( PRK_3e2m, info, iv_length )
]]></artwork> ]]></artwork>
<t>where iv_length is the nonce length in bytes for the EDHOC AEAD algor ithm, and info for IV_3 is:</t> <t>where iv_length is the nonce length in bytes for the EDHOC AEAD algor ithm, and info for IV_3 is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
4, 4,
h'dfe5b065e64c72d226d500c12d49bee6dc4881ded0965e9b h'adaf67a78a4bcc91e018f8882762a722000b2507039df0bc
df89d24a54f2e59a', 1bbf0c161bb3155c',
13 13
) )
]]></artwork> ]]></artwork>
<t>where the last value is the nonce length in bytes for the EDHOC AEAD algorithm.</t> <t>where the last value is the nonce length in bytes for the EDHOC AEAD algorithm.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for IV_3 (CBOR Sequence) (36 bytes) info for IV_3 (CBOR Sequence) (36 bytes)
04 58 20 df e5 b0 65 e6 4c 72 d2 26 d5 00 c1 2d 49 be e6 dc 48 81 de 04 58 20 ad af 67 a7 8a 4b cc 91 e0 18 f8 88 27 62 a7 22 00 0b 25 07
d0 96 5e 9b df 89 d2 4a 54 f2 e5 9a 0d 03 9d f0 bc 1b bf 0c 16 1b b3 15 5c 0d
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
IV_3 (Raw Value) (13 bytes) IV_3 (Raw Value) (13 bytes)
05 55 cf a1 6e 40 8d e5 e1 52 3d 04 7d 6d 83 00 c1 e2 3b 56 15 3a e7 0e e4 57
]]></artwork> ]]></artwork>
<t>The Initiator calculates CIPHERTEXT_3 as 'ciphertext' of COSE_Encrypt 0 applied <t>The Initiator calculates CIPHERTEXT_3 as 'ciphertext' of COSE_Encrypt 0 applied
using the EDHOC AEAD algorithm with plaintext PLAINTEXT_3, additional data using the EDHOC AEAD algorithm with plaintext PLAINTEXT_3, additional data
A_3, key K_3 and nonce IV_3.</t> A_3, key K_3, and nonce IV_3.</t>
<artwork><![CDATA[ <artwork><![CDATA[
CIPHERTEXT_3 (Raw Value) (18 bytes) CIPHERTEXT_3 (Raw Value) (18 bytes)
47 3d d1 60 77 dd 71 d6 5b 56 e6 bd 71 e7 a4 9d 60 12 e5 62 09 7b c4 17 dd 59 19 48 5a c7 89 1f fd 90 a9 fc
]]></artwork> ]]></artwork>
<t>message_3 is the CBOR bstr encoding of CIPHERTEXT_3:</t> <t>message_3 is the CBOR bstr encoding of CIPHERTEXT_3:</t>
<artwork><![CDATA[ <artwork><![CDATA[
message_3 (CBOR Sequence) (19 bytes) message_3 (CBOR Sequence) (19 bytes)
52 47 3d d1 60 77 dd 71 d6 5b 56 e6 bd 71 e7 a4 9d 60 12 52 e5 62 09 7b c4 17 dd 59 19 48 5a c7 89 1f fd 90 a9 fc
]]></artwork> ]]></artwork>
<t>The transcript hash TH_4 is calculated using the EDHOC hash algorithm :</t> <t>The transcript hash TH_4 is calculated using the EDHOC hash algorithm :</t>
<t>TH_4 = H( TH_3, PLAINTEXT_3, CRED_I )</t> <t>TH_4 = H( TH_3, PLAINTEXT_3, CRED_I )</t>
<artwork><![CDATA[ <artwork><![CDATA[
Input to calculate TH_4 (CBOR Sequence) (151 bytes) Input to calculate TH_4 (CBOR Sequence) (151 bytes)
58 20 df e5 b0 65 e6 4c 72 d2 26 d5 00 c1 2d 49 be e6 dc 48 81 de d0 58 20 ad af 67 a7 8a 4b cc 91 e0 18 f8 88 27 62 a7 22 00 0b 25 07 03
96 5e 9b df 89 d2 4a 54 f2 e5 9a 2b 48 a5 ee b9 ef fd ab fc 39 a2 02 9d f0 bc 1b bf 0c 16 1b b3 15 5c 2b 48 62 3c 91 df 41 e3 4c 2f a2 02
77 34 32 2d 35 30 2d 33 31 2d 46 46 2d 45 46 2d 33 37 2d 33 32 2d 33 77 34 32 2d 35 30 2d 33 31 2d 46 46 2d 45 46 2d 33 37 2d 33 32 2d 33
39 08 a1 01 a5 01 02 02 41 2b 20 01 21 58 20 ac 75 e9 ec e3 e5 0b fc 39 08 a1 01 a5 01 02 02 41 2b 20 01 21 58 20 ac 75 e9 ec e3 e5 0b fc
8e d6 03 99 88 95 22 40 5c 47 bf 16 df 96 66 0a 41 29 8c b4 30 7f 7e 8e d6 03 99 88 95 22 40 5c 47 bf 16 df 96 66 0a 41 29 8c b4 30 7f 7e
b6 22 58 20 6e 5d e6 11 38 8a 4b 8a 82 11 33 4a c7 d3 7e cb 52 a3 87 b6 22 58 20 6e 5d e6 11 38 8a 4b 8a 82 11 33 4a c7 d3 7e cb 52 a3 87
d2 57 e6 db 3c 2a 93 df 21 ff 3a ff c8 d2 57 e6 db 3c 2a 93 df 21 ff 3a ff c8
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
TH_4 (Raw Value) (32 bytes) TH_4 (Raw Value) (32 bytes)
ba f6 0a db c5 00 fc e7 89 af 25 b1 08 ad a2 27 55 75 05 6c 52 c1 c2 c9 02 b1 e3 a4 32 6c 93 c5 55 1f 5f 3a a6 c5 ec c0 24 68 06 76 56 12
03 6a 2d a4 a6 43 89 1c b4 e5 2b 5d 99 e6 05 9d 6b 6e
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
TH_4 (CBOR Data Item) (34 bytes) TH_4 (CBOR Data Item) (34 bytes)
58 20 ba f6 0a db c5 00 fc e7 89 af 25 b1 08 ad a2 27 55 75 05 6c 52 58 20 c9 02 b1 e3 a4 32 6c 93 c5 55 1f 5f 3a a6 c5 ec c0 24 68 06 76
c1 c2 03 6a 2d a4 a6 43 89 1c b4 56 12 e5 2b 5d 99 e6 05 9d 6b 6e
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="message4-1"> <section anchor="message4-1">
<name>message_4</name> <name>message_4</name>
<t>No external authorization data:</t> <t>No external authorization data:</t>
<t>EAD_4 (CBOR Sequence) (0 bytes)</t> <artwork><![CDATA[
EAD_4 (CBOR Sequence) (0 bytes)
]]></artwork>
<t>The Responder constructs PLAINTEXT_4:</t> <t>The Responder constructs PLAINTEXT_4:</t>
<artwork><![CDATA[ <artwork><![CDATA[
PLAINTEXT_4 = PLAINTEXT_4 =
( (
? EAD_4 ? EAD_4
) )
]]></artwork> ]]></artwork>
<t>PLAINTEXT_4 (CBOR Sequence) (0 bytes)</t> <artwork><![CDATA[
PLAINTEXT_4 (CBOR Sequence) (0 bytes)
]]></artwork>
<t>The Responder constructs the associated data for message_4:</t> <t>The Responder constructs the associated data for message_4:</t>
<artwork><![CDATA[ <artwork><![CDATA[
A_4 = A_4 =
[ [
"Encrypt0", "Encrypt0",
h'', h'',
h'baf60adbc500fce789af25b108ada2275575056c52c1c203 h'c902b1e3a4326c93c5551f5f3aa6c5ecc0246806765612e5
6a2da4a643891cb4' 2b5d99e6059d6b6e'
] ]
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
A_4 (CBOR Data Item) (45 bytes) A_4 (CBOR Data Item) (45 bytes)
83 68 45 6e 63 72 79 70 74 30 40 58 20 ba f6 0a db c5 00 fc e7 89 af 83 68 45 6e 63 72 79 70 74 30 40 58 20 c9 02 b1 e3 a4 32 6c 93 c5 55
25 b1 08 ad a2 27 55 75 05 6c 52 c1 c2 03 6a 2d a4 a6 43 89 1c b4 1f 5f 3a a6 c5 ec c0 24 68 06 76 56 12 e5 2b 5d 99 e6 05 9d 6b 6e
]]></artwork> ]]></artwork>
<t>The Responder constructs the input needed to derive the EDHOC message _4 key, see <xref section="4.1.2" sectionFormat="of" target="I-D.ietf-lake-edhoc "/>, using the EDHOC hash algorithm:</t> <t>The Responder constructs the input needed to derive the EDHOC message _4 key (see <xref section="4.1.2" sectionFormat="of" target="RFC9528"/>) using t he EDHOC hash algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
K_4 = EDHOC_KDF( PRK_4e3m, 8, TH_4, key_length ) K_4 = EDHOC_KDF( PRK_4e3m, 8, TH_4, key_length )
= HKDF-Expand( PRK_4e3m, info, key_length ) = HKDF-Expand( PRK_4e3m, info, key_length )
]]></artwork> ]]></artwork>
<t>where key_length is the key length in bytes for the EDHOC AEAD algori thm, <t>where key_length is the key length in bytes for the EDHOC AEAD algori thm,
and info for K_4 is:</t> and info for K_4 is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
8, 8,
h'baf60adbc500fce789af25b108ada2275575056c52c1c203 h'c902b1e3a4326c93c5551f5f3aa6c5ecc0246806765612e5
6a2da4a643891cb4', 2b5d99e6059d6b6e',
16 16
) )
]]></artwork> ]]></artwork>
<t>where the last value is the key length in bytes for the EDHOC AEAD al gorithm.</t> <t>where the last value is the key length in bytes for the EDHOC AEAD al gorithm.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for K_4 (CBOR Sequence) (36 bytes) info for K_4 (CBOR Sequence) (36 bytes)
08 58 20 ba f6 0a db c5 00 fc e7 89 af 25 b1 08 ad a2 27 55 75 05 6c 08 58 20 c9 02 b1 e3 a4 32 6c 93 c5 55 1f 5f 3a a6 c5 ec c0 24 68 06
52 c1 c2 03 6a 2d a4 a6 43 89 1c b4 10 76 56 12 e5 2b 5d 99 e6 05 9d 6b 6e 10
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
K_4 (Raw Value) (16 bytes) K_4 (Raw Value) (16 bytes)
22 9d 4c 1d 6d 02 33 7b 1c e3 81 a2 bf a7 9b 2e d3 c7 78 72 b6 ee b5 08 91 1b db d3 08 b2 e6 a0
]]></artwork> ]]></artwork>
<t>The Responder constructs the input needed to derive the EDHOC message _4 nonce, see <xref section="4.1.2" sectionFormat="of" target="I-D.ietf-lake-edh oc"/>, using the EDHOC hash algorithm:</t> <t>The Responder constructs the input needed to derive the EDHOC message _4 nonce (see <xref section="4.1.2" sectionFormat="of" target="RFC9528"/>) using the EDHOC hash algorithm:</t>
<artwork><![CDATA[ <artwork><![CDATA[
IV_4 = EDHOC_KDF( PRK_4e3m, 9, TH_4, iv_length ) IV_4 = EDHOC_KDF( PRK_4e3m, 9, TH_4, iv_length )
= HKDF-Expand( PRK_4e3m, info, iv_length ) = HKDF-Expand( PRK_4e3m, info, iv_length )
]]></artwork> ]]></artwork>
<t>where iv_length is the nonce length in bytes for the EDHOC AEAD algor ithm, <t>where iv_length is the nonce length in bytes for the EDHOC AEAD algor ithm,
and info for IV_4 is:</t> and info for IV_4 is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
9, 9,
h'baf60adbc500fce789af25b108ada2275575056c52c1c203 h'c902b1e3a4326c93c5551f5f3aa6c5ecc0246806765612e5
6a2da4a643891cb4', 2b5d99e6059d6b6e',
13 13
) )
]]></artwork> ]]></artwork>
<t>where the last value is the nonce length in bytes for the EDHOC AEAD algorithm.</t> <t>where the last value is the nonce length in bytes for the EDHOC AEAD algorithm.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for IV_4 (CBOR Sequence) (36 bytes) info for IV_4 (CBOR Sequence) (36 bytes)
09 58 20 ba f6 0a db c5 00 fc e7 89 af 25 b1 08 ad a2 27 55 75 05 6c 09 58 20 c9 02 b1 e3 a4 32 6c 93 c5 55 1f 5f 3a a6 c5 ec c0 24 68 06
52 c1 c2 03 6a 2d a4 a6 43 89 1c b4 0d 76 56 12 e5 2b 5d 99 e6 05 9d 6b 6e 0d
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
IV_4 (Raw Value) (13 bytes) IV_4 (Raw Value) (13 bytes)
98 4d 59 ab 25 5e 3d c6 f8 e0 65 5c b6 04 ff 0f 44 45 6e 96 e2 17 85 3c 36 01
]]></artwork> ]]></artwork>
<t>The Responder calculates CIPHERTEXT_4 as 'ciphertext' of COSE_Encrypt 0 applied <t>The Responder calculates CIPHERTEXT_4 as 'ciphertext' of COSE_Encrypt 0 applied
using the EDHOC AEAD algorithm with plaintext PLAINTEXT_4, additional data using the EDHOC AEAD algorithm with plaintext PLAINTEXT_4, additional data
A_4, key K_4 and nonce IV_4.</t> A_4, key K_4, and nonce IV_4.</t>
<artwork><![CDATA[ <artwork><![CDATA[
CIPHERTEXT_4 (8 bytes) CIPHERTEXT_4 (8 bytes)
89 07 43 64 70 a6 e1 9f 28 c9 66 b7 ca 30 4f 83
]]></artwork> ]]></artwork>
<t>message_4 is the CBOR bstr encoding of CIPHERTEXT_4:</t> <t>message_4 is the CBOR bstr encoding of CIPHERTEXT_4:</t>
<artwork><![CDATA[ <artwork><![CDATA[
message_4 (CBOR Sequence) (9 bytes) message_4 (CBOR Sequence) (9 bytes)
48 89 07 43 64 70 a6 e1 9f 48 28 c9 66 b7 ca 30 4f 83
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="out-and-exporter2"> <section anchor="out-and-exporter2">
<name>PRK_out and PRK_exporter</name> <name>PRK_out and PRK_exporter</name>
<t>PRK_out is specified in <xref section="4.1.3" sectionFormat="of" targ et="I-D.ietf-lake-edhoc"/>.</t> <t>PRK_out is specified in <xref section="4.1.3" sectionFormat="of" targ et="RFC9528"/>.</t>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_out = EDHOC_KDF( PRK_4e3m, 7, TH_4, hash_length ) = PRK_out = EDHOC_KDF( PRK_4e3m, 7, TH_4, hash_length )
= HKDF-Expand( PRK_4e3m, info, hash_length ) = HKDF-Expand( PRK_4e3m, info, hash_length )
]]></artwork> ]]></artwork>
<t>where hash_length is the length in bytes of the output of the EDHOC h ash algorithm, and info for PRK_out is:</t> <t>where hash_length is the length in bytes of the output of the EDHOC h ash algorithm, and info for PRK_out is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
7, 7,
h'baf60adbc500fce789af25b108ada2275575056c52c1c203 h'c902b1e3a4326c93c5551f5f3aa6c5ecc0246806765612e5
6a2da4a643891cb4', 2b5d99e6059d6b6e',
32 32
) )
]]></artwork> ]]></artwork>
<t>where the last value is the length in bytes of the output of the EDHO C hash algorithm.</t> <t>where the last value is the length in bytes of the output of the EDHO C hash algorithm.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for PRK_out (CBOR Sequence) (37 bytes) info for PRK_out (CBOR Sequence) (37 bytes)
07 58 20 ba f6 0a db c5 00 fc e7 89 af 25 b1 08 ad a2 27 55 75 05 6c 07 58 20 c9 02 b1 e3 a4 32 6c 93 c5 55 1f 5f 3a a6 c5 ec c0 24 68 06
52 c1 c2 03 6a 2d a4 a6 43 89 1c b4 18 20 76 56 12 e5 2b 5d 99 e6 05 9d 6b 6e 18 20
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_out (Raw Value) (32 bytes) PRK_out (Raw Value) (32 bytes)
6b 2d ae 40 32 30 65 71 cf bc 2e 4f 94 a2 55 fb 9f 1f 3f b2 9c a6 f3 2c 71 af c1 a9 33 8a 94 0b b3 52 9c a7 34 b8 86 f3 0d 1a ba 0b 4d c5
79 fe c9 89 d4 fa 90 dc f0 1b ee ae ab df ea 9e cb f8
]]></artwork> ]]></artwork>
<t>The OSCORE Master Secret and OSCORE Master Salt are derived with the EDHOC_Exporter as specified in 4.2.1 of <xref target="I-D.ietf-lake-edhoc"/>.</t > <t>The OSCORE Master Secret and OSCORE Master Salt are derived with the EDHOC_Exporter as specified in <xref target="RFC9528" sectionFormat="of" section ="4.2.1"/>.</t>
<artwork><![CDATA[ <artwork><![CDATA[
EDHOC_Exporter( label, context, length ) EDHOC_Exporter( exporter_label, context, length )
= EDHOC_KDF( PRK_exporter, label, context, length ) = EDHOC_KDF( PRK_exporter, exporter_label, context, length )
]]></artwork> ]]></artwork>
<t>where PRK_exporter is derived from PRK_out:</t> <t>where PRK_exporter is derived from PRK_out:</t>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_exporter = EDHOC_KDF( PRK_out, 10, h'', hash_length ) = PRK_exporter = EDHOC_KDF( PRK_out, 10, h'', hash_length )
= HKDF-Expand( PRK_out, info, hash_length ) = HKDF-Expand( PRK_out, info, hash_length )
]]></artwork> ]]></artwork>
<t>where hash_length is the length in bytes of the output of the EDHOC h ash algorithm, and info for the PRK_exporter is:</t> <t>where hash_length is the length in bytes of the output of the EDHOC h ash algorithm, and info for the PRK_exporter is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
10, 10,
h'', h'',
32 32
) )
]]></artwork> ]]></artwork>
<t>where the last value is the length in bytes of the output of the EDHO C hash algorithm.</t> <t>where the last value is the length in bytes of the output of the EDHO C hash algorithm.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for PRK_exporter (CBOR Sequence) (4 bytes) info for PRK_exporter (CBOR Sequence) (4 bytes)
0a 40 18 20 0a 40 18 20
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_exporter (Raw Value) (32 bytes) PRK_exporter (Raw Value) (32 bytes)
4f 0a 5a 82 3d 06 d0 00 5e 1b ec da 8a 6e 61 f3 c8 c6 7a 8b 15 da 7d e1 4d 06 69 9c ee 24 8c 5a 04 bf 92 27 bb cd 4c e3 94 de 7d cb 56 db
44 d3 58 5e c5 85 4e 91 e2 43 55 54 74 17 1e 64 46 db
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="oscore-parameters"> <section anchor="oscore-parameters">
<name>OSCORE Parameters</name> <name>OSCORE Parameters</name>
<t>The derivation of OSCORE parameters is specified in <xref section="A. <t>The derivation of OSCORE parameters is specified in <xref section="A.
1" sectionFormat="of" target="I-D.ietf-lake-edhoc"/>.</t> 1" sectionFormat="of" target="RFC9528"/>.</t>
<t>The AEAD and Hash algorithms to use in OSCORE are given by the select <t>The AEAD and hash algorithms to use in OSCORE are given by the select
ed cipher suite:</t> ed cipher suite:</t>
<artwork><![CDATA[ <artwork><![CDATA[
Application AEAD Algorithm (int) Application AEAD Algorithm (int)
10 10
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
Application Hash Algorithm (int) Application Hash Algorithm (int)
-16 -16
]]></artwork> ]]></artwork>
<t>The mapping from EDHOC connection identifiers to OSCORE Sender/Recipi ent IDs <t>The mapping from EDHOC connection identifiers to OSCORE Sender/Recipi ent IDs
is defined in <xref section="3.3.3" sectionFormat="of" target="I-D.ietf-lake-edh oc"/>.</t> is defined in <xref section="3.3.3" sectionFormat="of" target="RFC9528"/>.</t>
<t>C_R is mapped to the Recipient ID of the server, i.e., the Sender ID of the client. The byte string 0x27, which as C_R is encoded as the CBOR integer 0x27, is converted to the server Recipient ID 0x27.</t> <t>C_R is mapped to the Recipient ID of the server, i.e., the Sender ID of the client. The byte string 0x27, which as C_R is encoded as the CBOR integer 0x27, is converted to the server Recipient ID 0x27.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Client's OSCORE Sender ID (Raw Value) (1 byte) Client's OSCORE Sender ID (Raw Value) (1 byte)
27 27
]]></artwork> ]]></artwork>
<t>C_I is mapped to the Recipient ID of the client, i.e., the Sender ID of the server. The byte string 0x37, which as C_I is encoded as the CBOR integer 0x0e is converted to the client Recipient ID 0x37.</t> <t>C_I is mapped to the Recipient ID of the client, i.e., the Sender ID of the server. The byte string 0x37, which as C_I is encoded as the CBOR integer 0x0e, is converted to the client Recipient ID 0x37.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Server's OSCORE Sender ID (Raw Value) (1 byte) Server's OSCORE Sender ID (Raw Value) (1 byte)
37 37
]]></artwork> ]]></artwork>
<t>The OSCORE Master Secret is computed through EDHOC_Expand() using the <t>The OSCORE Master Secret is computed through EDHOC_Expand() using the
Application hash algorithm, see <xref section="A.1" sectionFormat="of" target="I -D.ietf-lake-edhoc"/>:</t> application hash algorithm (see <xref section="A.1" sectionFormat="of" target="R FC9528"/>):</t>
<artwork><![CDATA[ <artwork><![CDATA[
OSCORE Master Secret = EDHOC_Exporter( 0, h'', oscore_key_length ) OSCORE Master Secret = EDHOC_Exporter( 0, h'', oscore_key_length )
= EDHOC_KDF( PRK_exporter, 0, h'', oscore_key_length ) = EDHOC_KDF( PRK_exporter, 0, h'', oscore_key_length )
= HKDF-Expand( PRK_exporter, info, oscore_key_length ) = HKDF-Expand( PRK_exporter, info, oscore_key_length )
]]></artwork> ]]></artwork>
<t>where oscore_key_length is by default the key length in bytes for the Application AEAD <t>where oscore_key_length is by default the key length in bytes for the application AEAD
algorithm, and info for the OSCORE Master Secret is:</t> algorithm, and info for the OSCORE Master Secret is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
0, 0,
h'', h'',
16 16
) )
]]></artwork> ]]></artwork>
<t>where the last value is the key length in bytes for the Application A EAD algorithm.</t> <t>where the last value is the key length in bytes for the application A EAD algorithm.</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for OSCORE Master Secret (CBOR Sequence) (3 bytes) info for OSCORE Master Secret (CBOR Sequence) (3 bytes)
00 40 10 00 40 10
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
OSCORE Master Secret (Raw Value) (16 bytes) OSCORE Master Secret (Raw Value) (16 bytes)
8c 40 9a 33 22 23 ad 90 0e 44 f3 43 4d 2d 2c e3 f9 86 8f 6a 3a ca 78 a0 5d 14 85 b3 50 30 b1 62
]]></artwork> ]]></artwork>
<t>The OSCORE Master Salt is computed through EDHOC_Expand() using the A pplication hash algorithm, see <xref section="4.2" sectionFormat="of" target="I- D.ietf-lake-edhoc"/>:</t> <t>The OSCORE Master Salt is computed through EDHOC_Expand() using the a pplication hash algorithm (see <xref section="4.2" sectionFormat="of" target="RF C9528"/>):</t>
<artwork><![CDATA[ <artwork><![CDATA[
OSCORE Master Salt = EDHOC_Exporter( 1, h'', oscore_salt_length ) OSCORE Master Salt = EDHOC_Exporter( 1, h'', oscore_salt_length )
= EDHOC_KDF( PRK_exporter, 1, h'', oscore_salt_length ) = EDHOC_KDF( PRK_exporter, 1, h'', oscore_salt_length )
= HKDF-Expand( PRK_4x3m, info, oscore_salt_length ) = HKDF-Expand( PRK_4x3m, info, oscore_salt_length )
]]></artwork> ]]></artwork>
<t>where oscore_salt_length is the length in bytes of the OSCORE Master Salt, and info for the OSCORE Master Salt is:</t> <t>where oscore_salt_length is the length in bytes of the OSCORE Master Salt, and info for the OSCORE Master Salt is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
1, 1,
h'', h'',
8 8
) )
]]></artwork> ]]></artwork>
<t>where the last value is the length in bytes of the OSCORE Master Salt .</t> <t>where the last value is the length in bytes of the OSCORE Master Salt .</t>
<artwork><![CDATA[ <artwork><![CDATA[
info for OSCORE Master Salt (CBOR Sequence) (3 bytes) info for OSCORE Master Salt (CBOR Sequence) (3 bytes)
01 40 08 01 40 08
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
OSCORE Master Salt (Raw Value) (8 bytes) OSCORE Master Salt (Raw Value) (8 bytes)
61 63 f4 4b e8 62 ad fa ad a2 4c 7d bf c8 5e eb
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="key-update-1"> <section anchor="key-update-1">
<name>Key Update</name> <name>Key Update</name>
<t>Key update is defined in <xref section="H" sectionFormat="of" target= "I-D.ietf-lake-edhoc"/>.</t> <t>The key update is defined in <xref section="H" sectionFormat="of" tar get="RFC9528"/>.</t>
<artwork><![CDATA[ <artwork><![CDATA[
EDHOC_KeyUpdate( context ): EDHOC_KeyUpdate( context ):
PRK_out = EDHOC_KDF( PRK_out, 11, context, hash_length ) PRK_out = EDHOC_KDF( PRK_out, 11, context, hash_length )
= HKDF-Expand( PRK_out, info, hash_length ) = HKDF-Expand( PRK_out, info, hash_length )
]]></artwork> ]]></artwork>
<t>where hash_length is the length in bytes of the output of the EDHOC h ash function, context for KeyUpdate is</t> <t>where hash_length is the length in bytes of the output of the EDHOC h ash function, and the context for KeyUpdate is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
context for KeyUpdate (Raw Value) (16 bytes) context for KeyUpdate (Raw Value) (16 bytes)
a0 11 58 fd b8 20 89 0c d6 be 16 96 02 b8 bc ea a0 11 58 fd b8 20 89 0c d6 be 16 96 02 b8 bc ea
]]></artwork> ]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
context for KeyUpdate (CBOR Data Item) (17 bytes) context for KeyUpdate (CBOR Data Item) (17 bytes)
50 a0 11 58 fd b8 20 89 0c d6 be 16 96 02 b8 bc ea 50 a0 11 58 fd b8 20 89 0c d6 be 16 96 02 b8 bc ea
]]></artwork> ]]></artwork>
<t>and where info for key update is:</t> <t>and where info for the key update is:</t>
<artwork><![CDATA[ <artwork><![CDATA[
info = info =
( (
11, 11,
h'a01158fdb820890cd6be169602b8bcea', h'a01158fdb820890cd6be169602b8bcea',
32 32
) )
]]></artwork> ]]></artwork>
<artwork><![CDATA[
info for KeyUpdate (CBOR Sequence) (20 bytes)
0b 50 a0 11 58 fd b8 20 89 0c d6 be 16 96 02 b8 bc ea 18 20
]]></artwork>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_out after KeyUpdate (Raw Value) (32 bytes) PRK_out after KeyUpdate (Raw Value) (32 bytes)
5e 5e fc ae dd a8 d1 85 bb 7e 26 1d f1 91 59 1c d9 f7 c9 20 49 e7 0c f9 79 53 77 43 fe 0b d6 b9 b1 41 dd bd 79 65 6c 52 e6 dc 7c 50 ad 80
23 f6 b4 34 e3 6d fc 1d 1c 77 54 d7 4d 07 e8 7d 0d 16
]]></artwork> ]]></artwork>
<t>After key update the PRK_exporter needs to be derived anew:</t> <t>After the key update, the PRK_exporter needs to be derived anew:</t>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_exporter = EDHOC_KDF( PRK_out, 10, h'', hash_length ) = PRK_exporter = EDHOC_KDF( PRK_out, 10, h'', hash_length )
= HKDF-Expand( PRK_out, info, hash_length ) = HKDF-Expand( PRK_out, info, hash_length )
]]></artwork> ]]></artwork>
<t>where info and hash_length are unchanged as in <xref target="out-and- exporter2"/>.</t> <t>where info and hash_length are unchanged as in <xref target="out-and- exporter2"/>.</t>
<artwork><![CDATA[ <artwork><![CDATA[
PRK_exporter (Raw Value) (32 bytes) PRK_exporter after KeyUpdate (Raw Value) (32 bytes)
bb b3 b7 72 6e 97 9c 1b b3 46 a3 f9 2b f4 e0 28 8d 52 62 7f b5 e7 9a 00 fc f7 db 9b 2e ad 73 82 4e 7e 83 03 63 c8 05 c2 96 f9 02 83 0f ac
fd b3 b2 82 02 fd 2e 48 97 23 d8 6c 35 9c 75 2f 0f 17
]]></artwork> ]]></artwork>
<t>The OSCORE Master Secret is derived with the updated PRK_exporter:</t > <t>The OSCORE Master Secret is derived with the updated PRK_exporter:</t >
<artwork><![CDATA[ <artwork><![CDATA[
OSCORE Master Secret = OSCORE Master Secret
= HKDF-Expand(PRK_exporter, info, oscore_key_length) = HKDF-Expand( PRK_exporter, info, oscore_key_length )
]]></artwork> ]]></artwork>
<t>where info and key_length are unchanged as in <xref target="oscore-pa ram"/>.</t> <t>where info and oscore_key_length are unchanged as in <xref target="os core-param"/>.</t>
<artwork><![CDATA[ <artwork><![CDATA[
OSCORE Master Secret after KeyUpdate (Raw Value) (16 bytes) OSCORE Master Secret after KeyUpdate (Raw Value) (16 bytes)
c9 1b 16 4c 81 0b 29 a6 3f cb 73 e5 1b c4 55 f3 49 f7 2f ac 02 b4 65 8b da 21 e2 da c6 6f c3 74
]]></artwork> ]]></artwork>
<t>The OSCORE Master Salt is derived with the updated PRK_exporter:</t> <t>The OSCORE Master Salt is derived with the updated PRK_exporter:</t>
<artwork><![CDATA[ <artwork><![CDATA[
OSCORE Master Salt = HKDF-Expand(PRK_exporter, info, salt_length) OSCORE Master Salt = HKDF-Expand( PRK_exporter, info, oscore_salt_length )
]]></artwork> ]]></artwork>
<t>where info and salt_length are unchanged as in <xref target="oscore-p aram"/>.</t> <t>where info and oscore_salt_length are unchanged as in <xref target="o score-parameters"/>.</t>
<artwork><![CDATA[ <artwork><![CDATA[
OSCORE Master Salt after KeyUpdate (Raw Value) (8 bytes) OSCORE Master Salt after KeyUpdate (Raw Value) (8 bytes)
73 ce 79 24 59 40 36 80 dd 8b 24 f2 aa 9b 01 1a
]]></artwork> ]]></artwork>
</section> </section>
</section> </section>
<section anchor="sec-trace-invalid"> <section anchor="sec-trace-invalid">
<name>Invalid Traces</name> <name>Invalid Traces</name>
<t>This section contains examples of invalid messages, which a compliant i mplementation will not compose and must or may reject according to <xref target= "I-D.ietf-lake-edhoc"/>, <xref target="RFC8949"/>, <xref target="RFC9053"/>, and <xref target="SP-800-56A"/>. This is just a small set of examples of different reasons a message might be invalid. The same types of invalidities applies to ot her fields and messages as well. Implementations should make sure to check for s imilar types of invalidities in all EHDOC fields and messages.</t> <t>This section contains examples of invalid messages, which a compliant i mplementation will not compose and must or may reject according to <xref target= "RFC9528"/>, <xref target="RFC8949"/>, <xref target="RFC9053"/>, and <xref targe t="SP-800-56A"/>. This is just a small set of examples of different reasons for which a message might be invalid. The same types of invalidities apply to other fields and messages as well. Implementations should make sure to check for simil ar types of invalidities in all EDHOC fields and messages.</t>
<section anchor="encoding-errors"> <section anchor="encoding-errors">
<name>Encoding Errors</name> <name>Encoding Errors</name>
<section anchor="surplus-array-encoding-of-message"> <section anchor="surplus-array-encoding-of-message">
<name>Surplus array encoding of message</name> <name>Surplus Array Encoding of a Message</name>
<t>Invalid encoding of message_1 as array. Correct encoding is a CBOR <t>message_1 is incorrectly encoded as a CBOR array. The correct encod
sequence according to Section 5.2.1 of <xref target="I-D.ietf-lake-edhoc"/>.</t> ing is a CBOR sequence according to <xref target="RFC9528" section="5.2.1" secti
onFormat="of" />.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Invalid message_1 (38 bytes) Invalid message_1 (38 bytes)
84 03 02 58 20 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b ea 5b 84 03 02 58 20 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b ea 5b
3d 8f 65 f3 26 20 b7 49 be e8 d2 78 ef a9 0e 3d 8f 65 f3 26 20 b7 49 be e8 d2 78 ef a9 0e
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="surplus-bstr-encoding-of-connection-identifier"> <section anchor="surplus-bstr-encoding-of-connection-identifier">
<name>Surplus bstr encoding of connection identifier</name> <name>Surplus bstr Encoding of the Connection Identifier</name>
<t>Invalid encoding 41 0e of C_I = 0x0e. Correct encoding is 0e accord <t>The connection identifier C_I = 0x0e is incorrectly encoded as the
ing to Section 3.3.2 of <xref target="I-D.ietf-lake-edhoc"/>.</t> CBOR byte string 41 0e. The correct encoding is the integer 0e according to <xr
ef target="RFC9528" section="3.3.2" sectionFormat="of" />.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Invalid message_1 (38 bytes) Invalid message_1 (38 bytes)
03 02 58 20 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b ea 5b 3d 03 02 58 20 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b ea 5b 3d
8f 65 f3 26 20 b7 49 be e8 d2 78 ef a9 41 0e 8f 65 f3 26 20 b7 49 be e8 d2 78 ef a9 41 0e
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="surplus-array-encoding-of-ciphersuite"> <section anchor="surplus-array-encoding-of-ciphersuite">
<name>Surplus array encoding of ciphersuite</name> <name>Surplus Array Encoding of the Ciphersuite</name>
<t>Invalid array encoding 81 02 of SUITES_I = 2. Correct encoding is 0 <t>The element SUITES_I = 2 is incorrectly encoded as the CBOR array 8
2 according to Section 5.2.2 of <xref target="I-D.ietf-lake-edhoc"/>.</t> 1 02. The correct encoding is the integer 02 according to <xref target="RFC9528"
section="5.2.2" sectionFormat="of" />.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Invalid message_1 (38 bytes) Invalid message_1 (38 bytes)
03 81 02 58 20 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b ea 5b 03 81 02 58 20 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b ea 5b
3d 8f 65 f3 26 20 b7 49 be e8 d2 78 ef a9 0e 3d 8f 65 f3 26 20 b7 49 be e8 d2 78 ef a9 0e
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="text-string-encoding-of-ephemeral-key"> <section anchor="text-string-encoding-of-ephemeral-key">
<name>Text string encoding of ephemeral key</name> <name>Text String Encoding of the Ephemeral Key</name>
<t>Invalid type of the third element (G_X). Correct encoding is a byte <t>The third element of message_1 (G_X) is incorrectly encoded as a te
string according to Section 5.2.1 of <xref target="I-D.ietf-lake-edhoc"/>.</t> xt string. The correct encoding is a byte string according to <xref target="RFC9
528" section="5.2.1" sectionFormat="of" />.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Invalid message_1 (37 bytes) Invalid message_1 (37 bytes)
03 02 78 20 20 61 69 72 20 73 70 65 65 64 20 6F 66 20 61 20 75 6E 6C 03 02 78 20 20 61 69 72 20 73 70 65 65 64 20 6F 66 20 61 20 75 6E 6C
61 64 65 6E 20 73 77 61 6C 6C 6F 77 20 0e 61 64 65 6E 20 73 77 61 6C 6C 6F 77 20 0e
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="wrong-number-of-cbor-sequence-elements"> <section anchor="wrong-number-of-cbor-sequence-elements">
<name>Wrong number of CBOR sequence elements</name> <name>Wrong Number of CBOR Sequence Elements</name>
<t>Invalid number of elements in the CBOR sequence. Correct number of <t>The CBOR sequence in message_2 has an incorrect number of elements.
elements is 1 according to Section 5.3.1 of <xref target="I-D.ietf-lake-edhoc"/> The correct number of elements in the CBOR sequence is 1 according to <xref tar
.</t> get="RFC9528" section="5.3.1" sectionFormat="of" />.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Invalid message_2 (46 bytes) Invalid message_2 (46 bytes)
58 20 41 97 01 d7 f0 0a 26 c2 dc 58 7a 36 dd 75 25 49 f3 37 63 c8 93 58 20 41 97 01 d7 f0 0a 26 c2 dc 58 7a 36 dd 75 25 49 f3 37 63 c8 93
42 2c 8e a0 f9 55 a1 3a 4f f5 d5 4B 98 62 a1 1d e4 2a 95 d7 85 38 6a 42 2c 8e a0 f9 55 a1 3a 4f f5 d5 4B 98 62 a1 1d e4 2a 95 d7 85 38 6a
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="surplus-map-encoding-of-idcred-field"> <section anchor="surplus-map-encoding-of-idcred-field">
<name>Surplus map encoding of ID_CRED field</name> <name>Surplus Map Encoding of the ID_CRED Field</name>
<t>Invalid encoding a1 04 42 32 10 of ID_CRED_R in PLAINTEXT_2. Correc <t>The element ID_CRED_R in PLAINTEXT_2 is incorrectly encoded as the
t encoding is 42 32 10 according to Section 3.5.3.2 of <xref target="I-D.ietf-la map a1 04 42 32 10. The correct encoding is 42 32 10 according to <xref target="
ke-edhoc"/>.</t> RFC9528" section="3.5.3.2" sectionFormat="of" />.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Invalid PLAINTEXT_2 (15 bytes) Invalid PLAINTEXT_2 (15 bytes)
27 a1 04 42 32 10 48 fa 5e fa 2e bf 92 0b f3 27 a1 04 42 32 10 48 fa 5e fa 2e bf 92 0b f3
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="surplus-bstr-encoding-of-idcred-field"> <section anchor="surplus-bstr-encoding-of-idcred-field">
<name>Surplus bstr encoding of ID_CRED field</name> <name>Surplus bstr Encoding of the ID_CRED Field</name>
<t>Invalid encoding 41 32 of ID_CRED_R in PLAINTEXT_2. Correct encodin <t>The element ID_CRED_R in PLAINTEXT_2 is incorrectly encoded as the
g is 32 according to Section 3.5.3.2 of <xref target="I-D.ietf-lake-edhoc"/>.</t byte string 41 32. The correct encoding is 32 according to <xref target="RFC9528
> " section="3.5.3.2" sectionFormat="of" />.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Invalid PLAINTEXT_2 (12 bytes) Invalid PLAINTEXT_2 (12 bytes)
27 41 32 48 fa 5e fa 2e bf 92 0b f3 27 41 32 48 fa 5e fa 2e bf 92 0b f3
]]></artwork> ]]></artwork>
</section> </section>
</section> </section>
<section anchor="crypto-related-errors"> <section anchor="crypto-related-errors">
<name>Crypto-related Errors</name> <name>Cryptography-Related Errors</name>
<section anchor="error-in-length-of-ephemeral-key"> <section anchor="error-in-length-of-ephemeral-key">
<name>Error in length of ephemeral key</name> <name>Error in the Length of the Ephemeral Key</name>
<t>Invalid length of the third element (G_X). Selected cipher suite is <t>The third element (G_X) has an invalid length. The selected cipher
cipher suite 24 with curve P-384 according to Sections 5.2.2, and 10.2 of <xref suite is cipher suite 24 with curve P-384 according to Sections <xref target="RF
target="I-D.ietf-lake-edhoc"/>. Correct length of x-coordinate is 48 bytes acco C9528" sectionFormat="bare" section="5.2.2"/> and <xref target="RFC9528" section
rding to Section 3.7 of <xref target="I-D.ietf-lake-edhoc"/> and Section 7.1.1 o Format="bare" section="10.2"/> of <xref target="RFC9528"/>. The correct length o
f <xref target="RFC9053"/>.</t> f the x-coordinate is 48 bytes according to <xref target="RFC9528" section="3.7"
sectionFormat="of" /> and <xref target="RFC9053" section="7.1.1" sectionFormat=
"of" />.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Invalid message_1 (40 bytes) Invalid message_1 (40 bytes)
03 82 02 18 18 58 20 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b 03 82 02 18 18 58 20 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b
ea 5b 3d 8f 65 f3 26 20 b7 49 be e8 d2 78 ef a9 0e ea 5b 3d 8f 65 f3 26 20 b7 49 be e8 d2 78 ef a9 0e
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="error-in-elliptic-curve-representation"> <section anchor="error-in-elliptic-curve-representation">
<name>Error in elliptic curve representation</name> <name>Error in Elliptic Curve Representation</name>
<t>Invalid x-coordinate in G_X as x <contact fullname="≥"/> p. Require <t>The x-coordinate in G_X is invalid as x p. It is required that x
ment that x &lt; p according to Section 9.2 of <xref target="I-D.ietf-lake-edhoc &lt; p according to Section 5.6.2.3 of <xref target="SP-800-56A"/>, which is re
"/> and Section 5.6.2.3 of <xref target="SP-800-56A"/>.</t> ferenced in <xref target="RFC9528" section="9.2" sectionFormat="of" />.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Invalid message_1 (37 bytes) Invalid message_1 (37 bytes)
03 02 58 20 ff ff ff ff 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 03 02 58 20 ff ff ff ff 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00
00 ff ff ff ff ff ff ff ff ff ff ff ff 0e 00 ff ff ff ff ff ff ff ff ff ff ff ff 0e
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="error-in-elliptic-curve-point"> <section anchor="error-in-elliptic-curve-point">
<name>Error in elliptic curve point</name> <name>Error in the Elliptic Curve Point</name>
<t>Invalid x-coordinate in (G_X) not corresponding to a point on the P <t>The x-coordinate in G_X is invalid as it does not correspond to a p
-256 curve. Requirement that y<sup>2</sup> <contact fullname="≡"/> x<sup>3</sup> oint on the P-256 curve. It is required that y<sup>2</sup> x<sup>3</sup> + a
+ a <contact fullname="⋅"/> x + b (mod p) according to Section 9.2 of <xref tar x + b (mod p) according to Section 5.6.2.3 of <xref target="SP-800-56A"/>, whic
get="I-D.ietf-lake-edhoc"/> and Section 5.6.2.3 of <xref target="SP-800-56A"/>.< h is referenced in <xref target="RFC9528" section="9.2" sectionFormat="of" />.</
/t> t>
<artwork><![CDATA[ <artwork><![CDATA[
Invalid message_1 (37 bytes) Invalid message_1 (37 bytes)
03 02 58 20 a0 4e 73 60 1d f5 44 a7 0b a7 ea 1e 57 03 0f 7d 4b 4e b7 03 02 58 20 a0 4e 73 60 1d f5 44 a7 0b a7 ea 1e 57 03 0f 7d 4b 4e b7
f6 73 92 4e 58 d5 4c a7 7a 5e 7d 4d 4a 0e f6 73 92 4e 58 d5 4c a7 7a 5e 7d 4d 4a 0e
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="curve-point-of-low-order"> <section anchor="curve-point-of-low-order">
<name>Curve point of low order</name> <name>Curve Point of the Low Order</name>
<t>Curve25519 point of low order which fails the check for all-zero ou <t>The Curve25519 point is invalid as it is of low order and fails the
tput according to Section 9.2 of <xref target="I-D.ietf-lake-edhoc"/>.</t> check for all-zero output according to <xref target="RFC9528" section="9.2" sec
tionFormat="of" />.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Invalid message_1 (37 bytes) Invalid message_1 (37 bytes)
03 00 58 20 ed ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 03 00 58 20 ed ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff 7f 0e ff ff ff ff ff ff ff ff ff ff ff ff 7f 0e
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="error-in-length-of-mac"> <section anchor="error-in-length-of-mac">
<name>Error in length of MAC</name> <name>Error in the Length of the MAC</name>
<t>Invalid length of third element (Signature_or_MAC_2). The length of <t>The third element (Signature_or_MAC_2) has an invalid length. The l
Signature_or_MAC_2 is given by the cipher suite and the MAC length is at least ength of Signature_or_MAC_2 is given by the cipher suite, and the MAC length is
8 bytes according to Section 9.3 of <xref target="I-D.ietf-lake-edhoc"/>.</t> at least 8 bytes according to <xref target="RFC9528" section="9.3" sectionFormat
="of" />.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Invalid PLAINTEXT_2 (7 bytes) Invalid PLAINTEXT_2 (7 bytes)
27 32 44 fa 5e fa 2e 27 32 44 fa 5e fa 2e
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="error-in-elliptic-curve-encoding"> <section anchor="error-in-elliptic-curve-encoding">
<name>Error in elliptic curve encoding</name> <name>Error in the Elliptic Curve Encoding</name>
<t>Invalid encoding of third element (G_X). Correct encoding is with l <t>The third element (G_X) is incorrectly encoded. The correct encodin
eading zeros according to Section 3.7 of <xref target="I-D.ietf-lake-edhoc"/> an g is with leading-zero octets according to <xref target="RFC9053" section="7.1.1
d Section 7.1.1 of <xref target="RFC9053"/>.</t> " sectionFormat="of" />, which is referenced in <xref target="RFC9528" section="
3.7" sectionFormat="of" />.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Invalid message_1 (36 bytes) Invalid message_1 (36 bytes)
03 02 58 1f d9 69 77 25 d2 3a 68 8b 12 d1 c7 e0 10 8a 08 c9 f7 1a 85 03 02 58 1f d9 69 77 25 d2 3a 68 8b 12 d1 c7 e0 10 8a 08 c9 f7 1a 85
a0 9c 20 81 49 76 ab 21 12 22 48 fc 0e a0 9c 20 81 49 76 ab 21 12 22 48 fc 0e
]]></artwork> ]]></artwork>
</section> </section>
</section> </section>
<section anchor="non-deterministic-cbor"> <section anchor="non-deterministic-cbor">
<name>Non-deterministic CBOR</name> <name>Non-deterministic CBOR</name>
<section anchor="unnecessary-long-encoding"> <section anchor="unnecessary-long-encoding">
<name>Unnecessary long encoding</name> <name>Unnecessary Long Encoding</name>
<t>Invalid 16-bit encoding 19 00 03 of METHOD = 3. Correct is the dete <t>The element METHOD = 3 is incorrectly encoded as a 16-bit integer.
rministic encoding 03 according to Section 3.1 of <xref target="I-D.ietf-lake-ed The deterministic encoding 03 is correct according to <xref target="RFC9528" sec
hoc"/> and Section 4.2.1 of <xref target="RFC8949"/>, which states that the argu tion="3.1" sectionFormat="of" /> and <xref target="RFC8949" section="4.2.1" sect
ments for integers, lengths in major types 2 through 5, and tags are required to ionFormat="of" />, which states that the arguments for integers, lengths in majo
be as short as possible.</t> r types 2 through 5, and tags are required to be as short as possible.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Invalid message_1 (39 bytes) Invalid message_1 (39 bytes)
19 00 03 02 58 20 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b ea 19 00 03 02 58 20 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b ea
5b 3d 8f 65 f3 26 20 b7 49 be e8 d2 78 ef a9 0e 5b 3d 8f 65 f3 26 20 b7 49 be e8 d2 78 ef a9 0e
]]></artwork> ]]></artwork>
</section> </section>
<section anchor="indefinite-length-array-encoding"> <section anchor="indefinite-length-array-encoding">
<name>Indefinite-length array encoding</name> <name>Indefinite-Length Array Encoding</name>
<t>Invalid indefinite-length array encoding 9F 06 02 FF of SUITES_I = <t>The element SUITES_I = [6, 2] is incorrectly encoded as an indefini
[6, 2]. Correct encoding is 82 06 02 according to Section 5.2.2 of <xref target= te-length array. The correct encoding is the definite-length array 82 06 02 acco
"I-D.ietf-lake-edhoc"/>.</t> rding to <xref target="RFC8949" section="4.2.1" sectionFormat="of"/>, which is r
eferenced in <xref target="RFC9528" section="3.1" sectionFormat="of" />.</t>
<artwork><![CDATA[ <artwork><![CDATA[
Invalid message_1 (40 bytes) Invalid message_1 (40 bytes)
03 9F 06 02 FF 58 20 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b 03 9F 06 02 FF 58 20 74 1a 13 d7 ba 04 8f bb 61 5e 94 38 6a a3 b6 1b
ea 5b 3d 8f 65 f3 26 20 b7 49 be e8 d2 78 ef a9 0e ea 5b 3d 8f 65 f3 26 20 b7 49 be e8 d2 78 ef a9 0e
]]></artwork> ]]></artwork>
</section> </section>
</section> </section>
</section> </section>
<section anchor="security"> <section anchor="security">
<name>Security Considerations</name> <name>Security Considerations</name>
<t>This document contains examples of EDHOC <xref target="I-D.ietf-lake-ed hoc"/> whose security considerations apply. The keys printed in these examples c annot be considered secret and MUST NOT be used.</t> <t>This document contains examples of EDHOC <xref target="RFC9528"/>. The security considerations described in <xref target="RFC9528"/> apply. The keys pr inted in these examples cannot be considered secret and <bcp14>MUST NOT</bcp14> be used.</t>
</section> </section>
<section anchor="iana"> <section anchor="iana">
<name>IANA Considerations</name> <name>IANA Considerations</name>
<t>There are no IANA considerations.</t> <t>This document has no IANA actions.</t>
</section> </section>
</middle> </middle>
<back> <back>
<references> <references>
<name>References</name> <name>References</name>
<references> <references anchor="sec-normative-references">
<name>Normative References</name> <name>Normative References</name>
<reference anchor="I-D.ietf-lake-edhoc"> <!-- [I-D.ietf-lake-edhoc] is the companion document RFC 9528 -->
<front>
<title>Ephemeral Diffie-Hellman Over COSE (EDHOC)</title> <reference anchor='RFC9528'>
<author fullname="Göran Selander" initials="G." surname="Selander"> <front>
<organization>Ericsson AB</organization> <title>Ephemeral Diffie-Hellman Over COSE (EDHOC)</title>
</author> <author initials='G' surname='Selander' fullname='Göran Selander'>
<author fullname="John Preuß Mattsson" initials="J. P." surname="Mat <organization />
tsson"> </author>
<organization>Ericsson AB</organization> <author initials='J' surname='Preuß Mattsson' fullname='John Preuß Mattsson'>
</author> <organization />
<author fullname="Francesca Palombini" initials="F." surname="Palomb </author>
ini"> <author initials='F' surname='Palombini' fullname='Francesca Palombini'>
<organization>Ericsson AB</organization> <organization />
</author> </author>
<date day="25" month="August" year="2023"/> <date year='2024' month='March'/>
<abstract> </front>
<t> This document specifies Ephemeral Diffie-Hellman Over COSE ( <seriesInfo name="RFC" value="9528"/>
EDHOC), a <seriesInfo name="DOI" value="10.17487/RFC9528"/>
very compact and lightweight authenticated Diffie-Hellman key </reference>
exchange with ephemeral keys. EDHOC provides mutual authentication,
forward secrecy, and identity protection. EDHOC is intended for <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml"
usage in constrained scenarios and a main use case is to establish an />
OSCORE security context. By reusing COSE for cryptography, CBOR for <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8174.xml"
encoding, and CoAP for transport, the additional code size can be />
kept very low.
</t>
</abstract>
</front>
<seriesInfo name="Internet-Draft" value="draft-ietf-lake-edhoc-22"/>
</reference>
<reference anchor="RFC2119">
<front>
<title>Key words for use in RFCs to Indicate Requirement Levels</tit
le>
<author fullname="S. Bradner" initials="S." surname="Bradner"/>
<date month="March" year="1997"/>
<abstract>
<t>In many standards track documents several words are used to sig
nify the requirements in the specification. These words are often capitalized. T
his document defines these words as they should be interpreted in IETF documents
. This document specifies an Internet Best Current Practices for the Internet Co
mmunity, and requests discussion and suggestions for improvements.</t>
</abstract>
</front>
<seriesInfo name="BCP" value="14"/>
<seriesInfo name="RFC" value="2119"/>
<seriesInfo name="DOI" value="10.17487/RFC2119"/>
</reference>
<reference anchor="RFC8174">
<front>
<title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</ti
tle>
<author fullname="B. Leiba" initials="B." surname="Leiba"/>
<date month="May" year="2017"/>
<abstract>
<t>RFC 2119 specifies common key words that may be used in protoco
l specifications. This document aims to reduce the ambiguity by clarifying that
only UPPERCASE usage of the key words have the defined special meanings.</t>
</abstract>
</front>
<seriesInfo name="BCP" value="14"/>
<seriesInfo name="RFC" value="8174"/>
<seriesInfo name="DOI" value="10.17487/RFC8174"/>
</reference>
</references> </references>
<references> <references anchor="sec-informative-references">
<name>Informative References</name> <name>Informative References</name>
<reference anchor="RFC7252">
<front> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7748.xml"
<title>The Constrained Application Protocol (CoAP)</title> />
<author fullname="Z. Shelby" initials="Z." surname="Shelby"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8032.xml"
<author fullname="K. Hartke" initials="K." surname="Hartke"/> />
<author fullname="C. Bormann" initials="C." surname="Bormann"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8392.xml"
<date month="June" year="2014"/> />
<abstract> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8949.xml"
<t>The Constrained Application Protocol (CoAP) is a specialized we />
b transfer protocol for use with constrained nodes and constrained (e.g., low-po <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.9053.xml"
wer, lossy) networks. The nodes often have 8-bit microcontrollers with small amo />
unts of ROM and RAM, while constrained networks such as IPv6 over Low-Power Wire
less Personal Area Networks (6LoWPANs) often have high packet error rates and a
typical throughput of 10s of kbit/s. The protocol is designed for machine- to-ma
chine (M2M) applications such as smart energy and building automation.</t>
<t>CoAP provides a request/response interaction model between appl
ication endpoints, supports built-in discovery of services and resources, and in
cludes key concepts of the Web such as URIs and Internet media types. CoAP is de
signed to easily interface with HTTP for integration with the Web while meeting
specialized requirements such as multicast support, very low overhead, and simpl
icity for constrained environments.</t>
</abstract>
</front>
<seriesInfo name="RFC" value="7252"/>
<seriesInfo name="DOI" value="10.17487/RFC7252"/>
</reference>
<reference anchor="RFC7748">
<front>
<title>Elliptic Curves for Security</title>
<author fullname="A. Langley" initials="A." surname="Langley"/>
<author fullname="M. Hamburg" initials="M." surname="Hamburg"/>
<author fullname="S. Turner" initials="S." surname="Turner"/>
<date month="January" year="2016"/>
<abstract>
<t>This memo specifies two elliptic curves over prime fields that
offer a high level of practical security in cryptographic applications, includin
g Transport Layer Security (TLS). These curves are intended to operate at the ~1
28-bit and ~224-bit security level, respectively, and are generated deterministi
cally based on a list of required properties.</t>
</abstract>
</front>
<seriesInfo name="RFC" value="7748"/>
<seriesInfo name="DOI" value="10.17487/RFC7748"/>
</reference>
<reference anchor="RFC8032">
<front>
<title>Edwards-Curve Digital Signature Algorithm (EdDSA)</title>
<author fullname="S. Josefsson" initials="S." surname="Josefsson"/>
<author fullname="I. Liusvaara" initials="I." surname="Liusvaara"/>
<date month="January" year="2017"/>
<abstract>
<t>This document describes elliptic curve signature scheme Edwards
-curve Digital Signature Algorithm (EdDSA). The algorithm is instantiated with r
ecommended parameters for the edwards25519 and edwards448 curves. An example imp
lementation and test vectors are provided.</t>
</abstract>
</front>
<seriesInfo name="RFC" value="8032"/>
<seriesInfo name="DOI" value="10.17487/RFC8032"/>
</reference>
<reference anchor="RFC8392">
<front>
<title>CBOR Web Token (CWT)</title>
<author fullname="M. Jones" initials="M." surname="Jones"/>
<author fullname="E. Wahlstroem" initials="E." surname="Wahlstroem"/
>
<author fullname="S. Erdtman" initials="S." surname="Erdtman"/>
<author fullname="H. Tschofenig" initials="H." surname="Tschofenig"/
>
<date month="May" year="2018"/>
<abstract>
<t>CBOR Web Token (CWT) is a compact means of representing claims
to be transferred between two parties. The claims in a CWT are encoded in the Co
ncise Binary Object Representation (CBOR), and CBOR Object Signing and Encryptio
n (COSE) is used for added application-layer security protection. A claim is a p
iece of information asserted about a subject and is represented as a name/value
pair consisting of a claim name and a claim value. CWT is derived from JSON Web
Token (JWT) but uses CBOR rather than JSON.</t>
</abstract>
</front>
<seriesInfo name="RFC" value="8392"/>
<seriesInfo name="DOI" value="10.17487/RFC8392"/>
</reference>
<reference anchor="RFC8949">
<front>
<title>Concise Binary Object Representation (CBOR)</title>
<author fullname="C. Bormann" initials="C." surname="Bormann"/>
<author fullname="P. Hoffman" initials="P." surname="Hoffman"/>
<date month="December" year="2020"/>
<abstract>
<t>The Concise Binary Object Representation (CBOR) is a data forma
t whose design goals include the possibility of extremely small code size, fairl
y small message size, and extensibility without the need for version negotiation
. These design goals make it different from earlier binary serializations such a
s ASN.1 and MessagePack.</t>
<t>This document obsoletes RFC 7049, providing editorial improveme
nts, new details, and errata fixes while keeping full compatibility with the int
erchange format of RFC 7049. It does not create a new version of the format.</t>
</abstract>
</front>
<seriesInfo name="STD" value="94"/>
<seriesInfo name="RFC" value="8949"/>
<seriesInfo name="DOI" value="10.17487/RFC8949"/>
</reference>
<reference anchor="RFC9053">
<front>
<title>CBOR Object Signing and Encryption (COSE): Initial Algorithms
</title>
<author fullname="J. Schaad" initials="J." surname="Schaad"/>
<date month="August" year="2022"/>
<abstract>
<t>Concise Binary Object Representation (CBOR) is a data format de
signed for small code size and small message size. There is a need to be able to
define basic security services for this data format. This document defines a se
t of algorithms that can be used with the CBOR Object Signing and Encryption (CO
SE) protocol (RFC 9052).</t>
<t>This document, along with RFC 9052, obsoletes RFC 8152.</t>
</abstract>
</front>
<seriesInfo name="RFC" value="9053"/>
<seriesInfo name="DOI" value="10.17487/RFC9053"/>
</reference>
<reference anchor="CborMe" target="https://cbor.me/"> <reference anchor="CborMe" target="https://cbor.me/">
<front> <front>
<title>CBOR playground</title> <title>CBOR playground</title>
<author initials="C." surname="Bormann"> <author initials="C." surname="Bormann">
<organization/> <organization/>
</author> </author>
<date year="2023" month="August"/>
</front> </front>
</reference> </reference>
<reference anchor="SP-800-56A" target="https://doi.org/10.6028/NIST.SP.8
00-56Ar3"> <reference anchor="SP-800-56A">
<front> <front>
<title>Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography</title> <title>Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography</title>
<author initials="E." surname="Barker"> <author initials="E." surname="Barker">
<organization/> <organization/>
</author> </author>
<author initials="L." surname="Chen"> <author initials="L." surname="Chen">
<organization/> <organization/>
</author> </author>
<author initials="A." surname="Roginsky"> <author initials="A." surname="Roginsky">
<organization/> <organization/>
</author> </author>
<author initials="A." surname="Vassilev"> <author initials="A." surname="Vassilev">
<organization/> <organization/>
</author> </author>
<author initials="R." surname="Davis"> <author initials="R." surname="Davis">
<organization/> <organization/>
</author> </author>
<date year="2018" month="April"/> <date year="2018" month="April"/>
</front> </front>
<seriesInfo name="NIST" value="Special Publication 800-56A Revision 3" /> <seriesInfo name="NIST" value="Special Publication 800-56A Revision 3" />
<seriesInfo name="DOI" value="10.6028/NIST.SP.800-56Ar3"/>
</reference> </reference>
<reference anchor="SP-800-186" target="https://doi.org/10.6028/NIST.SP.8
00-186"> <reference anchor="SP-800-186">
<front> <front>
<title>Recommendations for Discrete Logarithm-based Cryptography: El liptic Curve Domain Parameters</title> <title>Recommendations for Discrete Logarithm-based Cryptography: El liptic Curve Domain Parameters</title>
<author initials="L." surname="Chen"> <author initials="L." surname="Chen">
<organization/> <organization/>
</author> </author>
<author initials="D." surname="Moody"> <author initials="D." surname="Moody">
<organization/> <organization/>
</author> </author>
<author initials="K." surname="Randall"> <author initials="K." surname="Randall">
<organization/> <organization/>
</author> </author>
<author initials="A." surname="Regenscheid"> <author initials="A." surname="Regenscheid">
<organization/> <organization/>
</author> </author>
<author initials="A." surname="Robinson"> <author initials="A." surname="Robinson">
<organization/> <organization/>
</author> </author>
<date year="2023" month="February"/> <date year="2023" month="February"/>
</front> </front>
<seriesInfo name="NIST" value="Special Publication 800-186"/> <seriesInfo name="NIST" value="Special Publication 800-186"/>
<seriesInfo name="DOI" value="10.6028/NIST.SP.800-186"/>
</reference> </reference>
</references> </references>
</references> </references>
<?line 3026?>
<section numbered="false" anchor="acknowledgments"> <section numbered="false" anchor="acknowledgments">
<name>Acknowledgments</name> <name>Acknowledgments</name>
<t>The authors want to thank all people verifying EDHOC test vectors and/o <t>The authors want to thank all people verifying EDHOC test vectors and/o
r contributing to the interoperability testing including: <contact fullname="Chr r contributing to the interoperability testing, including: <contact fullname="Ch
istian Amsüss"/>, <contact fullname="Timothy Claeys"/>, <contact fullname="Stefa ristian Amsüss"/>, <contact fullname="Timothy Claeys"/>, <contact fullname="Rika
n Hristozov"/>, <contact fullname="Rikard Höglund"/>, <contact fullname="Christo rd Höglund"/>, <contact fullname="Stefan Hristozov"/>, <contact fullname="Christ
s Koulamas"/>, <contact fullname="Francesca Palombini"/>, <contact fullname="Lid os Koulamas"/>, <contact fullname="Francesca Palombini"/>, <contact fullname="Li
ia Pocero"/>, <contact fullname="Peter van der Stok"/>, and <contact fullname="M dia Pocero"/>, <contact fullname="Peter van der Stok"/>, and <contact fullname="
ichel Veillette"/>.</t> Michel Veillette"/>.</t>
</section> </section>
</back> </back>
<!-- ##markdown-source:
H4sIAAAAAAAAA9293XLcSLImeB9PEau6EDXLpIDAP62rz6FIqsRRqUpLqrqr
rKdNFgACYraSmdxEUhKPTHu3trY2Ns8wMxf7CnO1V3tmX2SfZN098I8A8k9U
1ZlqNpVEAoH48Z/PPdw9JpMJ+3DMHcZW09VMHfM3S5monC8yfn724udTli6S
ubyBL9KlzFaTqVplk5l8ryYrunFihUzG8VJ9OGZsers85qvlXb4SlhVZgsml
ksf8SiV3y+nqnn18d8x/PHl5zv+6WL6fzt/xH5aLu1v2/uMxv5iv1HKuVpMz
fA1L5OqYT+fZguV38c00z6eL+er+Frpxcf7mOWPJIoXnj/kd9CZkt9Nj/h1P
5Jzf5YrL5VLe84NpxuVsxu9V/oQvlvxa5tf8Wi0V43y1SI7xC/iYL5arpcry
6u/7m+afcGeqblfXx1wwJu9W14vlMZtwPSM//Ot/W8I7r9RMzlO1xKfvlvqr
xrXFEvp5vpwmeb6Yw9/J4m6+Wt7DPR9VqvCKupHT2TF/t4DWjvLiyX9WxSNH
yeKmeuW/X1zP+euluvvX/8xfydWqaHM6n66mcgbd/vfNXvRv3Lgz/4AXHd0U
D5r78gpW9z2MFBZs2u7Eq/ZUlDfQy0+urk74ybMff/6t+frXCxx1/fobbBvm
gh79Z5nnUsazxX33/cmCv5nOFokcfn31Pb398uLqfGzYN9jm0Yqe+eflFHrQ
eN1s+v/+V8n/cvff/xO867//H7130hsu5supbL7iOaxqopqvmE1zefThLoGn
k3+e4v1H2ZKx+WIJEz79oICTOL+YnB3VzKbSa6BZ4DBgieZdl89PA+GJ4+Jj
4IbFx9ByyquhE1UfIzcqPkaW51ATp/Fi+UrhVSB3uXyngPOuV6vb/Pjp0wS+
O7pRT/WXWkCcPvv5kt/O5P07YF5aM85LzuD036T4F+cHpub0iD/DTs/ndD2V
K2jl5O4dF5ZwsAdXryehZU08/8Tci3QxPYK5fWpbR74lwqc/XVy9Obp6fVQ8
tHSa3btUQCM3ag6vAZnBYbr4azldTv46BdHwUt1PzvMV0NI0v4abVvwquVY3
IO9+yVEenU3zZKlWiv+4eCdBZF3f8NPl/e1q8W4pb6/v6T1AlFOV40KU432E
HXp0zB9d3aoEyIG/voMXJLoDRSehXx+mKMW482j9lJ3DlMnle5Ifhq9/POKn
12pu/vLkiF8u3sHH9/eDN/wFOGo6Ux/MN1we8TMJvW0u1+1yOoMFs8PGgtmh
v/2CwUPN5XrUXq+cFqy/DJNY5iptLQbM0mw2vV1NE356t/yg+NkCGAyko1wC
v4I2yR/tul7Qxw0WaXQVzo74q8UiHViCl7BGIO9APw2voXqn5jlQ5zQdWecY
Pi6afPVcxcs7ubwvmGsymXAZ56irV4y9uZ7mHBT6HZF+AioVJiwHHXijuPok
b25niq9q/X+LrLGE+TmbZtlUTV6o2QzYmP/8QS356c9X5/yAMMKTI/2im2ma
zhRj36E2Xy7SuwRnlDG6iX/+bBBpX75w6JLks+m769VHhb9p0qF/uCCw5O/V
PfQtuZbzd4rfLhegkRcznsKKvpvD10gu1/DY7B7HgwOd4uVcrVbA0PkRHxgz
SKPFil6wagMeeJTQRn7IPwLlwVzf3q0O+eJuRf/CqsEloK4blU7heexSgk+A
9Fiq/G62ygE08HwKkznN7vlK5dgRbB4vKeyFpnTsWjXd1xIIOFZqzmFupzDZ
KY/h4Y8LeBkAEGAP7H23BZjq70C/rgBDFZMMY13ezaElmExoDBbrglTUCqbp
4OIJdV8CbeW3CwQZ/ODyie4H8PcHGM7TW2IFmvVbEJs5PQHMiO9HTYcDgeVp
NIs34JW60aX6X++mS5zaBU4P0IGiO6rVA4Gby3cwbNDyPL9efJzDMOmWYjo+
AgHwuYK36hXGrxI5S+5m1cj1eOuWuutSLga+Qs0BLyq8QWuvz58LXQjkR+OT
9HYAfoslLgNPpzlquMYj0Oi7+SJHaUOEg6LiDlf9kKujd0eH1MWOaoT3aOX6
5QsQ0/U0uQbl/x46C/fecCXze5ohuQTNRHR8B9wFdHHamG7sGvy7wF51hqHf
rF/6VxXzN4v3IDH4welf3zwphgia/8uXI2R8ZeABJC894QAE/h08kqtEw/qJ
DTMzASVdcSKOl/gB+U6u7mCegEZyPqWeVgQL7yGg/UHO7lRJK78eeVbEE7XE
G5GroZNACx+mxWA+f8bv8i9fCloEar9dwGLmBOfP0zNAjHo8AGqgYzhXst01
XMVfhefZkb4TkVBxpyrF2EQNCbSmjDnqToUYngqkg8TQWHdagMSXK3pLdR04
ayZjeASFA6wYP53J6Q0yM67g6VXeXkLDvKAS468nwvPhzlojF6OOF9BB09Bx
pnTHN5wPLUFpLjQlTmezOxS0K03JPJlCO0tA3FNgu7l6t0DBAJOkhWWx0Mih
lY4BupgtPtbyYAFC71rJtBC5FVPn03/RkvnAiQ656x1yO3oCEwpvRgmgW6Mb
pnOguGnKu1JhiZx1Ny/IrF7U4n5ijp9+fnPObT3FOUAHwvsoSe/yUsFAx1OA
CgDd6e0wgUvULqXsmy41FxKDlmqnEmYFv+klwQlbyo/GZuDO5VJLUaKKqkno
Bmh3yWGCb/Kyx+KIX2QojHgyU3LJs+XipmgF5OAn0FVLWN2bWKH4lCvdXA6i
GZosBCZdInMZ/s5zEA9DL4WvudK6p+qAc8T/inK6JdphzHMYwZKUXmc10gX8
wg5P5yhs5ytQ2gV56KHPCmZOlos8J+u9fPYQEMJ76N3i5HXB4GD1oFhFrtQA
pnrN6v4W2HQGjePy3y61+kw1bcHkzBXhkhYvEqUuVlrq4pNlc29t1MDI9qhB
c6WQ2XQDOcyAe2TTsydHAsnQiHBIqi2AY4lwqVN6EpLZXSEBG6qP/mpAFpht
1PJvQLNN54vZ4t09vfBS61haEP4jMOoddJZ//g414Bct8JGLPy6Wac4fvfoF
AO+h/pfD4uHny/P/5ZeLy/Mz/Hz14uTHH6sPrLjj6sXPv/x4Vn+qnzz9+dWr
85/O9MNwlbcusUevTn57pNn/0c+v31z8/NPJj496I6OZWJFmI819i5Af4EnO
QFwky2ms5+bZ6ev/57/YLsz7/wTrLmwbtbb+I7QDF/5AtKDftpjD2uk/YUrv
mby9RdaYzomYEnk7XYEIO0Rq1rAD6fCI/emfQAwrPvH/6c8Mp9so7a9KxQfP
a4122tRoFy2J//iTt3rMv4MFaepUxi6KOajQdgtKlQithc9omtqYmPqTTt/h
aGqFDIrj1fmbFz+f8e+59QSN7kLejGG1/O4WubUtxK0SrqRoRwHdFZJezt4t
yBzTgEGz98n5yVn9Dbz75Pxqcnr6amL7E9+d2CKsbiVo0LwVyA0VWHXDq5NT
PlPzd4S7C345uCrU7Isn8ETdWMswqBs9OD89e8ETtAjxfg0Kqodq9NLsBkEM
uOfk9rayAzcaVvOBwcERM9a4WksAkEqwYrCk5XIaQFIfW5HRhZoSluq2tHM1
sWljoJJajNHy15BhgIryBlVPjxQA2ZqGYJH/t+I/Vlw9IP1whnrhAvTCE35g
0zI9YZZV3/z5GF4H6HL5fgJa9t38+0czla0eFXKpJsccVEoCfWsT3xE/4Yis
Zx1ogWxTKCZJcALG1ezi1S8Xb86v3l5s2MlOX8DGoUlHmFLhotIMIhSAoIvm
DFdijAabnape8DhvtFtYW/g8+xWYHADBXxAxQ1cdoen+CQsjLmAKBA8V9xIe
+9z3eWRzK+RuwC2POxH3LG7FPLC4p7hv8dTCb1MHb0g8HtosANgY8czh0G6Q
8FDyMOBxzC2nMRPrelvRLvvh7WB3HZtnIRcJD2LuxTxK8DWZxTObRy5PI247
PEm4LbjKuO1hh6CjIsQ/4bMPnyVzQ+g0lzZPLByVrbhweJBxy607uWVve8Tg
uGWXPeivxffrOKOO8006PkT+01VuxiX8FKhZa0ikuQZm5NYnkZZSGpgFsPl0
RdZ/Q64UQsOe0IM0D8AyfALKtM1L2FiTaE+NnUkQxKBUrofAsIMteig5TaSG
Bduy3UE2bjbOfloAC+LmERo35K+b/ouWyAhfm8MCiQ5wTjd7VQBhaNUqyWFQ
NJBj6Q6XqpKv5DrnDZT4Pf19oH101mH73+vHjp2FIgliL46SOM6szI7cNLKd
JLGFymzPEakjQpU5wneEdMPS1xfa0k6swLKVcILMch8XLcIi0ocnjfHVnemN
0QnKQVogIkBc7EX5rMGyI5TPW+vU0E5Cz3APhWiUcbPIVwjbM7VEJxIZrMQp
8EcXpoA5Wol9dCQmibpF97466r7igeR79YJB+f7bkMBUPs44TFYW4zLYMU9c
7ng49cLlrs9DmkcFKwSrl+GC+SDBM5xrS6L0T2MGgt51eQQaQuIygGwTNlfw
Exr4b6CzTYE52NsUXg2qBSjA4zasisdhOfyAZwl21fax5z4MIQSYzQMXKSYi
X1oYcyfkoId8wRzoto8aS7o8BL6LeCx4lHI72bm3a8X7fh1n1HG+Scd7RL2B
eL8cFO92aBLvaDg2RTwCoZ6Abwv368d2+Bjh3CfXtsNtxHw1FIYdNYp520Rm
W7bbW8GK5lybN1/ACqfKHK3D25VG3G9evBU44tI9DIMmv2yDi9vIHGaAnvme
vzjgQEKH8G8lOZ+0BGrriwG+SGzuezz1uYyIIGIko0yCKOJhSmwbI4WBoPQz
HqQ8AFnpICW5DrI/POK7DBFbxKVATgF5ajmI+VJoOTahtHa31jLAfj1k1EO+
UQ9xfWi/BKm6WpBqiSoXeemFgqXoLUALjZqb6mk3P/ymLM83mFe22cpvNq/V
Jz38AUL0uWuhoQCK2oU++jgysBhkjHOQCWzb1xYDaAsXf0eg1YFYUhxrEHFf
MsvnnsBxgHICZROByoG+hDigwe6sJ8C9esaoZ3yjnrHXly/fCjIVc9zbJduZ
XL+Fz467Rzb+b9BZB7jh+XSZr/SGDvkS8mu5pC1F3JMGifHrbyRvFjdAnegg
Rr8rWhoIVICYAUmgYqIdiaa0pQdba9dvvY0PPJ6kaLoBfYU+fgbKApgWEEZz
yRZUcLeFhh2YfSrgdsY9IK4IGRuAQugyoEH41sl4DLQWImhIMmxBdOTq/JDX
c9eTpSRH355/on3kgye1X6gyMgYkLULUot3vO63wXM5gmmlanhTwufgPRPOr
k9NJ4UBp38nYR3Ta0TXsK9Jgc5rp+h+HRYrBD4EqsNFdXFa4xYP1TRHGBQEK
ADfGpVQxLit8C5Acbk5BuoRIDFaKSxkBQHRI0iQIGS0SP7C4cA+g71Q2OnRF
IKL27Rx2/IBN11BerHrtGzri+nl8xozFYSWKNocdbXAPedq62Pxx3t5V1JC8
oDx8YAhwlzC7sxmI2PDqZReyNBiL1tTKeBahLQQMJNEhglwFNgyyTlDYQiks
vYMmjQzwt68Qx8KCZBlLYvwMJOF5uGIBaAsHgXoUrYGyBYA19Pn1SJ8B86cx
unVAD3k2Uk0INCyRUkDBWEDSEpWNqziAppCUkHKQaKWFhA2UD/A7IW8RXEw8
JDcVcZEhEXmNPhPFOkrcrBWiwzseRyW9jdFYx/3Iq/d+X0iMow4b0Ze/OyN1
zcraN0BbexjkN0fC1TioiGFoYRgQbSSy6N9KLL48e35QzcEhF4flPt5b+Hgj
k7faLw5PPMHw1+IrePxPf+IXZ29PL8/P3l4ekjg85OVf/8TR5yH4n//MmL6G
q9r2KwM8cSfxVMPpQmRXDRZy+XMhnUGzH/O/TWzvEMyKIMqEdO3Ys63EzqL4
8d/pri+lhO46rHVMADRxQA7rJ+XGGhrlWnMAPYF5XnvCtSP8kJXbFtRaLU+g
H402qtiD+oZCgWBI8lz7vGEhAHTBaPMmddXDNfic3AYL2oBnBA8FEhKgNeB+
4C3Ah4D9gCmRC4GfmsitnnSpoW/TyCvCI87O653jwZAJzYC4OzyBq1++tOy4
ou9N1hCuXTlmLfQMKJh6q/DUgEwAcWeBvrPpt0AqR8hrIw5GL4SF/mXQdHAb
IAjfY4GFF0FLwj0wWvwcFTeAAITHsUFyFbkeeiRgdtwMkS7gP1CXgID9jIG2
hT/hBlgD4F2QV/hjIwc65DmyA2JIQT8WSlT81qfPIV10GV70kb3rmyO6TZT3
6w9W/QM3w29BA0S3l8XgXYbOBwOdBwnvoG8LR6Gw83hFsJGxCNmfQ2wBP9uo
dEp5zvaQ57yU56wnzwff7tLb4wD9TnGCBKAkasBIsJDsH7wZUA2YTwqXOElw
5uFmUIWo/lIESLiFYOGoQR8BzFQJiksQrK7HnIAIjDQsPAsNov8qwg7DS6FX
ML22hYwEd4JQhiFDNyKXRx5ZUyH3UwaaA+YEgKpUOP+gnYHlwNxC3AWaWpiA
1iADC1jH2hyBXu7HD6yazT34gRE/8P34gRE/8P34gQmreNce/MCIH8bGsgE/
sL3xDfADG8A3W/EDI37g+/EDI37g+/EDI37gW/DDdrshBl+KYTdkF7RRPV0/
3HuViOytdSsfdimwLS05o0uBkSXH95MUrENnO0kK1tCcO0sK1tCcO0sK1tCc
O0sK1tCcO0sK1tCcO0sK1tCcO0sK1tCcO0sK1tCcO0sK1tCc20iKYRZtYFTi
0tqdFyHdw5D2YFe2q+Olya6s7XjZjV2ZCehuy67MBHS3ZVdmArrbsiszAd1t
2ZWZgO627MpMQHdbdmUmoLstuzIT0N2WXZkJ6G7LrswEdLdiV+0uaHqeV9fL
xd2768qvegt28sGTNdtfh7wVxEq+nGFPTsNN8eLl2fNJ8ZLaT4F5VW3/xBPc
t8Q8W0pWhAcP1jgz+q7J1h0w4nfTD3rncGhQR8XLcBu/nKfClaE70QzOEFVQ
hrTtUAj4UW7Y9WZ4obAS37W8xPbcxPMD1/dLH7WM7TQTluNHnmUpz7VUlNlu
nDoyiHxp+Z5IpPL9JLJ82w/DMoELxFRmO1ZoK4W/pS0ty7GEZcP/heX6wrEj
lbiOZXmWbzkiLp/zvQButFPHtmP4N8JvPc9y4WJiC9dzXTd0M9cRlif8DHRt
8VzgQrOeD184HvzPdiJ4WtmBlcIV4ViOA9d8+DeEv1zHKZ9zfE8Wd0Vwh6D7
8Lel/+dJ6Db0VmCvlFXNS6NXQadXXuAEFvRN+S58Frpf1fsa/ROyHj+OG/61
LUvaaewGceTZoRt65XOuTG0h4W3S8Vzl2qGUiXIcKa1MJL4vEsuKHZl4Xqoi
kUXV+Lyo+w4X3hEHwokTGJCMrUiEKozh2yQKU1U+Z0dJ4oTCSV1fBakfhUEM
TbhBmKkkk0ACnhPAqsKHJAljVQXxiCjx48CxXHiNHTqBil0ZJ5Ebeb6Xhn6a
KM+GBpQnZByKxK76KZLYEmXIjyPKiJ/avzaT+apwrBUbrDpRjVInSmeSMfi2
jK9t+sE6PGQA7HUYkeB7owG2xzZMhQZYbxtmBzTABtxeW6EBNuD22goNsAG3
11ZogA24vbZCA2zA7bUVGmADbq+t0AAbcHtthQbYgNtrKzTABtxeW6EBNuD2
WosGiMssk/Or4NeBwFyKMwNmhDUSCUaVYTSEg5ELMNspNesK5DLpYJQEzp6F
SxOEuFUC/QSKciMMUwsTnGS4GaklxvBAxxhH3JQfo6G3e3WNUdf4Rl0zwYwq
o+PtYvm2glcoMR9X+1KPSyGKew9v8QmbL+J/AHjqRxi2t4KKkJYiwEunKxeY
5G/8UfVu+9Fhy6nC//znQt7D1SH/ymEhof8OyEa3qB9pNbsJynlc3WXCO2M4
p8ImBrwzhnMqrGDAO2M4p9LBBrwzhnMaGKOHd8ZwTvWcAe+M4ZwKexnwzhjO
qTFUH++M4ZzyORPeGcM51fsMeGcM55TPmfDOGM4pnzPhnTbOuX4MBJdI14lE
Ejoq9Z3Ut2UqYCqEpaTjw8RaVgjdSb04gbdVtJjFYeJFroAViW1Yxsf0xd+b
gsnAlNwsqSrfJIgbwBseYRKQQagKbdTpAWlDn9QfKKxRFMRaKIiAE4CfLcOj
2Ja+TCMcYnvsAlZwiO2xC1jBIbbHLmAFh9geu4AVHGJ77AJWcIjtsQtYwSG2
xy5gBYfYHruAFRxie+wCVnCI7bELWMEhNgSHtsEQbBTebIYhOuHdIDzyhrNl
OBiJYzBSM1Gtjzta0M13GwHQiuL8RICRf9Bpi5IDhIfUDLMAawA3AKGnAa59
KjHKFAwnkWJMKdBKKpmX4VQqYmm4kgWYKRYQfQMp6xbgAxAciA9YNh33BHOh
LPoKZF9KvBpiTzx6EClMYtKZFyBHIVcQ13kk8mIbY6MsZYiEMo29J3xB+NUw
EWTjftPAaBr4ftPAaBr4ntMwAhlf/3hy8dOb81/fUGwQ6q3GlbYD6xTAoP5U
o8anHKv8wD8T4R4dCae4oT/dxRcFluzlEDVf2rP/w3Zk/naGf28d2U7k3FlH
thM5d9aRbb2OdaS7KcLr5flvV28uz09eaYsiVRmFyvZi6Ib9roedwNvCtdtJ
TzKG2zZf3gsuE+oQLR9tV9zO5FR7ZYuc604YLv3XdvxWjWi/b7+F0jnV+6aw
rLrZ3TABTZIrr5eFlgp/VHtCBz27dbrdNpYMWjANj1vLkikxabiR7218cEZP
W3Nk41l7e8fSs03AIvCzZ4yvaXW0qa1qoZABDlNFuDlwrB8jlyKnwXXKdwA2
Ezp52UEmBDilBOIGgBFZiEjISxhAHxhjSKAHRENIHYZx2TbmdMSCgKmL30KH
I8qPjshJAIo/JS2e+AwAgbIRD0GbNuWDZBk24qYY8wviCbgdRI+MaDIpwS6A
BwNEMPAVQAdoJKYsSJhYgDiAYAATgICAroYEF0C0gZAK/UF8UImDnJ9evH5x
flmQuMz5r7jJWpToalI/0nxjnlsxfs0mBuYfoIzweZricKwM/WIADQESQc9B
YiIkdZEAENkkOMmACEGqYqysjzSTARAMEArDlErMQEGpBxMLkgvoB8QiSF4M
nVaI8PRvWFYAsnAP0B7MLdArLj0g+xhtDJxASmEEnW1TjgzALxDuAEnhqdRC
uQ9AFgwxeBZ6DvgMXm0RzgsV+mSBejNChJI6D4QEzcIqg0wH4wfzIrrpYUbd
WuWddrJ2O3r1h7e/vW3Oc8nyXG9o9b4v2Z40bzeCE16PcZtzjQIXuCdT1v4h
mUHSoUwUabZ6ZMjoNcgG226CJLBDHjrpaQPqYuuoi29AXWwddfENqIutoy6+
AXWxFnU1E5idoYSKRqmVb59Q0ayHsHlCRfOp8YSKiyEPs0t5STDfIVmCHmUk
wSrBmkiS0xlhMNQPlHQRBehOgfnG1IuMTFHBPLLi0ZFC6+PT4jtIsOsqVYxm
VAx2GiYc9KAMqYs2fgADNSZ8CbwD5AfjSSIUU0BjAC6B8oHUJXlMMhc1nZUx
NIlDNHGFVVi2oLmAnu0mWETM5CpnfUaFs1lGxRCRmTIq6L3fV4kF3ZwK+vp3
z6kYyOt1dsjrdSivV+Pbhmotnejr00sdAwwDM+BbJjTyDawrts662sRKZuus
q02sZLbOutrESibX5r7R2WzvmEvcXts75pI2YPeNuYSJYnvHXHJfsb1jLjGM
6oGzzzb3U7K9Yy7B3mB7x1zyyGO7BHFVn7SgGVBMFrIO0CZMKuATmEsYIhhK
0EeYNuQnD7kNBAbcA7ML2hQmADoOzGo7eH8UMmgBKSIlZOVj8ajMR4+nioa7
s3a7dr+eMeoZ36hngwV4tkmycwq4T5/7vhDUfYfcr2PTnFbkmVNZ+7qV6q52
FPwFeVOcQsFclLu0Tp1zd7Fdzt1FO+eulXKXCFfGIksD33WSIMr+7afcGcs8
jaTcAYRHJhQIJgMfKQms9ijrptxdfLWUOzziYSDl7uKrpdxJ64+dclfqpW+T
cudGtMEWEaqKit1WVMj7pdyVgJ/tAfh5CfhZD/CvUWKwIrhSNj4eO5hQHlgs
isgkz/C9oFpBuYHiAkytrKKgVkolRNAqBwsqww6DOoLHQQEGHiocN8QYZ2A4
i/AUEBv0xyIjHZ5Fi5hwHIwIPsM8wIrABxgadBXoM8uouFTE4KUwIaA+QDcC
TAOAD5BBWkW5EstYjWSQgfdOuWvzwx8v5W4vftg65c7ED4z4Ya+UO5WyvQ1g
4Ac2YABvxQ+M+IHvxw+M+IHvxw+M+IFvwQ/bpdwZ7MuRlLttwEb1dP3wdil3
A7qVD4M/tiUsNYI/RuBvR/OvlBR/1JS7HSXFjil3bUnBGppzr5S7vV1lrKE5
d5YUrKE5d5YUrKE5d5YUrKE5t5EUgxy6S8bdxtzKdjUim9zK2qbajhl3Jpz7
R8q4245b9824I25lJpy7V8bdrtzKTDh3W25lJpy7LbcyE87dlluZCeduw63a
bfDtE+6aLotu0p32WfSS7hxD0t0Gjo2dfBrj+XrOTvl6zlhUh2+MZO+6QjB+
XVmRbQtbZp5M/ERVsdG266VuKDz43rJFJqIgClWYBbYjkyiMbNcRqRCeH/uZ
H4SqiifeJF9PWr9bvl4jRv3r5uu5ka/8KHD9yIcv/Gz7fD2VWr4MpfJtGYpq
PmPpZdJzPeElUWoFmRumqeti5+C1ysqEk4ZJIiyMIQ89u3qfrUxx7J6AubTT
MHZkEFhR5MdJlkQxLEkVa+6qQFlYQDuNob/SiVNYfNuKnUgEngQqigPPt2wv
Cu3Qs6o8TRGksR84wGwBEAS8RvhBmlqeUlkmAnhDIEPbgaEEbhwIWcfux7Ao
8e+Ur2dE+3UAkT+Wr7cZlmB7OKQrLMF6bt8d8/X2xhIPnK+3BZb4Cvl6bsQG
fGZ75evthCXYgM9sKyzBBnxmW2EJNuAz2wpLsAGf2VosMZ6vN7j/g5tJEe4E
w3izCFkSxoibWwHOqpPhJECXYqrQnxEbBnob3sMIIGRzj+GOu4e8DFwGAB43
pIk80mSkP2s3gPbrGlkzHt+oaxtk6znD2XpsKFtvcE9pt2y9i262nhEzHRby
eetsvd52Tytbr4t2xlBOqaFMaGebbL0m2vnG2XrWGMrZJVsPUU6F2AxoZ/Ns
vTbaGUM5VT8NaGcM5dTZc320M4ZyKmRpQDtjKKdGQn2000Y5QIt2EvmhDLIo
S5W0oySwhJPBLxG7aZQBXQaBUADQQy+C4VRzYHkBkINILQfRZppsmK1nllP7
Z+s1MBBrYaB2tt7Ge+BsSzeoEQxtmq03Cob+ANl6Bb75Rtl6wxuIe2Xr9cAQ
22MDsQJDbI8NxAoMsT02ECswxPbYQKzAEBsCQ9sgCDYKbjZDEJ2ztrbK1rs4
HkvXc4bS9bIEZzdQlJJJrAPUgfImwPg8inrEcLrEw4AkPKQnLkKLEgqTQgIH
crCRVOMUw5BBHuAqhThcmDMnRRLAyMIYI/+ki0HfgY3T4CY4BxGd9gZq1KJJ
hR9YTFwNOikgkBgGbpFMCiVKI+AYh8Ly4IPlm5ChafBr8/X2mweKFCCxt8c8
MJoHvu88DIPGOrjU6eXrOW0HVo0WN83Sc1pZes5Ilp7B6g+tnbb4BtaNbUm/
xnVjW9Kvcd3YFus2ivVlni+SKQUn0QnH6EGpIvuLxTypFrEE6+fzZHl/u7Jq
qF5DoG2gOELwqoBVB4r3IdCJkeFA15Rwx8GJRZWmMKoWZG4QoQwNSOm61iao
he2xebtd5F43Xi9VIIa1Zwwl70u0n7bxlh+ujwnHCX1pCv/T9euc0tUN76+T
GIvlMSU/NsveNZ85LN18jYuFfYpD66YGIs3VvW4fNttNfhx3jztfnwqLFm1/
EwfmtqM7YsY8SGPgfaVXELLuG4LKNoHfdtNf08h+7Cr9OvtKlyyQILMiaiZD
AAjCEbA5iDMQhYrkI4Ymgwjupj3swirzBfpGLv7yQNyCDQ+xi1uyy/RDn1vW
sUvjmYpb6msFOenB7cEu1P0RfnEfjl+cTfhl+wEaXf40zDGOcb8Rx1jGc490
91ocU8UEwtNovUSYu4FAgtAFAJIwRazvpqj90xFtbkysdTCx9rFOocM9TXIF
khuwVNxc4mndKmVdLugc9U1pVFX+ehPWAaWl6RQ5Tc4IOqB6PixVF5FhzZtH
5uzdzqyE1dF1UvKIEmhgnQAZgRnlUp4yWLhCA58Yb1A+Xs8onxFPHCIrCdPt
cHUZYq4M0xdsG5cfJJFM0ViLyPCPYmowQiEFih0MMYuyPjNYGo/yNF0Ad4gp
0GFCN7uU45mklG1Nhq0iwoptfGPqUaK3Q4aePoPUQzMzohAZaMGO0RgHsAbv
gmaxlpuF2UJAnYD7EhstUFx2DyGqh/kWjWWvMFnr8MBetm1zco8NybMGNoms
hsECP/vNPaO55/vNPaO55/vNPaO5519h7gdS8twdUvJcfdSm1hstbiqsovVJ
ea4pKS/g3zI5ZZNdU7bOmNrECGbrjKlNjGC2zphaawTDKNjekdv1juJ+mQxs
78ht2qrdN3Ibd/P2jtymrIx9I7fR2t07cpunIds7chtUOds7chsGwvaO3IY7
2Y7xmFrEmLdjfV0ITCAhwHoCLwKLR5p8bDqDU+EHTOoVODKbJhsoLiF9ant4
ooykIgnQWbgHxH3sYm48yOg4GO7O2t3Y/XrGqGd8o541ax+420a8G4S3IeJ9
g8JYbs/R5rahvXaXuSPusj37ss575FbeI3cL75GPxSqFJ90oTqMswi1OO8Lt
WDuIfJFmduq6Tpj4vmt7SspqAy1RaeqL2IvdKA3iODB5j0x0tLX3aJTQ2GYs
sBmhjc78iEms0Ue1DAjJH8iT5JKda0wlDck4dgd8SUbz2P3kGL1JddGZr+BO
grY6DiV3zEAOvz5hPrRDqW8evzRixto6Djch7XEZyjYg7bY/qfr0sqtuancS
6M+MCqlEZDxgFSyCewDrIhcr+SROUTqCCuY8AO+QCfsg3KP/A+PYHWKhqGQh
o39pIzZqPllx0d4+pi4P0SBGmCh6OCb6xl6mcT6KvhEfDXqZuoxUeZkABAL4
dBMEhIAq8f1k7mEpCSr3BjBYWcP8Y/QyuQ/vZXJNXia39DK5bS+T2/Kmtzp6
UHmWYOg2FdEPY6zCghU7LDx9rB56zfybelpck6fFQCpV5RyA9+v7ATAT2XkB
ogqHiZ/Vp9sFTPWSf/4OLk/g8qS8ZH/RtZXw9vHSSqOFlQhSFs0MiKWgFEso
1oaqZZrkUiNdo/1syb3Ni8NVJBuB4iMx4h1HeD01g1IqeDAptVnw+85DNQqr
csBjdTSDb6X3h0J/q04OlFIjuxuM4og8fJFHlbXA8vWo0FOGli/WwPGxuI3+
4GqbWuBWfhqh5xzQA5a+oYpSYEdHCUXJiLYQJXn389Xpz5fn/BWsDLAYsMxS
adbrfCFncBmWUcOGtFOIFlOhNJPKETYUR/Y6Nmy3dgAUE6tZlcd0yFuQoMer
pVw4HH6uoMaWYKEKvXpY2XJxU5JRiVla9/beCTceAsg7JINuVDwMCglq4neS
EXhbZzIGhYVt9WzX34vLq+72WL1ykVjkPx9lw7oVMy/KFH2BgCMygVDCz9DJ
5FAxvEChy9a20OWZxlTGzEcW9CiSJXbQzQY2hh/i8VQubQko8l8CZyMkgW+j
jn+l4LjXcilvFPQqR42XJ4ulmtzitS+aY4lUy6Ki5UO39UPDivBknP+wcY1R
gEBetNYhR4vhLqeKOMUbURi00vyMVSybIOEEcVERZkfvOamw0AGAoCfMbCo1
H6NedR+b2N2twhuAYIhYiJs1XYEkmBfTUFViWtKwivFcKUR9Ty9h5m6ncAO/
OMsHa3c7R844pDh9e4kPY0e0ubUibFm3XVJ9rpYfUGBNj9SRrvapO9K4JZnh
M0ccR9YsZWR9skPM+pwm1yh2i1cSXIN3yiaOaz3l2vgcpbXOPyCKrTqoO9Pu
J76ltZNJvXmct+cN72zDcHoprGmzeOepLsu0flb0kEdnRffVNCsibc3KxdCs
IPB+B23iE8bp0L3oTodIW5D7ivqx8XyIzTTwNknHLQ4ZTz0ekwCF2Dd25/ue
Yi4VnhZQb3sOrxHdXD468mxPRdZPF3rS9CwrtVD/S5hPEFPAy/IOgMw6J1NX
UrEx7TmwfhvUqP96XrGeaB3XoMYu90Fzo/Y8alKjdDY3ZfZsZQki0Sym/UsH
64eCLhUhln7Hkuoholi4AeBvjDHdHaFuAKRbpeZvziXu+vR8Q2f6PGK3eSSH
uzZmkg2eHXWCGZ9rs0fzu3Gg1h/tej7Q6zOMJXtcEO6BJPvv3oTusYsjVG/T
Nr2x+LSpoVZQT9UI7f6DUYi1RmNEhFGIBfXayO8lsPYvt6lcKcbw8x19HkQf
LzazoqAl3ehBaQfxJ8fjzg5tzNgNw6ltj2xuyDyUHZPdzWkSNAGW4yKHfzlc
aLpfaadzy4CESn3MM4O/I4qMiEOs9qqoiq2O6clSvAgwPsQDIAzHGw28rl/i
sg5esfjOr2VUprMIpCyp/H2TgoYZsObA1I+V7Ue+JeIwTpSUlm17YZbGobDC
yEr6xl7fmyEz5ISBCa4tKoyTSDH6JLOwci76OAL0wAgKvIgsdHBEHm4bRlRi
2xUYWCMz9GJkNkYnuBJLxflUtDfO6AwvH4OasBR1k69OqEP1XBz2TV3cDMmL
3MLSASDn6iPM2R/F8qd1wzVufoumF7DBtZy/05CWpEPfOfrlqLtS6wxeWBUs
4ZyQvk/RWY5RGy5GSMXkl4opOgbNXolJWImLCtuNMfQZyyFbFAynMMQpiKnS
hIMfPDp5wfE2hb49J5NewrY/eBSvGlSkCUb2gGJ/4hsgcmDemyb6l6N12GiU
URpHehAg8svoPEdiSAzYKbZCYQCgyZe0T5/hIgXpRlhpj2nVAGfddDYQRX8i
m3Bjz5kkZ+TYPFb6F+QEipMYQyYThSFMdoKxRm39e1rX/EWnC5YAzr8w+u67
xo5Q4za4awnXqS5wo58lq/9FLXNQUseYqwwWY604wVqcyhn/6e4mhqkGke8G
rh1ZIOPgvvI83Mbt1SEeldPjGMSQ8Dy7qqnDL/L8Dhs7/amUUfxysVjx87R9
H0zONJ2u7lui6Se48ZkCtaGOYXqXFBIYHgv32PFB3wjBf3j1pveAlq3H/Ewl
FBTnHFsW/OADUeuBqzuqvdDuWzWf3Q4Wd/PX+jgPREIXQD3Hrfc3vhyZk/K/
4nrx1ASeOu7dc3sX9y/if9sUvTc2sPGBnVxkxgaoOP521FDfRMzQHtlO55+3
Wtjm8M+qqH6rhZ0OAm21sGmxfeTeOmugzb1VVe+vwL2gLCvuldYfgns1Mz4A
99bz+Ufn3m0qFxkb2DiBH+PuTQ3oY4Cq+dmbe3eqhtRqYZtiAFUMbquFnQoD
tFrYNDaX2Pd0cXMDFi9xREf9wqWvw8BhFDXUb/BHUL/Osf1g6tfUtz8a74Iy
0vE5oYVkkoQYRQqDA2YEfsVsG4X5CwGwglnzIjNkaEPaMeVhCuR8nW3mZri7
71NCTgzvMTcADKJqzferZ0UfHIp5niNl5e1uF1+TGwfjYI55ArMDlDrrtd0k
YiQvUzvPZA7zfErxexgelI+1d3L85vKX868oZYAnwdaDFYAJtD3MSMBoBoma
GVS6S/kiAW2J4tanxJ3QsD2Hro/rhhghQ4KGaQ/pwChfJ6noM3Y8FGQJGTdW
gGUGmi3AqsEKJnQ+HFiOeCinS3lTMToO4Aco36LsFugYXgcx1G4hovoh8Bab
xD00ldHpWEA1VjPgCMQMP2mXACHz6GoFfyT87MUhPz294het01sev5+mj/l3
IIVylUxgkRI1ESCILuZgVuFu0yd5czvrndVWnKhSA2A0g5onuBWmmbq9Vjdq
KWeTvOjFNINXT16o2exGzvlBVRXNeaI3wBplTu5u0SbLW7uwOffp7QJ3TPli
ie9eZPx2qTIw0cjv2e/cYj67NzfHxVEhg6AzU3r1jM/VuwX2AWewrKWmPmkT
77DzOBqjd7mq9ulS3Lm+mc6LE2XqbWcwRv+dOXrue7hwNTk9fTWx/YnvTmwR
Vrd2Cmd+X55JU93w6uS053g8qFb8CTxRN4YepHIcjUYPzk/PXvDkbvlB4f2v
W+2bjmoE+Xul7xnerBkY1fDORWNsZPcXByFCn3MirqWCNc6BvLSVjWePNm85
uHz98slhtTkKcyH56V/f8NOZnN7koC3RP356pamjfYDR6rp90FAVgKCZ44i1
c0ZsfpBNl/mKr6Y3MGGfv7ux32L03rMF0vs8vV2gnBtiiLxmRr0jXDNAM8Cg
uGpwthabr709pQbfUPRCzqervOCLZfdATh+onuN2EnB296TOxv4y8cSqVT/o
l4s351fmk47Kno1kOy+VPq9pXguG+kxPdPhiYEbnYHAz1Q6d+lm3W1ZFwrMz
fx2sT5mg7EbgliCaQ890jE5cULT6cEDMbhMo+jEN06bkR4EptngKrIsprXbK
7ISnDqLoNEBNkwr0JIJ6aNYSWdfZipQP+eNPjyfJAkTbdI7bKD+8Hex94KLS
sOkQxJhOgQbtBEAAbARPod5wyLkGoD8m+ACI2ovpbNgMLVJQNcIvDv/BuEFF
XlJBOaIZnhn7tXq/Nvtrv4EwGgjfZCAjrGIMq6GgC+1WX/WiMyxVSv2cKnxO
yTXZFFSFdLEn9GAZqoHWVJvRsK3WkVzGviTXi1wHKVUjoDgUY3SGpQzLt2W7
wzzedDuuzaDDRDZ7JFltuHhIJXM7h13b5rIxdXV1sIWk7aRBLC03zOLYtz0V
uU7oS+nAH7GSXuykYeZ7mSN8UZmWceBGsVJhKoJQZbIuh9FPxGvog5EYXZ3g
sheRswa3jhA5t7q+YBD8sJKdXIB0AQJ4DoZTgYc6ikH7t0GNaSmNLWiBfH55
+fb057NzgDy4MVgcWljog0skYrzj4qfnP2scV7/xdrm4BQLrAq9D0NAmFbS6
vjMooaO+Erpk5vModaf7BcSrNRFt31pPvQMSXiCGRP3O2BWAAeB5dat1+q1a
gqK60X1r5kvaxOo1NDjknz8TNPhyyOO7lZ7Fcpui1KNHvydu+HwMb1t9XCzf
T8Cgfzf//tFMZatHX4akZAf56rCJ5vmJNwucICPkOMif4NaKNioSCWreBwKY
zbrhbHK5lPf8P/wNvhX/4e8bQo8q0AEtML+9un90BOL46LVOqNZBJNFv7FN4
PG430inVIUVcxAJFQppQlQOsDkmb6sT6wmFehgfMSwIkysFNSos2n4VnYpCv
CUFCiR3PKMcWz9C2sb+g3m2qG2EHKJgkVUoAAGXb6P9IMwyTyjB4BE/3tWIW
+TgBMXlHwKZOJJ6mm6Ac3AmCLOaKP75vjWC4PDkIUZnhfoFP0c8gTW1yGcoU
t40ByKGTNaT9eTok2gvIEUB1sOiEaJTxmN3vULkUF52FoUVeG+frTf5aBLXf
OjBaB77JOnxVBOUEOyKoiehDKCf4yhDKCR4QQjUb37IIwRiWGhR8O4MqEsV/
r5BVKDM/cx1LxcoOU8e1Q9eyAxlJ244zz7aTMM2yMAsdN3CsOKrOZ0nsOIDv
4kSKLAEMViKridgOWkUNaFWKe74rD7CeLBrhAd5asgZkEF2MVbmaBpMJCvWJ
OExzRcfBNq5JUXfmiwpE0PnASaJuVzKeqaNe9ufD6LzqBYM677fBU8FpC8qm
TRasiGwhAA4prNAltQeyWFIcFKxhFlDQTVpUHQQNh7a3ZGFI0TpU58rHHBRs
SuFqm8TuQG/HxO5g912bsutsBPKZhV0AYJ4IVMpAiKAmQKenFO6CruEIkTtY
BBgmHOI2uCtgECyk+kJZhIV3YKCORG9+hilyBqGzvvdb6DxFRZFS3HoDkJFK
pHpJFZTiCB0ZoPk8HzsHfBD6ODywTeB3RiWrQcNFNjYCY4MpAKSCpb1cZC8V
8SjdqfemuV+r8vZbBkbLwDdZhh57b6DzLgd1nthZ54U9lSe2UnnVCCin5wBd
qB+6OR27qLxOu4MqT3SroxiKsokdirIJXZQNqOYQ/q2Ux5OWTml9McAaIOxB
mcDvOMWdFkml6oQ2t13UAwHlyXkWmu1uirfhRrZH23sBfg48hgdeOlQ6zaK9
GioQBsIqNMXYtnu1luT36yCjDvJNOkjLMzXWrxOtvPq8UM2wEr35X1sKT/T1
ux9+UybnG8wr22zhN5rX6oMe/YBJSDWMshT1Hug0kLi63J8V4vAyhQMAwQwj
dDJUpBiAZOMjHh08EOImIouoiw6hGcBJsa5uhzpzsDdryW+/jjHqGN+kY7oW
glBrSiHY41mgz9EXo4OlaYsrv5YIpnIdvQp21W+ttBtKsURrC5EZkDIAI1RE
+NevTTFLD7aWrt96az2BfqwEISXYmr5FgTsO+f6AVDCmDOPUUquouSzI+ndp
rx+D0aiYYpAy0CWAHdDZ51GEGlWGE1TVvsW180Nez11PkJZ5PbjRuzp4Um9X
VlpnpORN0e73nVYoHPZQz2cnXBzk8quT00mxsde+s4yqzYuQXqTB5jTnvVSU
34FD2jHnYjAZwKOoyNRH9geZ4FB0Myy6S0U0AWCBbYJB0D4KFqxhaqEcAzsF
LAvXpwoOKZZLEg7VM42ojKlPVRuAYJpYpHOYmHPY3Yhv+A7LQ0Iq56F2zY7u
BmN6ocyBHhZzbb6g+5M2h0uHJ15tGRJ5CWjgWdo9PiygzbD5A3eKrqEC6NAc
JEBtVhbLkA0yfAoKu3qJuGRgD02gYeFSHgbYe6mLvh0gEAxWp3KaAI1B+kVk
SYY6aj1EX74M0NUGVqhKyaChHCtQS0CAysenMMrEeEJdq9caBfc73QPFA/0H
hYQ0FKFkwfqiigJTHCzrirA9QTgvJBIWqFIdBwjqE9B6RBVQ4assZklMtbEd
FDqodP0iXDAzJkpu2v+NzBHXQzUJE+hRQC9wgg5IVqI4RMeiVYDphYlFnpao
9YH1pY9aHBStsphNxYAF1SPwdDxwhhMSiB7njHFL29PeCk45rCrAN9IPGKmM
q5Mf3+hvUFX88Pby16MmfqrrlNXYp35kKDFusxplnQzRjg1vFOL1q/tpQEJR
tiZK4rVZQIYUIHz8YVPmhpKXm/NZpjyNJWo6nq+y1HOCwHaxRr4VZk6mHBn6
SehkmZv4se0rL7BEmGVOVB2m6wnHT+xQxHhocugajsc1pGrWnRvbKLT53hiL
laptBGN1q4hUHxq9HKggkmF6AHAawucAI9QdEnaCKuoClE6oABHuSAYYTB9T
EfzQLktO++gcsHzMWkGpKjDYDYA57ltEGIfQAX8ld4zCv2EOOWq30iqKgyw6
gIc24aCq3R4QqubwUL+jxzZdPNR7oOQV+qtgEgN2beC6Fmq9LFDrpUatRy3U
evnrVqhV14FRZDoJUguYO6Lwikc+o4Tssow2thWZZiHFlUvyB8EjmY+1KYE+
shjRTkRhsDZtkgjHQILVxA5nXKLDysFATqDqyEd7K7HwT8vCfI+A9seB5m06
7g+kPeaVhUhyNlUYtyPU97g3RsnMIdXpFil1vJXJPF6Acqluiv3vYRGPR18h
nqV/h44gEfW59qJ19LxAUqi+ap9of1lK6PIvXSpY0In2+hqSTjvITRaRnkTg
TYeUzkm3PjmiPDKlfE1BvJ81Cbv8GAWn0IV5m6Hq9QOG8ryN47ssFyGI01TJ
dW8B5l2+ftna98do1aJPn/lW/z2FJ58WnCeg34+KKNYjld49Ohx7ML+LywdD
eHDj9z5N5tnTitftzR99SgUXX6r7pw1Jgc+LsX5WT79ftR4U5SKte/gpEEPj
wQm+0d7ojcnyQ/NB/cZnz04dN/LxUNzzE/fMEeeRa52enIkT4bi2G/Zivc/O
ToUdRPaJLU6ePzt9dnIaOT6eVeufnbnucwsG8PRT8z0Ovcf17OhceAGo4Wfi
xDo9Bz3sPLcix35uP3dCv/ee05Pg5PnZie8+Pz07t2wrPBXCPfXs85Nnz30r
EI9hRI0Z/MKa/zaJfJDCo6oAtSQt6+sa8yHaE5jzatHesod43Kca+WBYgFRE
frDR11SdPKB5A+QXHmxfooGd0D1ro3s+jO7paIiwqN/fhuFsexjOezCcGWD4
dnudBhehYa9zF0lZPV0/3HuV7TgGAbYzUmM9J8QYUhugJ7YNPfEBemJ7WIsV
PbFt6GnIrGPb0JPJrBtcx4aWo6X0Gs7MUEfz7r6gbMCrtNWCsu0FRH9B2d7m
Pywo215A9BeUbS8gTAtaYqatSiKZjcRt6n43sFq3OEDz4LcmSHtyqAuWMG3s
fc8P1iC6vvOudQeMuFWHsJviccRqq7Kco8GqKKKydqVtua7tCC8U1iaWb6kO
mxZw1/KV8K+PR7uHvu2ngeUnfpVdKZTv+W7gWSG82ZYe6F24G3sgLMsWNvYj
jpMSMVR5pdJNHaEAOSQyFVIjhzRNCChIW8gsTmKZlEAhraxy180sQaNDfKA0
PoiFtBKF+CBDfJDZGeCDRAYyq56TvpslqUJYkAAsSDxbyTgjWLBNIafBRBxj
4Sa9bgZNU7sCiOX2k1Bs2O+9uYRiO0GYjoR6aAfl5hKK7QRhKgk1UD+rWE9j
yQ7MDFaY8gdjxRxOgWZzZgwLbJJFC142ao6vb64vX3rHMZOUKY3T6knDbXsP
ydTmnuMbtMrrkvOlGdu40paLpwAE9afacN30LOtSphY4spQOetrr5ooA+byO
cNfGd5VZdqhTErvBIZVYgfZmd0UeG95U1dY/7ObBpQoDKGJTVdcR5xhtA9Fa
3MhbMFUr455/0VLtjiJSZjLBzEaMUivz5Ew1WB2hI9yb92DACjoV6q0gSbt8
kiKVqIVmNX7ZrmN6MLGjJ+2ST43l7AtPu9pqJdfjxrQ07L55ef7b1ZvL85NX
mmG+rY+++XKjk94qDZuKMMbqdY266vstVLVHe18Ne+0by9M98bk1kRuUEv3a
vnnbrnzzW5ZjbAzKfC5PY2hj54pY38i1b5lCO1qdbEU5V0wTU8iKouPmYomh
CJiVFKIOBvs36qbPrTtXRKBc+hXlhFp9VIBmm7yLtNHoUit8rdnEQFejEBEA
BvGmVIRc0qkCAQWPYvbUJrqiCtvtxD939MQPb3972+zSYRsLdr8u6ah30AiV
X17McYdxXtY6Z+RFLuPviNjKUJNmm0eGmGgDqblNy1bEDx4ztcUiNMOkHTYY
9efsEPXnVEexisO2/Cm08Pr4M8NpurbbPE734WOe+DqNBZic7e1WRBy+t1sR
5AHb260Iz7K93YowP2zQDaTX1byDlGYYPhVbOGeKjjcAXJ8K5A+ga4v2jkRa
plf6yDEw+tAuIrQiH5aIRVRwKIzwQRcWzaUzFYAtpEH8NqhsLLJuv44x6hjf
pGNDAUSN2h7/1gKImhlV2wYQNZ8dDyC6GCw0SqfvAMPo1D07xH1HmHUsBU5h
8b5PrE4lX4HBQoe2Sm2SHQ4mPIQWkxHKF5dSyqA1LDsVEpMbY9Favd43gAh4
GGQHan/KHYSeo9whBZDSqbkRRbFiNqGgYzQpWiqmejgpFSbyfTqhxMayRsCo
MSXgBBmW02lljm3d/40CiHw6xETRuSSgfjDQjsLtQM7iFQdZAU8Tcuj86pgq
7TkYtZuSVEJmipmTkBpzqJSYTWejSPydhH3Wudg2aghPzjJHDdE3Omro4rfN
oobqxr551BC9emgr2zssTkXfPm6o6V79XSKHijkdNE68ur50przY8j3lu0kg
UiH81LOsxBYp1Q3w08QNQxtWzorgpqgqF5lmYZQKV3puJpQXyc0Dh6hvY4FD
ZQz7HiqElbptRIWMBw7pXg6kCLsoC6XghZCjs0Cx2HWCfAk2B3CwleL1zCfZ
Q5W0QfUDC4IEUjYm4wBIgJuxOBZVC1QUp49FhFslxJvcNho4NHrizddkc2Ts
PWONqN1urFE164f0inWRRt3bayvm4ret4owuDNHxF+04o4vtouNBN1pUjM2j
U9vjBPEkUCkeMEBpgFh6zSJ7xEcMCfQMtwV0/qKMseJaGuC2uQgRPdp0sBwg
bYTobisHu/pQTepQemKEegL0tKDK4Bhb5KH+wHp9LsZ2x/RyRcAWbWYb+wia
EjApqBZQ+SJhipBsQr5wPJ2TdKfqbnUNJuluE2bkFFtXztCRj369KdXecnKa
YUZOe/P8ohTo5V/a6enUYUYXO4QZibgTZnRhCjMScRVm1I8zMmVV9+OMRBM5
1d192DgjV0w8a+LYk+eg4Z5PnGDiiIkT9WKO/seIM4JV+sZxRiengXcenZ+e
O+ee9ez5aXh+5ltOFIVh5AnhWl2wwb1TN3j23PbPnke+71snri2i8PSZ61jB
8+D8mY/xP4Y4I//cOzv3bdsJwxP3WXgSCvjsuPD6Myc4P33Wf484ccLgTHjB
uX/2zDkVJ5Fz9lzYz587J8+hn+vijDqBRsbCAVal8/U2XUBlax0KYMRSuBZ9
cKiOaormOPwIKh6iPzjk5ik+CFZ8iAbdBiLuBhv0TAW2vanAe6YCK02F2m2w
PaZnPUzPN8L020UjGRxGI9FI2wjU6un6YYNvyjOIuZ3hH+u5Nsbg3wDNsW1o
jg/QHNuG5obMU7YNzfEBmmP72ZGa5tgamhtc607Ekhs0nETa87bHorMBf9ZW
i862FzT9RWfbC5r+orPtBU1/0b+l80AjtG8f1EQqpoSH3cim5qHeTVxYRzbV
oU3jKHI0tMnZOrTJGbPH/U5ok4gx+GcT27zUwE0bvWubY2hTEDiuI0TqeI4F
v53yOQdb810ffnv423GcgH4L+h11Q56qkKi4Dn2SSQCvVYlylGfFWRKqtAVi
vMStyszHme2nGWEXSdgliRG7ZIGKfR3y5CsvVRqqSLfyN4SygCzwstQJVBJ7
QgJCSQGhwEzETiJk5KSZsLPMkVl1akASPnDok1Gt1TV9qFbifqKODbvuNxd1
bCdM1RF1bCdM1RF1bCdM1RF1bCdM1RF1bBRTjYRHOQOxRJIOV8BjFTLa8qFx
O9FIM6PhQ+ub2yA8yinDo5zR8KivMCRTm3uOb9idUO+POr34KKctXGsze9Oo
KKcVFeWYo6Iu/q1GRYGVu1NUlIiHoqLwmx2josRQVJRJrlamCcYEbEI/o94o
meeLZEq+QDSNWrVPS6I6qYjpb5okHp3Pk+X97cp61Dsk9Ss60+mLvzcPWjcy
U20+hQ7Gt7i0te87qEmCiHIFSXa61iY6h222XbzZruzozHe9f9rBXJ2k/BLh
2Dag8HB9fAVO6EuTQ1Hv1TilKds78Br/W7PF03zmsMQX7QOuy6ENHRJtOkeh
G3c2DiGdB9vSqY/A5nzXQ7BN4zOHoJkYvxF65nyrzSHTztDLrpqsz4QE4ePQ
QW0enZmE5W6o8rUgRANoy44Q4ADwwU2g7pmQu3DKfEHa6C8PxCzY8BC3uCW3
TD8Yzh9ewy2NZypmqa8VtKQHtwe3UPdH2MV9OHZxNjE0th+gkV1omGP84n4j
frFSEyTU3WtxTH2Gt4eReHhYIEWXgY4KU6oFRecFOinaS73DUxuMYgzVdBAs
PdaBNQikHiMb0E5Bqbe5xBNbVMq6XNA57oU2fCpA1kSXQGlpOkVOkzNCDqid
D0vNVZRBLXnzyBwP2p2VCm+DKQRDT21K0aAT2/AgLR8L53s+LkxMV1SAAW5R
irfZzQ24CsC0itr1YjibXTk2BGWa0FcF3T06WHKvbg6ETbo7hE26Vdikc9he
pgKmrw+bdA2j9eyGr/LhA9r4KKTVxjzbb4NEf2D7bZBoY57tt0GijXm23waJ
NubZ1hsk1Se98ANFqKjyMnQcKybT8sI6ADXD0skMA2Zjm2YxxZURAUoyjFf1
MIjVozNPE4FgBUAAzDrwAIZ/Ovi4nbTPQu90Z21g5X49Y9QzvlHPmqHO7oan
ohg4qX0qyppkJ7dnzLttva1N8qrCdvO+Xd68zg50KzvQ3cIOjGXmWzKNEwAS
WaKCMJKZ8GLbCmUqhQg8L/Asz088kdiJsCpnrC9FKl3pu04Y2UnsmuxAE41s
bQeOEhHbjLw3I6LRmR9Bt1reV8ug4ycfxCZ0uSEEUG8jhIRz3QGr0Ih0m/sP
rae+nlnIOmahO4Zzw69PlD2z8BsYhQbuboDccBOyHpeNbAOyHjIK3SGjELQb
YB+XijX5KSUIOHh4qk3KNKSiYaArZYDAQKgHYBsCog/COPo/gLjuEPdEJfcY
rcSNOKj55Fc0FVnXVBxloejhWOgbm4rjXBR9Iy6yTCX1de/MlmIUYiytFyEc
htd7VI428TEIVxEeB9TZO9FlXVKf+/CWomuyFN3SUnTblqI7YCm6jc0YmEIr
wLnE9CgL5xWM5SgzmH/uxuafazL/DITS3LhZ3w8Cj8jNC5BUOE78rD7hISKw
Ip+/g8sTuDwpL+EJveXt46HOo4HOBB2LZgakUlBKpbGw/jVi6ZsH9ddTMyil
ggeTUnVI/5bpxpsN1SisygGP5QkE30rrt/ME2mHX1MmBPJ6Y2iPXFlx1SFRh
MewMY8IFnVoSudgpjypKRhmWeXQyzKbE81Z9TO8H+J4pqp8dYSlnPG1bF2Vu
9ogE3s9Xpz9fnvNXsDLAYlc63h2pqPMFViHHM/nKCqLtqH2M2tFMKjts6B4J
XZ3+8+cx9mu3cgCUEqtZFWhzyFtIoMejpTw4HH6uoMKWQOkWRC1WpoQqrXt7
74QbDwHaHZIJty7bxywcqInfSTbgbZ3JGBQSttWzVn8v7q6628/+rjhc0jFX
Y+xXtzJQjDtDweCRHwldyj6dS0DHM+GBpAmeFhRKspYpYzcJEVgEEg8xsD38
NkiZS6nEIGzgKRAwoYd1gyObq/6hmwWvvS4jAHLNm0ScZa58eVMVJpCPqLyT
8RMhsHENR4AkXrRmPkfTAA/CgvaKNyLbt4LWjKmoTUDQOw/9pD5lHfDOE2Yb
l6b5GPWq+9jE7uK1G0BbiE6IfzUlGY8iomEV47lSCPCeXsLM3U7hBn5xlrOh
VEKMlRgFD6e6cCt2RNtVK4KRddslnedq+QFFlD63FK/ojjRuSWb4jA7AGDot
CQRs8crOkaGtGAn9BEVZzj8gVK26prvR7iHe3QKS1I/HeXvG8E7jAYGtA41O
dYLJ+vnQgx2dD91X03w47fm4WD8fljJOh+5Fdzqc1nRcUTc2no7W+XjDSnab
ENgWa4wHwo6xfiHhjd35vqeDS922yJPFUr3tebNG1HD56MizPW1YP12oRNOz
VfWa/peYcH+PTCzvZqu1XqSuiGJjinJg/Tao4vP13F49mTquLI1d7uPiRnEe
VJpGsWxuyuy7ChNsJ5LossJq6VQRALAncB+WxKA8f7DKAeHSEb0daW7AnFsF
im/OJe54sLiBS7AzfR6x2zyCh/VszCQbPNu3Jz/V9qTxuTZ7NL8bx2T90a7n
A70+w7CxxwVVMPUuqLH/8iNjurihkyN0T8fVmGN2TQ0Zo12xFo2DRW/cmM62
Ekj0Wbf+z0tg7l/o3HPG8LM+A32whsGLdR6Lgq7UvW70oDR6+JPjcY+Gtlzs
hpXUNj42t1oeymjJ7uY0CVUXtT+/HCo0288e6twyFHBl4cYwgPIs5bE+LTfC
Qj+pT9nMPu49WwK/ivFocYPLceB1/TzFOmvJ4ju/lpHTufBhlxT+vkk9w+xX
85+0bNsLszQOhRVGVpL6sbL9yLdEHMaJMpRhqDpQeeMyZIKB+W2dqorVmxJ0
YKQpns2W2pTOHuMOvPBxTyOz0QzyyFGSRniEG574ZWEQhApgVhhojcynPX8X
dzz8FBu0O0UOTqhDjanoWbS41ZEX54+Wdr6cq49lMtAfwMCnVcMVbn6L9hYw
ABUUIjRLcqHv+/zSjoHewK6FVYgdPIEvoGJXUYAeI5suuj5GRmQRRnNkdJCJ
CDG0Csti0Rk1sYerE0mGJOygtymkABD4E51SIbS2Kezt+ZD0CrbdvaNY1aAe
TRCyBxL7E98AkAPzTm1MyOymKR/HRaN8UsshoHiYd5sigkIbw2MEnQ3kZBim
ElDMDNyQuOTl2wwn7TGtGtysm84GmuhPZBNq7DmT5Gscm8dK88JE4ek2Edan
AIGCLlMf60jV0/Udv5gDupim/M1SJqB7+OfvcpVMsHyImkz1d19wWtGbUuje
KkWjODCFNFZxb7lNWhXrkgRQZ1MJxuMU774BM1Jj0I/T2YwSJPCORa5oom7u
APBgsIi850v1D3glnlpO5Z3eobQacJQewheXz0/DyI2qPyLLc/APbBaQw+tJ
aFkTzz/RSRxT8hD9A18neX4joS+5InXbHFY6zTJYSOj8Usl8QXkpxRD5zfTd
9QrFZzF2bYlTJbPV/W1rWqarKZ6tTntfJHQXK3QNZVM1S3M97mLekB4+qtns
iF+0Zgum/3pxN4MbYdQ8v0N8uODJtUrek9bLpzfTmVwOvBkoDAd4/uIMQITh
rUeEwc7L3azz5XKBbrbv4OLV3fJ2dge3L5ewJM0Nr+JhxkoaMnz51qbqGfjs
ET9dLJe4oNV9lNTSOiG4vdgl2vPWu8krmr5oEyJ04MCpN/tc3JSwygC5wMVz
4W0HSwnFEoNj8cDVGP2WHhU5pEqVKPpjn3ybknsxc1K8zffoXDM6TCoOyhjF
kI42CzHUUAKGaYYfNCezt3lodMsZZta10VjE3UasiUKOG/O8WgNTWWU37TuV
e88jd1K24TzSqNsGwxhhascr+V3rKezcFlKIJtx89cvFm/Mrmk0xMJVimCq/
1lTq7vwOVElT+QYhe+E9bE5kq/5iPZUoY0q7ZHU9XQJ9aknFD354++uTIUZv
+igfhM2DNm0GNJsYBwsWaISoDifXoYqJXlEQFb99jvG0+ja8Aa6fc/+U7FaX
bjsvH6TzX/1T+nmOf2Jkb282/7pcwLjmdzcxiHhk1ZaAK6Yqr6ezvrP8rsxd
bD1ZT6vpgZzbQ5Pq7Dypgh+4FSj7Nketu8+2rBxcCwLMx2xSb5FUqvWdQZYW
6eMCN5Jtq/EEbiC0ClKbKbp6ckDQejuI2lYFe7sKQRVBt7cbVa8fVTnrpkfX
BN56VpwBafk15kM05kN3b6NpQGxziuFHi8lS6SSIEuHoOaK/cHQFQh8WffUN
g8LvaqgUbetvgORkieiat68nDkAT07zlWs1oFGtb4xNYLUjdzU+N4qhEtIXW
GVqkYKR96kN5a4AlEvXNFdZeI6Drqtmo8cg+tkP82UnvsRJF7K73qnUHwD29
xZqNejmqRHGC3vXqtydzrk9UzfknmIPP/9//+X99gSm6PeKXILCnS00TlLv9
if+J35onPBpd0NaEe0c+UIKjb29ZM9upRT3ZWVb/WFb5Yzc+m39wL6T57NBP
D/oOzfXtYjpfDU8xMVVhJQJtU/xhMYdSP1uWkNb1m6lRwxrc/ym/u/2z+NNT
/Eev13/F9fpE153i+v8MjeJ3//F/p+/g75gf3CxSfvvkD7Z+mA+rEJRgFliK
ytOl0+ZB9mHlU4lH0GNxeQfrZgYpOt/h/jhgmY9PgZSEP6EpVLkJPhKQGA2o
xKor++t3Wq8WDmG2+AhmeopGCn0jPM+ODF8XboBMTmfa212brGCRTv5FLRel
p3uHCd5q6spEDQxo2oCCez9sk9uCMdKvxfKrk1OzUmkplP7RQk+0k6F+wnx0
UysgpaV3kCLxYrMcDygDVBm41TSqHaKSendT30FDe6Pqdpuqe0NpUSINs9Nh
Y2OEVC+MmP5GGvxd9GErBV9ztp2h0x+tlQABNKgvAMd+SKFTAncLsBiyPuxA
YgBmQjsEoDZDD3dvooR2T2xUgIFPsd02nV6tkVLS04H8p8V8kmLA1M10Ps1x
otHoKPTjL+iUwP4u74GjG8ZhPf22P4mnjcm16ZhtiwilrqFTr0Kx59V+ZfU0
PDewDmMmTGsdGiGVDYeglkJYmBn9b6gQKEtt+e5O208ZURtFw+RlXCSZYTfy
H4vSqyaqPXZP47GVfJeTO3ep1U1a7KdI8tYtV/jhdpHn03im1tFCFQtezeAe
DgG2OzDCdb+Y06YryItJ5bNuek/q5Z+uuZNHzzFAEIby/HnH2/I3/5CLv5v5
E8Gh/1COlxYMbfbvd4Ch3+Gg7pbT1T3MwzyfgsYs3L3kiKdvSv97ukiIWs0O
eL1BPMQhH6/RwV62SMlPjXehY/peaxY8aAMPuaAiSdoNAQ9WL0rknEoaqaqJ
ug44csSrX67e8J9+foN33OUqPaI9hpOfTvrDm8q5pKHhRgky0Xyh72x3DlqY
TCawEsl7lEr8JHk/X3ycqfSddqN8Pi78ISr9/tF88Ug3WWTTgqTHjQeKZpPz
9+QEv1ULGAr/oJbT7L4quc6BIFZwMVnhUzCUp7pwyGo5je9WBQHqRDGQXItb
6F48neFc4oO6/DYWnoJPxwghT6+XKNvknJ/c5P/6f+f5F70v8fnN9Gaxuobl
nkmY6vLq1UplcO8LfGjxL4sP5fXL6XsJKu3Fv/63d7O7eVpe1q2D1nq5uJvJ
G1m183wp5yCxE8lfy9niJgbWLL/6cZpO4fIige6X116jGOYf4M0I1a5Wi/df
6h2Tz69AZqoZ/4uazmZqtVJfiLVwNbLZHeCh/x9fLpTNS3MBAA==
</rfc> </rfc>
 End of changes. 339 change blocks. 
1450 lines changed or deleted 880 lines changed or added

This html diff was produced by rfcdiff 1.48.