domain: spi chim

text:
Driss Kenfaui

Zarel Valdez-Nava

Lionel Laudebat

Marie-Laure Locatelli

Céline Combettes

Vincent Bley

Sorin Dinculescu

Christophe Tenailleau

Pascal Dufour

Sophie Guillemet-Fritsch

Z ; V-N

Innovative ceramic-matrix composite substrates with tunable electrical conductivity for high-power applications

Keywords: Power module, Ceramic-matrix composite substrate, Graphene, Spark plasma sintering, Electrical conductivity anisotropy, Breakdown voltage

Introduction

With the unquenchable thirst of societies worldwide for energy and the emerging ecological awareness, a pressing need exists for prioritizing the use of electrical energy which represented a share of 19% of the total final energy consumption in 2018, and it is expected to grow up to 24% within the next two decades.[1] An ever-growing share of such energy is managed by the power electronics (PE), a key technology for the efficient conversion, conditioning, and control of the flow of this energy from the source to the load. It is this technology which is associated to High Voltage Direct Current (HVDC) networks by the mean of power converters to tap into the various renewable energy sources located far from consumption centers.

A PE converter uses one (or more) power module(s) (Figure 1) which comprises semiconductor chips surrounded by an assembly of heterogeneous materials including a metallized ceramic (alumina (Al 2 O 3 ), aluminum nitride (AlN) or silicon nitride (Si 3 N 4 )) [START_REF] Sheng | Power electronic modules: design and manufacture[END_REF] serving as a substrate to concomitantly ensure multiple technological functions that are essential to the operation of this device. The ceramic substrate indeed performs the dual function of electrically isolating the chips, that are brazed to it through the metallic tracks, and of extracting the heat generated by them. It also fulfils the role of a mechanical stand assuring the rigidity of the module assembly. The metallization is otherwise performed by a metal layer adhering to the substrate by using either an eutectic bonding process, such as DCB (Direct Copper Bonded) [START_REF] Iwase | Thick film and direct bond copper forming technologies for aluminum nitride substrate[END_REF] or DAB (Direct Aluminum Bonded) [START_REF] Kuromitsu | Direct bonded aluminum on aluminum nitride substrates via a transient liquid phase and its application[END_REF], or AMB (Active Metal Brazing) one [START_REF] Sheng | Power electronic modules: design and manufacture[END_REF][START_REF] Nicholas | Active metal brazing[END_REF]. The connections on the top of the chips are established by the mean of bonding wires, ribbons [START_REF] Ménager | Conditionnement des modules de puissance[END_REF] or pins [START_REF] Horio | Packaging technologies for SiC power modules[END_REF], to electrically relate them to the metallic tracks.

Prior to the closing of the power module housing, this material arrangement is encapsulated by an insulating polymer, such as silicone gel, to achieve both the protection of chips and connections from the environment effects (humidity, vibration and dust), and the dielectric protection along the substrate surfaces by avoiding, at high voltage, the risks of either corona effect or dielectric breakdown that could come about by surface creepage or bypassing in air.

The power modules, that are currently in service, include chips predominantly based on silicon (Si), and they cannot then be used for very high voltage and / or high temperature applications, owing to the limited physical properties of Si. [START_REF] Buttay | State of the art of high temperature power electronics[END_REF] The voltage level for commercial modules comprising Si chips (Silicon Insulated Gate Bipolar Transistor (IGBT) module), indeed, does not exceed 6.5 kV, and operate at junction temperatures limited between 125 and 150°C. But, the emergence of wideband gap semiconducting components, such as silicon carbide (SiC) [START_REF] Buttay | State of the art of high temperature power electronics[END_REF][START_REF] Raynaud | Comparison of high voltage and high temperature performances of wide bandgap semiconductors for vertical power devices[END_REF], has enabled developing chips which would distinctly push these limits, opening hence the PE technology to new potential applications operating at higher voltage levels (up to several tens of kV), at higher temperatures (> 200°C) and / or along with higher switching frequencies (several tens of kHz). Thus, SiC chips, which are capable of withstanding voltages higher than 15 kV, have already been reported [START_REF] Millan | A survey of wide bandgap power semiconductor devices[END_REF][START_REF] Bilbao | Analysis of advanced 20 KV/20 a silicon carbide power insulated gate bipolar transistor in resistive and inductive switching tests[END_REF][START_REF] Yonezawa | Low V f and highly reliable 16 kV ultrahigh voltage SiC flip-type n-channel implantation and epitaxial IGBT[END_REF], reflecting then an enormous potential for boosting the performances of power modules.

Nevertheless, such PE technological breakthrough will be accompanied by the need to miniaturize electrical systems, which will not only make it more complicated to manage the power density and extract the heat dissipated by the chips, but will also markedly intensify undue stresses within the power module. Effectively, increasing the voltage level in the current power module results in heightening the electric field at the junction between the ceramic substrate (Figure 1), the metallic track borders and the encapsulating polymer. [START_REF] Hourdequin | Metallized ceramic substrate with mesa structure for voltage ramp-up of power modules[END_REF] The induced electrical constraint at this triple point can dramatically impair the performances of the power module and, subsequently, reduce its lifespan, when it exceeds the critical one allowed by the dielectric strength of the insulating materials, thereby limiting the voltage ratings for future systems. Note that an increase in electric field within the power module may also lead to a premature electrical aging of the insulating materials, even when operating at voltage levels below their breakdown thresholds. Such material aging is mainly triggered by the occurrence of a localized activity of partial discharges which occurs in microcavities that may be present within the insulating volume, at the outer edge of the metallization and, in particular, at the above-mentioned triple point. [START_REF] Fabian | Analysis of insulation failure modes in high power IGBT modules[END_REF][START_REF] Wang | Partial discharge control in a power electronic module using high permittivity non-linear dielectrics[END_REF][START_REF] Berth | Partial discharge behaviour of power electronic packaging insulation[END_REF] Accordingly, we beforehand undertook a preliminary modeling investigation, based on the finite element simulation of the electric field distribution within a power module, to evidence such electrical constraint in typical geometry. The power module comprises a 635 µm -thick AlN ceramic substrate with a dielectric permittivity, ε AlN = 8.8, and an electrical conductivity, σ AlN = 10 -15 S.cm -1 . This module is encapsulated by a silicone gel (ε gel = 2.7 and σ gel = 10 -17 S.cm -1 ). An alternative voltage of 4.8 kV at 50 Hz is applied on one 300 µm thick -copper electrode on the upper side of the substrate, whereas the other electrodes on the upper and back sides are linked to the ground. The achieved numerical results are depicted in Figure 2a which indeed shows a concentration of equipotential lines around the triple point within the addressed module, resulting in heightened electric field stresses, located in the ceramic substrate and the gel, with estimated maximum values of 56.9 and 50.4 kV mm -1 , respectively.

Most of the solution strategies published to date for mitigating this electrical stress involve polymer encapsulation. Yet, it has been reported that in a power module, the activity of partial discharges seems to originate from the ceramic substrate, rather than from the encapsulating material [START_REF] Auge | Partial discharges in ceramic substrates embedded in liquids and gels[END_REF], and the gel possesses a higher dielectric strength and appears to undergo less electrical stress compared to the ceramic substrate as highlighted in Figure 2a. These strategies mainly involve modifying the encapsulation polymer i) by adding micro-and / or nanoparticles to improve the dielectric properties (breakdown or partial discharges thresholds) [START_REF] Wang | Partial discharge control in a power electronic module using high permittivity non-linear dielectrics[END_REF], and ii) by using anisotropic materials or properties gradient materials as functionally graded materials to allow a self-adaptive permittivity gradient at the area where the constraints are more prominent [START_REF] Belijar | Online optical and dielectric monitoring of anisotropic epoxy/BaTiO3 composite formation tailored by dielectrophoresis[END_REF][START_REF] Belijar | Method for processing an electrically insulating material providing same with self-adjusting electrical field grading properties for electrical components[END_REF].

Here, we address that issue of electrical field heightening by acting, for the first time to our knowledge, on the insulating ceramic substrate. We report therefore an original concept based on locally amending its properties with the aim of attenuating the reinforced electrical constraint concentrated at the triple point by shifting it, as well as reducing its intensity, towards an area that is otherwise less constrained within the power module. This concept was realized by developing, through a practical approach, a novel substrate made of an AlN-based ceramic (material A) integrating, immediately underneath the metallization, a nanocomposite volume with controlled properties and geometry. The chemical composition and the microstructure features of both material A and nanocomposite were adjusted using the required additives and the Spark Plasma Sintering (SPS) to achieve the properties suited for endowing the novel substrate with the multiple technological functions including the electrical field grading sought for a high-power module. An effective process was then developed to three-dimensionally integrate the nanocomposite within the material A. The achieved novel substrate was finally used to fabricate a power-module packaging prototype that was experimentally assessed in terms of the dielectric strength. The experimental results were compared with the simulation predictions, which enables highlighting the merits of such concept and validating it.

Paragraph: use this for the first paragraph in a section, or to continue after an extract.

Experimental section

Powder mixture preparation

The starting powder AlN (median grain size d 50 = 1.9 µm, Atochem, France) and the sintering additives Y2O3 (purity: 99.9%, Shinetsu, Japan) and / or CaF2 (purity: 99.7%, Alfa Aesar, Germany) were weighed in the proper stoichiometric ratios and mixed at 200 rpm for 1 h in an agate ball mill using absolute ethanol as a dispersant. The obtained mixture was then dried in air at 80°C for 15 h to eliminate this liquid.

Exfoliation of graphite

A liquid solution of 2.5 vol.% of graphite nanopowder in 20 ml of isopropyl alcohol was hence thoroughly prepared and transferred to the probe type sonicator (Sonics Materials VCX-750, Fisher Scientific, France), fitted with a 13 mm circular tip and a high-frequency ultrasonic generator. In all experiments, the sonicator power was set at 150 W with an amplitude of 40% and a pulse mode defined by the cycle of 4s ON / 6s OFF. The pause time (6s OFF) enables limiting the temperature rise of the solution, thus slowing the evaporation of the solvent. Note that the latter was added along the sonication to maintain the solution volume constant.

SPS processing

For each sample, 2 g of the prepared powders (AlN + 3 wt% Y 2 O 3 , AlN + 1 wt% Y 2 O 3 + 2 wt% CaF 2 or AlN + 1 wt% Y 2 O 3 + 2 wt% CaF 2 + 2.5 vol.% GNP (graphene nanoplatelets)) were loaded in a graphite die with an inner diameter of 20 mm which was then transferred to the SPS machine and heated up to the dwell temperature of 1800°C for 10 min, with a heating rate as high as 100 °C/min, and under pressure level of 50 MPa. Note that an AlN sample was elaborated from pure AlN powder under the same SPS conditions and according to the procedure described above. The as-prepared samples were then polished to remove the graphite foil used during SPS processing before undergoing further characterizations.

TEM characterization

To characterize the exfoliation state, a similar solution was sonicated for 9 h and, immediately after the end of the sonication, a few solution drops, loaded with exfoliated graphite, were deposited on holey carbon grids for observation by transmission electron microscopy (TEM). After evaporating the isopropyl alcohol, the structural and morphological characterizations of the exfoliated graphite were performed on a TEM (HT-7700 Hitachi 120 kV) operated at an accelerating electron voltage of 80 kV to diminish the damage that can stem from the electron beam on the graphene while maintaining the image resolution of the particle fringes in attempt to distinguish the number of layers and / or the local thickness on folded edges.

Dielectric spectroscopy

The dielectric properties were monitored for the materials under low voltage (3 Vpp) in the 10 -1 -10 6 Hz frequency range by using a broadband impedance analyzer (Novocontrol Alpha-A). The elaborated pellets of 20 mm in diameter were mirrorpolished before being annealed at 150°C during 5 h to eliminate all traces of water. A 80 nm-thick gold electrode was deposited by sputtering on both faces of each sample.

The metalized pellet placed into the measuring cell between two conducting electrodes to form a parallel capacitor. Alternative voltage, U(t) = U 0 cos(t) was applied to the latter at a controlled frequency. A subsequent electrical current was generated with a difference in amplitude and phase shift I(t) = I 0 cos(t+). The complex impedance is given by: Z * () = Zʹ() + jZʺ()= U*() / I * () where Z * () stands for the Fourier transform of the complex impedance and = 2 / f (rad/s) is the angular frequency. U*() and I*() are the complex notations of U(t) and I(t), respectively. Zʹ() and Zʺ() represent the respective real and imaginary parts of the impedance, in linear case; the ratio U*() / I*() is independent of the magnitude U 0 .

The complex permittivity ε * and conductivity σ * are deduced from the impedance as follows:

ε * = εʹ -iεʺ = (-i) / (x Z * () x C 0 ) σ * = σʹ -iσʺ = d / (Z * () x A)
where C 0 (F), d (m) and A (m 2 ) represent the capacitance of empty cell and the electrode spacing and area, respectively. (εʹ; εʺ) and (σ ʹ [S/m]; σʺ [S/m]) are the respective real and imaginary parts of the permittivity and conductivity.

Thermal measurements

The thermal conductivity κ was determined in the 50-400°C temperature range as follows: κ = d × C p × D, where d and C p are the density and the specific heat capacity, respectively, while D is the thermal diffusivity. D was measured by the laser flash diffusivity method by using the LFA 457 MicroFlashTM system (NETZSCH-Gerätebau GmbH, Selb/Germany) on ∼6 mm × 6 mm × 2 mm parallelepiped-shaped specimens cut from the core of 20 mm diameter -pellets. C p and d were determined by using the thermal analyzer (STA 449 F3 Jupiter®, NETZSCH-Gerätebau GmbH, Selb/Germany) and Archimedes method (KERN & Sohn GmbH, Baligen, Germany), respectively.

Modelling section

The finite element method (FEM) was used to simulate the electric field distribution within i) the first power module with a traditional AlN substrate (Figure 2a) and ii) the second one comprising the novel AlN substrate integrating the tridimensional zone, that is electrically more conductive (Figure 3b), in effort to ascertain the effect of this latter and to evaluate such substrate concept. For both cases, the simulation offers a quantitative assessment of the resulting electric field.

To achieve that, an electrostatic analysis based on Maxwell's equations was undertaken by solving the equations below to compute electric field, current and potential distributions in conducting media under conditions where inductive effects are negligible:

where ε 0 = 8.85 × 10 -12 F m -1 refers to the vacuum dielectric constant.

The 2D problem is solved using Comsol Multiphysics 5.3a computing in a frequency domain. The maximum magnitude of the electric field is estimated for a sinusoidal voltage 4.8 kV at 50 Hz applied on one copper electrode (the other electrodes are related to the ground). The presence of electric field singularities (corners, triple points, tips, etc.) is a problem from the numerical point of view. Indeed, the mesh is dependent on the electric field strength and a numerical solution will depend on the mesh resolution as reported elsewhere [START_REF] Beneventi | A new approach to the analysis of electromagnetic FEM simulations results at electric field singularities[END_REF] (the theoretical value of the field tends to infinity).

Hence, the electric field was simulated using the same mesh for both module cases (Figures 2a andb). Here, the structure is defined using a fixed triangular mesh (30 um).

To address the electrical insulation system, the properties as well as the dimensional parameters of the traditional and novel substrates, the encapsulating silicone gel and the copper electrodes were used for simulation. A 650 µm -thick ceramic metallized with electrochemically etched electrodes and encapsulated in silicone gel allows us to obtain the geometry presented in Figure 2, that is too often used in power modules. The material parameters, considered here, are the permittivity and the electrical conductivity that are equal, respectively, to 2.7 and 10 -17 S.cm -1 for silicone gel, 8.8 and 10 -15 S.cm -1 for ceramic and 8.8 and 1.8 10 -9 S.cm -1 for the nanocomposite layer. The maximum magnitude of the electric field is then evaluated for each configuration and presented in Fig. 2a and Fig. 2b.

Assessment of the concept by finite elements simulations

Before realizing this concept, we assessed it by performing numerical investigations by finite elements for the same module, but, this time, it comprises furthermore an AlN ceramic substrate integrating a three-dimensional material zone with 150 µm in depth, possessing a higher electrical conductivity (~10 -9 S.cm -1 ), located immediately underneath the metallization (Figure 2b). The simulation results exhibited that the use of such novel substrate brought a drastic reduction in the electrical constraint at the triple point through the spreading of equipotential lines caused by the more conductive zone. Indeed, for the same sinusoidal voltage supply of 4.8 kV at 50 Hz, the maximum electrical field in the substrate is decreased to 30 kV/mm compared to 56.8 kV/mm previously noted in the traditional AlN substrate (Figure 2a), corresponding to a decrease of close to 50%. The electrical constraint was diminished and shifted to the edge of the integrated zone, where the electrical fields in the gel (near the substrate surface) and in the more conductive zone are estimated at 24.7 and 27 kV/mm, respectively, as well.

Design and development of the novel substrate for electrical field grading

To realize the concept, we developed a practical approach aiming to fabricate a novel substrate made of AlN-based ceramic (material A) integrating a volume including a nanocomposite endowed with controlled properties and geometry as schematized in Figure 2c. The nanocomposite was developed by partially modifying the chemical composition of the material A through the incorporation of carbon-based nanoparticles.

Note that AlN material was selected here as the ceramic matrix because of its better properties for power modules as compared to the Al 2 O 3 and Si 3 N 4 ones. [START_REF] Sheng | Power electronic modules: design and manufacture[END_REF] Indeed, it possesses both a high dielectric strength and a very low electrical conductivity, less than 10 -15 S⋅cm -1 at room temperature, characteristics of an excellent dielectric material wellsuited for withstanding higher voltage level and electrically isolating the chips in the module power. It exhibits a much larger thermal conductivity as well, making it more relevant for dissipating the heat generated by them.

Even so, elaborating AlN ceramics by conventional sintering requires high temperature levels combined to very long times to reach a high material density, owing to the strong covalent bonds in the AlN system and the low diffusion coefficient of its constituent elements. [START_REF] Yu | Microstructural characterization and microstructural effects on the thermal conductivity of AlN (Y2O3) ceramics[END_REF][START_REF] González | Development of AlN and TiB2 composites with Nb2O5, Y2O3 and ZrO2 as sintering aids[END_REF][START_REF] He | Study on microstructure and thermal conductivity of spark plasma sintering AlN ceramics[END_REF] Long sintering times will not only push up the cost of fabrication of these materials, but will also promote the growth of their grains and, subsequently, cause the degradation of their mechanical properties.

We hence used the SPS process, well-known for its ability to speed up the sintering kinetics and to achieve very high material density [START_REF] Xiong | Microstructural effects on the transmittance of translucent AlN ceramics by SPS[END_REF], to elaborate the AlN-based samples (material A and nanocomposite) needed for experimental investigations, and, in particular, to integrate the nanocomposite within the material A to fabricate the novel substrate.

Fabrication of fully densified AlN-based ceramics (material A)

In order for the novel substrate to fulfill the aforesaid technological functions concomitantly with its role of grading the electrical field, the material A must possess, besides a very low electrical conductivity, the highest possible thermal conductivity. This material must hence display a full densification, which is otherwise needed to limit the local activity of partial discharges within its microstructure pores at high voltage [START_REF] Auge | Partial discharges in ceramic substrates embedded in liquids and gels[END_REF], on the one hand, and to ensure good mechanical properties, on the other hand.

For these purposes, we added, prior to SPS processing, a fraction of 3 wt% Y 2 O 3 to the AlN powder, as this sintering additive was reported to react with the latter to form a liquid phase allowing to foster densification through liquid-phase sintering [START_REF] González | Development of AlN and TiB2 composites with Nb2O5, Y2O3 and ZrO2 as sintering aids[END_REF][START_REF] He | Study on microstructure and thermal conductivity of spark plasma sintering AlN ceramics[END_REF][START_REF] Xiong | Microstructural effects on the transmittance of translucent AlN ceramics by SPS[END_REF], and to reduce the oxide impurities in the AlN lattice that have proved probative for the thermal conduction. [START_REF] Qiao | Effect of Y2O3 on low temperature sintering and thermal conductivity of AlN ceramics[END_REF] The AlN + 3 wt% Y 2 O 3 mixture was prepared as per the procedure described in the methods' section (Powder mixture preparation), and treated thereafter in nitrogen atmosphere in the SPS apparatus (Dr. Sinter 2080 device from Sumitomo Coal Mining -Fuji Electronic Industrial, Saitama, Japan) under the conditions and following the procedure detailed in this section (SPS processing) as well.

Scanning electron microscopy (SEM) observations, performed on a fractured surface obtained by cleavage parallel to the applied pressing axis of the AlN + 3 wt% Y 2 O 3 pellet (Figure 3a), showed the typical microstructure features of AlN ceramics produced by SPS with sintering additives, i.e., the secondary phases (in bright contrast) are placed at the grain boundaries of the AlN matrix. Such microstructure is nearly fully densified (> 98%) with a very limited grain growth. It was achieved by the fact that the sintering occurred in the liquid phase formed following the reaction of Y 2 O 3 with the thin Al 2 O 3 layer originally present on the surface of the AlN grains. The secondary phase, in a liquid form, flowed into the grain boundaries before being solidified during cooling, thereby densifying the material. Its chemical composition was found to be close to that of YAlO 3 , which is in keeping with that reported elsewhere. [START_REF] Qiao | Effect of Y2O3 on low temperature sintering and thermal conductivity of AlN ceramics[END_REF] Nonetheless, it has to be noted here that adding a fraction of Y 2 O 3 as high as 3 wt% led to the formation of a relatively large amount of YAlO 3 which partly covers the AlN grains as can be clearly seen in the inset of Figure 3a. That would likely promote the diffusion of phonons at the YAlO 3 / AlN interfaces, and subsequently degrade the thermal conduction within the material.

To cope with such YAlO 3 excess, we decreased the Y 2 O 3 fraction to 1 wt% and added 2 wt% of CaF 2 , as the latter is reported to lead to the formation of compounds which evaporate during sintering [START_REF] He | Study on microstructure and thermal conductivity of spark plasma sintering AlN ceramics[END_REF], thus reducing the amount of secondary phases at the grain boundaries. The resulted AlN + 1 wt% Y 2 O 3 + 2 wt% CaF 2 mixture was homogenized by using the same procedure given in the methods' section, and consolidated then by SPS under analogous conditions. Figure 3b depicts the SEM micrograph of a fractured surface of the AlN + 1 wt% Y 2 O 3 + 2 wt% CaF 2 sample elaborated by SPS. It depicts a fully densified (>99%) and homogeneous microstructure containing a much lower amount of secondary phases sited at the junction lines and concentrated exactly at the triple points between the grains (Insert of Figure 3b). It emphasizes therefore the relevance of the selected experimental conditions as well as the choice of the sintering additives and the adjustment of their fraction. This is mainly ascribed to the formation of some secondary phases which evaporated during the sintering. Indeed, traces of evaporated compounds were observed on the spacers at the end of the SPS processing. The XRD patterns show the presence of an additional oxide, Ca 3 Al 2 O 6 , coexisting with YAlO 3 at the grain boundaries (Figure 3c). The production of the compounds AlF 3 , Ca 3 N 2 and Ca 11 N 8 has been reported [START_REF] He | Study on microstructure and thermal conductivity of spark plasma sintering AlN ceramics[END_REF]. Their decomposition temperature [START_REF] He | Study on microstructure and thermal conductivity of spark plasma sintering AlN ceramics[END_REF] is lower than the dwell one (1800°C) used here, thereby they readily evaporate during the sintering.

In the light of these results, the AlN + 1 wt% Y 2 O 3 + 2 wt% CaF 2 composition was selected as the material A for fabricating the novel substrate.

Fabrication of nanocomposites endowed with controlled properties

As already stated above, the material volume, that will be integrated in the material A to fabricate the novel substrate, comprises a nanocomposite endowed with controlled properties. Compared to the material A, it must then possess a higher electrical conductivity with a magnitude enabling grading the electrical field, concomitant with the closest possible thermal conductivity to prevent thermal stresses in the novel substrate.

Thus, we developed a nanocomposite by incorporating the graphene nanoplatelets (GNP) into the material A in an effort to capitalize on their combination of large specific surface area, two-dimensional high ratio aspect sheet geometry and very high charge carrier mobility [START_REF] Novoselov | Electric field effect in atomically thin carbon films[END_REF][START_REF] Bolotin | Ultrahigh electron mobility in suspended graphene[END_REF][START_REF] Singh | Graphene based materials: past, present and future[END_REF][START_REF] Balandin | Superior thermal conductivity of singlelayer graphene[END_REF]. The choice of GNP is also dictated by their outstanding mechanical properties [START_REF] Gómez-Navarro | Elastic properties of chemically derived single graphene sheets[END_REF][START_REF] Ovid | Mechanical properties of graphene[END_REF] that endow them with high resistance to irreversible damage during harsh SPS sintering at a temperature as high as 1800°C under loading required for fully densifying AlN-based materials. Such resistance distinguishes them from carbon nanotubes (NTC) that are reported to be reactive with oxides and nitridebased materials in similar environments, making it difficult for them to keep their structure upon SPS processing. [START_REF] Fan | Preparation and electrical properties of graphene nanosheet/Al2O3 composites[END_REF][START_REF] Kusunose | Production of a grain boundary phase as conducting pathway in insulating AlN ceramics[END_REF]

Production of graphene platelets (GNP)

With a view of exploiting such properties of GNP, we performed a simple and costeffective procedure to produce these nanoparticles by solution phase exfoliation of graphite (Average lateral particle size: 15 µm, Skyspring Nanomaterials, Inc. -USA) in isopropyl alcohol using ultrasonication. This solvent was selected for its evaporation temperature (82.6°C) that is much lower than that of (NMP) N-methyl-2-pyrrolidone (202°C) or (DMF) N-dimethylformamide (153°C) solvents regularly used to stabilize the dispersion of graphene sheets prepared by exfoliation of graphite. [START_REF] Coleman | Liquid-Phase Exfoliation of Nanotubes and Graphene[END_REF] Indeed, it will be easier to eliminate during the preparation of the nanocomposite powder.

Thus, a series of similar solution samples, prepared from 2.5 vol.% of graphite nanopowder in 20 ml of isopropyl alcohol, were separately sonicated following the procedure and under the conditions given in the methods' section (Exfoliation of graphite) for different times before being left to settle with the aim of evidencing the evolution of graphite exfoliation with sonication time under the selected conditions.

Figure 4a shows an image taken 15 h after the solution samples were sonicated for the effective times (pulse: on) of 0.5, 1, 2, 4, 6 and 9 h. The longer the sonication time, the larger the apparent volume (black part of the container) of the exfoliated graphite, suggesting the increase of GNP amount with sonication time.

The TEM characterization of the solution sonicated for 9 h evidenced a large number of two-dimensional and quasi-transparent flakes were hence observed (Figures 4b and4c) exhibiting lateral sizes in the 600-3500 nm range, which could be comparable to those reported for single-layer graphene flakes obtained by exfoliation of graphite in the NMP solvent [START_REF] Coleman | Liquid-Phase Exfoliation of Nanotubes and Graphene[END_REF] or in other liquids [START_REF] Paton | Scalable production of large quantities of defect-free few-layer graphene by shear exfoliation in liquids[END_REF][START_REF] Bepete | Surfactant-free single-layer graphene in water[END_REF]. In many cases, the graphene flakes depict straight edges and corners with angles well-suited for allowing the observation of the nanometric order of their thickness and even the very small number and presence of single-layer flakes. We also observed the existence of less transparent and thicker flakes as shown in Figure 4d, comprising a higher number of single-layers.

Elaboration of nanocomposites

Immediately upon 9 h -sonication of a new solution sample of 2.5 vol.% of graphite in 20 ml of isopropyl alcohol, the obtained solution was introduced with the AlN + 1%wt Y2O3 + 2%wt CaF2 powder into a glass flask that was then fixed in a rotary evaporator, and subjected to a rotation of 70 rpm for 2 h in view of homogenizing the resulting solution. It was then heated up to 70°C under vacuum while maintaining the flask rotation. The produced vapor was progressively pipped to a cooler system for condensation, thereby removing the solvent to obtain the nanocomposite powder AlN + 1%wt Y2O3 + 2%wt CaF2 + 2.5%vol GNP (material B). This mixture was annealed at 80°C for 15 h before being treated in SPS under the same aforementioned conditions.

Electrical and thermal properties

In Figure 5a-c, depicted are the frequency dependence of the dielectric properties measured for the material A at room temperature. For the sake of a comparison, commercial AlN ceramic (IMPAK company, France) was characterized as well. Note that the latter differs from the SPS-sintered AlN sample.

Compared to this commercial material, the impedance curve (|Z|) showed that the material A sintered by SPS (Figure 5a) exhibits a similar dielectric behavior governed by the capacitive effect over all the measuring frequency range. The material A, however, seems to display a better electrical response at low frequency as can be seen from the phase  and conductivity  curves (Figure 5 b-c) where its  and  were shifted to lower values. It exhibits a value of ~ 3 x 10 -14 S.cm -1 at 0.1 Hz.

In view of the two-dimensional character of the GNP particles, the electrical conductivity of the material B was otherwise monitored on bars cut from a SPS-sintered pellet in the directions parallel (σ∥) and perpendicular (σ ⟂ ) to the applied pressing axis (Inset of Figure 5d). Figure 5d depicts the frequency dependence of σ∥ and σ ⟂ for the material B. It reveals that, whatever the measuring direction, the addition of 2.5%vol GNP made σ insensitive to the frequency over all the measuring frequency range, resulting in electrical changing from the capacitive behavior (Figure 5c) to the resistive one (Figure 5d) and significantly increasing to larger values (σ ⟂ = 3.2 x 10 -2 S.cm -1 , σ∥ = 0.73 x 10 -2 S.cm -1 at 20°C at 0.1 Hz) as compared to the material A (Table 1). The GNP therefore induced an anisotropy within the material B yielding a ratio (σ ⟂ / σ∥) = 4.4, which can be derived from the fact that they were aligned, under the effect of uniaxial pressure during the SPS sintering, in the direction perpendicular to the pressing axis as can be revealed by the SEM observations (Figure 5e). Effectively, since GNP are typified by the superior σ in their in-planes over that of their out-planes, they induce σ ⟂ larger than σ∥ within the material B. Note that only stacks comprising a high number of GNP could be visible using SEM. The single graphene flacks, that are also incorporated in the AlN matrix, could not be observed, but they do contribute markedly to the electrical conduction within this material.

It is relevant to point out here that such anisotropy could be advantageously used to bestow the novel substrate with the role of grading the electrical field whilst keeping the traditional functions. For that purpose, the σ ⟂ electrical conductivity of the nanocomposite, that is probed here in the direction parallel to the upper surface of the substrate (Figure 2a)), must be lower than that value recorded in the material B in order to foster the electrical field grading as indicated by the simulation results. Moreover, the σ∥ conductivity (in the direction perpendicular to the surface of the substrate) should even be comparable to that of the material A so as to safeguard the function of the electrical isolation even along a depth as small as that of the thickness of the integrated nanocomposite.

To cope with this challenge, we elaborated, under similar conditions, a second nanocomposite comprising, this time, a lower fraction of GNP, i.e., AlN + 1%wt Y 2 O 3 + 2%wt CaF 2 + 1.25%vol GNP (material C). Unlike the material B, the material C was found to present distinct electrical behaviors flowing its both main directions (Figure 5f). Indeed, it exhibits capacitive and resistive behaviors in the directions parallel (σ∥) and perpendicular (σ ⟂ ) to the applied pressing axis, respectively, with a σ ⟂ = 2 x 10 -6 S.cm -1 at 20°C and σ∥ is comparable to that of the material A (Table 1).

The material C particularly reveals much more pronounced σ anisotropy with a striking (σ ⟂ / σ∥) ratio attaining 10 6 at low frequency, which is the highest value achieved hitherto for the AlN-based ceramics to our knowledge. These results reveal that the electrical conductivity σ ⟂ exceeds by far the percolation threshold (as in the case of the material B following its both main directions), whereas the σ∥ one appears to be still close to it. They otherwise suggest that, in the material C, the GNPs seem to be better aligned compared to the material B, which led to much lower σ∥ (Table 1). In other words, an important number of GNP contained in the material B, which could not be visible through SEM observations, were not well aligned perpendicular to the pressing axis during the SPS processing, and contribute then in the electrical conduction following the direction parallel to the latter as well, thereby enhancing σ∥ and, subsequently, yielding lower anisotropy ratio. This would ultimately indicate that the lower GNP fraction led to better GNP orientation in the nanocomposite during the SPS processing.

Figure 6 shows the thermal conductivity, κ, measured in the 50-400°C range for the materials A and B. In order to ascertain the effect of the selected sintering additives, the κ-curves obtained for AlN and AlN + 3%wt Y 2 O 3 SPS-sintered samples, processed under the same conditions compared to the materials A and B, were plotted as well.

Generally, κ decreases as the temperature is raised, and its magnitude evolution from one sample to another mainly depends on the secondary phases as all the elaborated materials were fully densified. Effectively, adding 3%wt Y 2 O 3 allowed to markedly increase κ because it diminishes the O 2 impurities primarily existing in AlN material through the formation of YAlO 3 as previously noted. But here, the YAlO 3 was produced in abundance and then partially covers the AlN grains (Figure 3a), which consequently promotes the phonon diffusion at the AlN/YAlO 3 interfaces. It results in diminishing the mean free path of the phonons which is proportional to the lattice component of κ that is dominant in the AlN material, thereby limiting κ. Such phonon diffusion was lowered for the material A by simultaneously decreasing the Y 2 O 3 fraction and adding CaF 2 . Indeed, that brings a significant reduction in the number of AlN/secondary phases through the formation of evaporable secondary phases during the sintering (Figure 3b), hence rising κ in the material A. Note that κ improvement is achieved by concomitantly controlling the O 2 impurities and the interfaces AlN/secondary phases in the material A.

Otherwise, incorporating GNP in the material A led to a decrease in κ (in the material B), which can be obviously ascribed to the phonon diffusion at the AlN/GNP interfaces.

However, the κ magnitude could be kept larger when diminishing the GNP fraction.

Fabrication process of substrates grading the electrical field

Finally, we developed a practical process enabling three-dimensionally integrating the elaborated nanocomposite within the material A in effort to realize the novel substrate (Figure 1). This process includes simple fabrication steps (Figure 7a) which are carried out as flows: the powder (material A) was first loaded into a 20 mm -diameter graphite die (1), and a 20 mm -diameter steel punch, endowed with a cylindrical imprint (14 mm in diameter and 600 µm in height) at only one end, was then introduced in the die (2). This arrangement was then uniaxially cold-pressed (3) with the aim of compacting the powder A and introducing an imprint cavity (14 mm in diameter and 600 µm in depth) into the resulting preform A.

Note that the dimensions of imprint of the steel punch were determined on the basis of the shrinking measurements assessed separately for materials A and B upon SPS sintering. The aim here is to obtain a substrate integrating a cylindrical volume containing the nanocomposite with a depth value the closest possible to that used in the numerical assessment of the concept, i.e., 150 µm (Figure 2b).

Secondly, the steel piston was removed leaving in the die only the preform A, wherein the cylindrical cavity was imprinted (4). The nanocomposite powder was then poured on the preform A so as to fill the cavity and, even, cover the entire surface of this preform A (5).

Finally, the die was closed by a second graphite punch [START_REF] Ménager | Conditionnement des modules de puissance[END_REF] and uniaxially cold-pressed [START_REF] Horio | Packaging technologies for SiC power modules[END_REF] before being treated in SPS under the same abovementioned conditions [START_REF] Buttay | State of the art of high temperature power electronics[END_REF]. Here, it is worth noting that the SPS treatment allows to concomitantly sinter both preforms (A and nanocomposite) and joining them to each other to fabricate the novel substrate.

Figure 7 presents the obtained substrate after being polished to remove the graphite foil used during SPS sintering. Its rear and upper sides comprising material A (bright) and nanocomposite (dark) are depicted in Figure 7b andc, respectively. It was then progressively polished on its upper side (nanocomposite) so as to remove the material excess and to keep the nanocomposite material only into the imprint cavity in order to ultimately achieve the novel substrate (Figure 7d). Optical microscopy observations indicated an excellent bonding between the materials A and nanocomposite with the absence of cracks at the interfaces between them, which reflects very low thermomechanical stresses at these interfaces, on the one hand, and emphases the relevance of the SPS cycle selected for consolidating both material A and nanocomposite, and establishing reliable three-dimensional interfaces between them, on the other hand.

Upon SPS processing, another novel substrate underwent this time a progressive polishing on its sidewall till the introduction of a cross-section exhibiting the thicknesses of both material layers (material A and nanocomposite) as shown in Figures 7e and7f. The observation of such cross-section allowed hence to assess the depth of the nanocomposite into the material A which was found to be about 148.9 µm (Figure 7g). That indicates a significant material shrinkage after sintering (about 450 µm) and, in particular, points out an excellent agreement with the dimensioned depth value used in the simulation assessment (150 µm), thereby testifying to the relevance of the approach taken here.

Performances of the developed substrates

In order to perform breakdown tests on the developed substrate, enabling an experimental assessment of its dielectric strength, concentric 150 nm thickgolden electrodes were first deposited on its both faces by using cathodic sputtering. In Figure 8a, a 10 mm -diameter electrode laid on the upper side of the substrate containing the integrated nanocomposite is shown, while Figure 8b depicts an 18 mm -electrode layer that was deposited on its lower side.

Secondly, a pair of magnetic rods was used as a mean for electrically connecting the deposited electrodes. To do this, an end of each rod was brought into contact with the metalized substrate at the center of its sides, so that both rods magnetically maintain it between them. The obtained assembly was thereafter encapsulated under vacuum using transparent epoxy resin (Buheler, Epothin 2). Upon resin reticulation, the cylindrical resin block was cut so as to allow access to the second end of each magnetic rods (Figure 8c) in order to electrically connect the achieved encapsulated substrate prototype during the breakdown testing.

It is noteworthy that we realized two batches of seven similar prototype samples each from the developed substrates with the integrated materials B and C (Table 2) including fractions of 2.5 and 1.25 vol% GNP, respectively, which emphases here the very high degree of reproductivity of novel substrates using our approach.

To ease comparison, a third batch of seven prototype samples was prepared as well, but, this time, from traditional substrates made of only the material A (Table 2), i.e., without the integrated nanocomposite.

Finally, all prototype samples of the three batches were separately subjected to breakdown testing. The sample was connected and immersed in an insulating liquid (Galden HT55) within a cell designed for such testing at room temperature. A sinusoidal voltage (at 50 Hz), provided by a high voltage power supply (France Transfo, V max = 100 kV), was then applied and ramped up at 1.5 kV / s. The detection of the breakdown voltage V B value is performed once the electric current circulating in the circuit increases up to 5 mA with a current switching-off time of about 20 ms. The experimental breakdown data were thereafter processed using Weibull statistical distribution. Figure 8d depicts Weibull plots giving the evolution of the cumulative probability P c of the breakdown as a function of V B for the three sample batches. They reveal that the prototype samples comprising the novel substrates (batches 2 and 3) present larger average (V B (Average) ) and scale parameter (α for P c = 63.2%) values in comparison with the ones (batch 1) corresponding to the traditional substrate (Table 2), which reflects that the electrical constrain was mitigated at the triple point as a result of the larger σ ⟂ within the integrated zones comprising the materials B and C.

Compared to the material B, the material C seems to bring a larger dielectric strength for the insulating packaging as indicated by its higher α value. It already makes V B larger by 15% than that provided by the traditional substrate, and further V B improvement could be attainable for lower σ ⟂ by optimizing the GNP fraction within the nanocomposite. Note that the batch 2 seems to present a dispersion of V B values lower than that for both other batches as indicated by its much higher shape parameter β.

More importantly, the location of the area degraded in the traditional substrate under the breakdown effect differs from that in the novel one. Effectively, a black mark was observed at the edge of the upper electrode of the traditional substrate as indicated on Figure 8e, while a radial black mark going from the outer edge of the integrated nanocomposite (materials B or C) to the edge of the metallization was visible on the novel substrate (Figure 8f) where such impact appeared to be surrounded by bright area as a consequence of a local resin delamination. These observations evidence that the breakdown came about for the traditional substrate under the effect of a heightened electric field at the triple point, whereas it occurred in the case of the novel substrates at the periphery of the integrated zone and created then an electrical current path joining the electrode through the nanocomposite. It suggests otherwise that the breakdown channel was shifted from the border of the upper electrode (traditional substrate) to that of the integrated nanocomposite (novel substrate) before crossing the substrate towards the lower electrode as schematized in Figure 8g. Such shifting of the electrical field pick resulted in improving the breakdown voltage V B in the prototype comprising the novel substrates, in agreement with the simulation results that furthermore revealed the potential of the latter to achieve much higher V B , which hence supports the merits of the concept proposed here.

Conclusions

To summarize, we demonstrate here a new way towards improving the breakdown voltage V B of the insulating system of power modules by developing a novel concept of the substrate based on locally amending the properties of the traditional ceramic one.

The novel substrate was fabricated by integrating, right underneath the metallization, a nanocomposite within AlN-based ceramic (material A) employing an effective process. This process, that comprises simple steps, enabled elaborating both the material A and the nanocomposite, concomitantly with joining them to each other to realize the novel substrate, thereby making significant time and energy savings. The material A displayed very low  and high . The nanocomposite, comprising the added GNP, was revealed to possess a controllable electrical anisotropy. For 1.25%vol GNP, it indeed showed an anisotropic electrical behavior typified by capacitive and resistive effects in the directions perpendicular and parallel to the applied pressing axis, respectively, resulting in a higher σ ⟂ compared with the conductivity of the material A, and σ∥ that is nearly similar to the latter. This behavior is likely suitable for the electric field grading concomitantly with the electrical isolation function performed by the substrate. At such GNP fraction, the nanocomposite displayed a marked anisotropy, with (σ ⟂ / σ∥) = 10 6 (for 1.25 % vol GNP) which is the highest anisotropy ratio obtained so far for the AlNbased ceramics to our knowledge.

The novel substrate presented a full densification and an excellent bonding between the materials A and nanocomposite with the absence of cracks at the interfaces between them, which testifies for the relevance of this process to achieve reliable substrates.

Electrically, it enabled shifting the breakdown channel from the border of the upper electrode (traditional substrate) to that of the integrated nanocomposite (novel substrate) before crossing the substrate towards the lower electrode, thereby leading to a larger breakdown voltage V B of the novel substrate as compared to the traditional substrate. This result corroborates the numerical simulations which otherwise revealed the potential of such novel substrate in attaining further improvement in V B and, subsequently, withstanding higher voltages, that could be attainable by optimizing σ ⟂ through the adjustment of the GNP fraction.

We believe that the approach taken here paves the way to manufacturing multifunctional composite substrates sought not only for high power modules but also for many other potential applications.

Table 1. The chemical composition of the materials A and the nanocomposites (materials B and C), and their electrical conductivity σ obtained at 20°C. For the materials B and C, given are the σ values recorded in the directions parallel (σ∥) and perpendicular (σ⟂) to their applied pressing axis, and their respective anisotropy (σ⟂ / σ∥) ratio. Table 2. The average breakdown voltage (V B (Average) ), and the scale (α (Pc = 63.2%) ) and shape (β) parameters obtained for the three batches subjected to the breakdown testing.

For each batch, provided are the number of the prototype samples, the corresponding substrate and the constituent materials of the latter.

Figure 1 .Figure 2 .

 12 Figure 1. Schematic illustrating a typical representation of the traditional power module.Triple points, localized at the junction between the ceramic substrate, the metallic track borders and the encapsulating polymer, are highlighted.

Figure 3 .

 3 Figure 3. SEM micrograph of fractured surface parallel to the applied axis of the (a) AlN + 3 wt% Y 2 O 3 and (b) AlN + 1 wt% Y 2 O 3 + 2 wt % CaF 2 ceramic samples processed by SPS in N 2 atmosphere at 1800°C under 50 MPa for 10 min. (c) X diffractogram recorded for the AlN + 1 wt% Y 2 O 3 + 2 wt % CaF 2 sample (material A) indicating the formation of the oxides Ca 3 Al 2 O 6 and YAlO 3 during the SPS sintering.

Figure 4 .

 4 Figure 4. (a) Similar solution samples, containing 2.5 vol.% of graphite nanopowder in 20 ml of isopropyl alcohol, separately sonicated for different effective times (0.5, 1, 2, 4, 6 and 9 h) before being left to settle for 15 h. The apparent volume (black part of the container) of the exfoliated graphite increases with the sonication time, highlighting the increase of GNP amount. (b-d) TEM micrographs of graphene flakes deposited over the TEM grid immediately after the end of the sonication of a similar solution for 9 h. They present (b and c) two-dimensional and quasi-transparent flakes revealing nanometric thicknesses and lateral sizes in the 600-2500 nm range, and (d) less transparent and thicker flakes comprising a higher number of single-layers.

Figure 5 .

 5 Figure 5. The frequency dependence of (a) the impedance |Z|, (b) the phase angle  and (c) the electrical conductivity  measured for the material A at room temperature. The frequency dependence of the electrical conductivity monitored in the directions parallel (σ∥) and perpendicular (σ⟂) to the applied pressing axis for the nanocomposites: (d) material B and (f) material C. (e) SEM micrograph of a fractured surface, obtained by cleavage parallel to the applied pressing axis of the material B, evidencing a stack of GNP aligned perpendicular to this axis.

Figure 6 .

 6 Figure 6. Temperature dependence of the thermal conductivity κ measured in the 50-400°C range for the materials A and B. To ease a comparison, the κ-curves obtained for AlN and AlN + 3%wt Y 2 O 3 samples are plotted as well.

Figure 7 .Figure 8 .

 78 Figure 7. (a) Schematic illustrating the main steps enabling the tree-dimensional integration of the nanocomposite within the material A. (1) -(4) Formation of the preform A with an imprinted cylindrical cavity having 14 mm in diameter and 600 µm in depth. (5) -(7) Formation of the nanocomposite that fills the cavity and covers the surface of the material A. (8) SPS sintering of both compacted materials A and nanocomposite in N 2 atmosphere at 1800°C under 50 MPa for 10 min. (b and c) The respective bottom (material A) and top (nanocomposite) of the novel substrate upon the SPS processing. (d) The obtained novel substrate after removing the nanocomposite surplus covering the surface of the material A. (e and f) A cross section introduced by polishing on another novel substrate. This cross section served to investigate the interface material A / nanocomposite and to assess the dept of the nanocomposite volume into the material A. (g) Optical micrograph of such corner of such cross section allowing to experimentally measure this depth.

Acknowledgment: This work was supported by the French National Research Agency (Agence Nationale de la Recherche -ANR) through the grants ANR-16-ASTR-0009 (FILCERA Project). The authors acknowledge the French Directorate General of Armaments -DGA for funding this work and supporting it in the frame of ANR ASTRID program. They also thank Prof. Jacques NOUDEM from Normandy university for the thermal conductivity measurements, Dr. Jean Jacques DEMAI for his help in TEM observations, and Dr. Moussa GOMINA for the insightful discussions on the elaboration of ceramics.


Baptiste Cottier

DIENS David Pointcheval

Security Analysis of Improved EDHOC Protocol

Keywords:

Ephemeral Diffie-Hellman Over COSE (EDHOC) aims at being a very compact and lightweight authenticated Diffie-Hellman key exchange with ephemeral keys. It is expected to provide mutual authentication, forward secrecy, and identity protection, with a 128-bit security level.

A formal analysis has already been proposed at SECRYPT '21, on a former version, leading to some improvements, in the ongoing evaluation process by IETF. Unfortunately, while formal analysis can detect some vulnerabilities in the protocol, it cannot evaluate the actual security level. In this paper, we study the protocol as it appeared in version 15. Without complete breaks, we anyway exhibit attacks in 2 64 operations, which contradict the expected 128-bit security level. We thereafter propose improvements, some of them being at no additional cost, to achieve 128-bit security for all the security properties (i.e. key privacy, mutual

Introduction

A key agreement is under analysis by IETF [SMP22], under the name Ephemeral Diffie-Hellman Over COSE (EDHOC). EDHOC aims at being a very compact and lightweight authenticated Diffie-Hellman key exchange with ephemeral keys. It is expected to provide mutual authentication, forward secrecy, and identity protection, with a 128-bit security level.

This protocol is deeply inspired from SIGMA [Kra03] and OPTLS [KW16] and targets constrained devices over low-power IoT radio communication technologies. For this reason, very aggressive parameters are proposed to minimize the communications. This paper follows a request from the LAKE working group to study the computational security of the EDHOC protocol with such agressive parameters.

Related Work

A formal analysis of the May 2018 version has already been proposed by Bruni et al. in [BSJGPS18] and later completed and updated by [NSB21,CJKK22,JKKR23], leading to some improvements. But such a formal analysis, when successful, does not give any insight about the actual security level, in terms of time complexity of the best possible attack. While our computational analysis covers the MACbased authentication method, other ongoing works cover other authentication methods based on signatures.

Contributions

In this paper, we analyse the August 2022 version of EDHOC proposal [SMP22]. We are able to prove the three expected security properties in the random oracle model, under a Diffie-Hellman assumption and with secure encryption primitives. However, because of the aggressive settings, we exhibit attacks in 2 64 operations, against authentication, which is not acceptable for a 128-bit security level.

We thereafter propose some improvements to get better security, at no communication cost. Firstly, adding more inputs to some hash value allows to speedup the simulator when searching in some tables. Secondly, one converts an authenticated encryption scheme into a simple one-time secure encryption scheme, for hiding the identity of the Initiator, and sends a larger tag together with the External Authorization Data, in plaintext. We convert an authenticated ciphertext into a smaller ciphertext encrypting only a part of the message, and the remaining of the message is sent as plain values rather than encrypted, but with better authentication. This conversion globally has no communication impact, but increases from 64 to 128-bit security level for initiator-authentication. Last, we confirm that a fourth message provides a 128-bit security level for responderauthentication.

Preliminaries

Computational Assumptions

For security analysis in the computational setting, we rely on some computational assumptions: the Gap Diffie-Hellman problem and some properties of symmetric encryption.

Gap Diffie-Hellman (GDH). The Gap Diffie-Hellman problem aims to solve a Diffie-Hellman instance (U = g u , V = g v ), in a group G with generator g, where u, v $ ← Z p , by computing g uv , with access to a Decisional Diffie-Hellman oracle DDH returning 1 if a tuple-query (g a , g b , g c ) is a Diffie-Hellman tuple, and 0 otherwise. We define the advantage Adv gdh G (t, q ddh ), as the maximum advantage over all algorithms A in outputting g uv , with time-complexity at most t and making at most q ddh queries to the DDH oracle.

One-Time Pad Encryption. We will use several symmetric encryption schemes, such as the one-time pad: given a random key sk ∈ {0, 1} k , the encryption of the message m ∈ {0,

1} k is c = E(sk, m) ← m ⊕ sk, while the decryption just consists in m = D(sk, c) ← c ⊕ sk. It satisfies the injective property: ∀sk, m 0 , m 1 ∈ {0, 1} k , E(sk, m 0 ) = E(sk, m 1 ) =⇒ m 0 = m 1 .
It also guarantees perfect privacy: for a random secret key sk, c does not leak any information about the plaintext. We stress this is of course for a one-time use only, as there is no additional oracle access.

Authenticated Encryption with Associated Data (AEAD). We will also use an Authenticated Encryption with Associated Data scheme Π ′ = (E ′ , D ′ ), with a key sk and initialisation vector IV. For a message m ∈ M and some associated data a ∈ A, the ciphertext is c = E ′ (sk, IV; m; a)1 , while the decryption process provides m = D ′ (sk, IV; c; a) in case of valid ciphertext c with respect to sk, IV, and a, or ⊥ otherwise. Two security properties are expected from such an AEAD.

Indistinguishability. (A) over all A with time-complexity at most t. We stress that c only aims at protecting the messageprivacy, but does not provide any security for the associated data. Thanks to multiple queries, we are in the chosen-plaintext setting, and not a one-time security as before.

Π ′ = (E ′ , D ′ )
Authentication. An AEAD scheme is also expected to guarantee some unforgeability property (UF-CMA, for Unforgeability under Chosen-Message Attacks), also for the associated data (not encrypted). More precisely, we consider the Experiment Exp uf-cma Π ′ (A) in which A is given access to the encryption oracle E ′ (sk, •; •; •), for a random secret key sk. The Experiment returns 1 if A outputs some data a, an initialisation vector IV and a ciphertext c accepted with respect to IV and a, which means that D ′ (sk, IV; c; a) ̸ = ⊥, while c has not been obtained as the output of an encryption query to E ′ (sk, •; •; •). We define the advantage of A in violating UF-CMA security of Π ′ as Adv uf-cma

Π ′ (A) = Pr[Exp uf-cma Π ′ (A) = 1]
and the advantage function Adv uf-cma Π ′ (t) as the maximum value of Adv uf-cma Π ′ (A) over all A with time-complexity at most t.

Brief Description of EDHOC

As with any key exchange protocol, EDHOC aims to provide a common session key to two parties. We briefly sketch the key elements of the EDHOC protocol. Due to the page limitations, we refer the reader to [SMP22] for a detailed description. EDHOC protocol can be instantiated with several settings:

-Authentication Method : Each party (Initiator and Responder) can use an authentication method: either with a signature scheme (SIG), or with a static Diffie-Hellman key (STAT). -Cipher Suites: Ordered set of protocol security settings. Initial paper offers many possible suites, but we focus on the most aggressive cipher suites set- ting the MAC length to 8 bytes, while still using SHA-256 as a hash function, with 256-bit outputs.

-Connection Identifiers: Data that may be used to correlate between messages and facilitate retrieval of protocol state in EDHOC and application. -Credentials and Identifiers: They are used to identify and optionally transport the authentication keys of the Initiator and the Responder.

We suppose both the Initiator and the Responder are aware that the authentication method is STAT/STAT. Also, we ignore the Cipher Suite ID Suites_I (as it appears in [SMP22]) in the first message of the protocol.

Extract and Expand. In the EDHOC Key-Schedule, recalled in Figure 1 (ignoring the vertically hatched patterns for the initial protocol), the pseudorandom keys (PRK) are derived using an extraction function. In our context, Extract(salt, IKM) = HKDF-Extract(salt, IKM) is defined with SHA-256, where IKM holds for Input Keying Material (in our context, this will be some Diffie-Hellman keys) and Expand(PRK, info, len) = HKDF-Expand(PRK, info, len) where info contains the transcript hash (TH 2 , TH 3 or TH 4 ), the name of the derived key and some context, while len denotes the output length. Transcript hashes, denoted TH i , are used as input to the HKDF-Expand function. More precisely, with SHA-256 as H, we have:

TH 2 = H(Y e , C R , H(m 1 )) TH 3 = H(TH 2 , m 2 ) TH 4 = H(TH 3 , m 3 [, m ′ 3 ])
where m 1 is the first message sent by the Initiator, m 2 and m 3 (possibly concatenated to m ′ 3 in our improvement, to preserve the authentication property) respectively are the plaintexts respectively encrypted in the message 2 and message 3. More notations are provided in Figure 2.

Protocol. The detailed description of the initial protocol is given in Fig 3, ignoring the gray highlights which will be for our improvements. The final session key is SK = PRK out .

Our Improvements

We here make some remarks on the initial protocol, with some improvements, that appear in gray highlights in Figure 3, and to the removed/additional hatched patterns in Figure 1.

On Mutual Authentication

The encryption key sk 3 , used by the initiator to encrypt its second message m 3 , is computed by calling HKDF-Expand on PRK 3e2m . However, even an adversary that plays in the name of a non-corrupted user, is able to compute PRK 3e2m , when knowing the Initiator ephemeral key x e , as PRK 3e2m does not depend on x s , the long term secret key of the Initiator. In order to break the Initiator authentication, with respect to a Responder, an adversary can play on behalf of any user as an Initiator. It will be able to compute sk 3 , but not t 3 , for which value it will need some luck, but this is only 64-bit long! Which is not enough for a 128-bit security.

Initiator Responder xs, Xs = g xs ys, Ys = g ys InitRun1(IDI) xe $ ← Zp, Xe ← g xe ; CI $ ← {0, 1} ℓC m1 ← (Xe∥CI∥EAD1) m1 RespRun1(IDR, ys, m1) Parse m1 as (Xe∥c∥EAD1) ye $ ← Zp, Ye ← g ye ; CR $ ← {0, 1} ℓC sid ← (CI, CR, Xe, Ye) PRK2e ← HKDF-Extract( "" | TH2 , Xe ye ) TH2 ← H(Ye, CR, H(m1)) sk2 ← HKDF-Expand(PRK2e, 0, TH2, ℓ2) salt3e2m ← HKDF-Expand(PRK2e, 1, TH2, ℓhash) PRK3e2m ← HKDF-Extract(salt3e2m, Xe ys ) CTX2 ← (IDR∥TH2∥Ys∥EAD2) t2 ← HKDF-Expand(PRK3e2m, 2, CTX2, ℓmac) InitRun2(IDI, xs, Ys, (Ye, c2, CR)) Ye, c2, CR m2 ← (IDR∥t2∥EAD2); c2 ← E(sk2, m2) PRK2e ← HKDF-Extract( "" | TH2 , Ye xe ) TH2 ← H(Ye, CR, H(m1)) sk2 ← HKDF-Expand(PRK2e, 0, TH2, ℓ2) Set m2 ← D(sk2, c2); parse as (IDR∥t2∥EAD2) CTX2 ← (IDR∥TH2∥Ys∥EAD2) salt3e2m ← HKDF-Expand(PRK2e, 1, TH2, ℓhash) PRK3e2m ← HKDF-Extract(salt3e2m, Ys xe ) t ′ 2 ← HKDF-Expand(PRK3e2m, 2, CTX2, ℓmac) if t ′ 2 ̸ = t2 : return ⊥ TH3 ← H(TH2, m2) sk3 ← HKDF-Expand(PRK3e2m, 3, TH3, ℓkey | ℓid ) IV3 ← HKDF-Expand(PRK3e2m, 4, TH3, ℓiv) | ∅ salt4e3m ← HKDF-Expand(PRK3e2m, 5, TH3, ℓhash) PRK4e3m ← HKDF-Extract(salt4e3m, Ye xs ) accepted ← 1 CTX3 ← (IDI∥TH3∥Xs∥EAD3) t3 ← HKDF-Expand(PRK4e3m, 6, CTX3, ℓmac | κsec ) m3 ← (IDI ∥t3∥EAD3) | IDI , m ′ 3 ← (t3∥EAD3) c3 ← E ′ (sk3, IV3; m3; "") | E(sk3, m3) c3, m ′ 3 RespRun2(ID, st, peerpk, c3) TH3 ← H(TH2, m2) sk3 ← HKDF-Expand(PRK3e2m, 3, TH3, ℓkey | ℓid ) IV3 ← HKDF-Expand(PRK3e2m, 4, TH3, ℓiv) | ∅ m3 ← D ′ (sk3, IV3; c3; "") | D(sk3, c3) parse m3 as (IDI ∥t3∥EAD3) | IDI and m ′ 3 as (t3∥EAD3) Xs ← peerpk[IDI] salt4e3m ← HKDF-Expand(PRK3e2m, 5, TH3, ℓhash) PRK4e3m ← HKDF-Extract(salt4e3m, Xs ye ) accepted ← 1 CTX3 ← (IDI∥TH3∥Xs∥EAD3) t ′ 3 ← HKDF-Expand(PRK4e3m, 6, CTX3, ℓmac | κsec ) if t ′ 3 ̸ = t3 : return ⊥ TH4 ← H(TH3, m3, m ′ 3 ) sk4 ← HKDF-Expand(PRK4e3m, 8, TH4, ℓkey) IV4 ← HKDF-Expand(PRK4e3m, 9, TH4, ℓiv) m4 ← "", m ′ 4 ← EAD4 TH4 ← H(TH3, m3, m ′ 3 ) c4, m ′ 4 c4 ← E ′ (sk4, IV4; m4; m ′ 4 ) sk4 ← HKDF-Expand(PRK4e3m, 8, TH4, ℓkey) IV4 ← HKDF-Expand(PRK4e3m, 9, TH4, ℓiv) if D ′ (sk4, IV4; c4; m ′ 4 ) = ⊥ : return ⊥ PRKout ← HKDF-Expand(PRK4e3m, 7, TH4, ℓhash) PRKout ← HKDF-Expand(PRK4e3m, 7, TH4, ℓhash) terminated ← 1 terminated ← 1 SK ← PRKout SK ← PRKout
To get around this issue, we suggest to modify the construction of Initiator's second message as follows:

Initial message m 3 = (ID I ∥t 3 ||EAD 3 ) is split as m 3 ← (ID I ) and m ′ 3 ← (t 3 ||EAD 3 ) 2 .
Thus, m 3 is encrypted using sk 3 (with a one-time pad encryption scheme Π = (E, D), under sk 3 still depending on PRK 3e2m ) into c 3 . Then m ′ 3 does not need to be encrypted. We introduce the value κ sec , always set as the expected bit-security parameter, independently of the ℓ mac value. Then, we set the length of t 3 to be κ sec , as it already authenticates CTX 3 = (ID I ∥TH 3 ∥X s ∥EAD 3 ). Concretely, the second message sent by the initiator to the responder is:

c 3 ∥m ′ 3 , where c 3 = E(sk 3 , m 3 ), m ′ 3 = t 3 ||EAD 3 . Once the Responder receives (c 3 , m ′
3 ), he first decrypts c 3 , retrieves X s using m 3 , computes PRK 4e3m and is then able to verify the tag t 3 , allowing to check the authenticity of ID I , as well as all the other values is CTX 3 = ID I ∥TH 3 ∥X s ∥EAD 3 . The extra required length for the tag t 3 is perfectly compensated by the absence of the tag jointly sent when using Authenticated Encryption, and the plaintext length of m 3 is the same as the encryption of m 3 . Therefore, this does not impact the communication cost of the protocol, until κ sec ≤ 2 × ℓ mac , but improves to κ sec -bit security for Initiator-Authentication.

About the Responder-Authentication, t 2 also provides a 64-bit security level only: by guessing it, any active adversary can make the initiator terminate, and thus breaking the responder-authentication, if one does not wait for the fourth flow c 4 , m ′ 4 . However, with this fourth flow, we can show the 2 × ℓ mac -bit security level is achieved.

On Reduction Efficiency

After analysis, we also notice another improvement: the key PRK 2e is computed according to g xeye only, as the salt used in HKDF-Extract is an empty string. When considering several parellels sessions, this allows an adversary to find a collision with any of the session making a single call to HKDF-Extract. Therefore, we replace the empty string used as salt with TH 2 that depends on the session variables and is different for each session. Thus, an adversary has to make a call to HKDF-Extract with a chosen TH 2 , linked to a specific session. This makes the reduction cost of the key-privacy game independent of the number of sessions.

Security Analysis

Security Goals. The security goals of an authenticated key exchange protocol are:

-Key Privacy: Equivalent to Implicit Authentication. At most both participants know the final session key, which should remain indistinguishable from random to outsiders. With additional Perfect Forward Secrecy, by compromising the long-term credential of either peer, an attacker shall not be able to distinguish past session keys from random keys. In our context, this will rely on a Diffie-Hellman assumption. -Mutual Authentication: Equivalent to explicit authentication. Exactly both participants have the material to compute the final session key. -Identity Protection: At most both participants know the identity of the Initiator and the Responder. While the identity of the Initiator should be protected against active adversaries, the identity of the Responder should be protected against passive adversaries only.

Random Oracle Model. For the security analysis, we model Hash and Key Derivation Functions as random oracles. Respectively, the random oracles RO T and RO P will model HKDF-Extract and HKDF-Expand functions as perfect random functions.

Key Privacy

We describe in Figure 4 the security game introduced in [DG20] following the framework by Bellare et al.

[BR06]. After initializing the game, the adversary A is given multiple access to the following queries:

-NewUser: Generates a new user by generating a new pair of keys.

-Send: Controls activation and message processing of sessions -SessionKeyReveal: Reveals the session key of a terminated session.

-LongTermKeyReveal: Corrupts a user and reveals its long term secret key.

-Test: Provides a real-or-random challenge on the session key of the queried session.

Then, the adversary makes a single call to the Finalize algorithm, which returns the result of the predicate [b ′ = b], where b ′ is the guess of A and b is the challenge bit, after succeeding through the Sound and Fresh predicates. The advantage of an adversary A against the key privacy is its bias in guessing b, from the random choice: Adv kp-ake (A) = Pr[b ′ = b] -1/2. For the reader's convenience, we give a formalized description of the EDHOC protocol in Figure 6, in the Appendix. It is compliant with the security game made in Figure 4. The protocol is analyzed in the random oracle model, therefore, HKDF can be substituted by respective random oracles.

Theorem 1. The above EDHOC protocol satisfies the key privacy property under the Gap Diffie-Hellman problem in the Random Oracle model. More precisely, with q RO representing the global number of queries to the random oracles, N the number of users, and ℓ hash the hash digest length, Adv kp-ake EDHOC (t; q RO , N ) is upper-bounded by

(2N + 1) • Adv GDH G (t, q RO ) + q RO 2 + 4
vealed. We say a party/session is non-corrupted if no query to LongTermKeyReveal has been made before the time of acceptance t acc , where we consider each block (InitRun1, InitRun2, RespRun1, RespRun2) as atomic. Then corruptions can only happen between two calls to simulated players. Game G 1 . In this game, we simulate the random oracles by lists that are empty at the beginning of the game. As RO T and H always return a digest of size ℓ hash , we simply use the simulation oracle SO T and SO H respectively. However, RO P may return values of several lengths. We thus define a simulation oracle by digest size: SO size P , for size in {ℓ 2 , ℓ id , ℓ hash , ℓ key , ℓ iv , ℓ mac , κ sec } The simulation oracles SO P and SO H work as the usual way of simulating the answer with a new random answer for any new query, and the same answer if the same query is asked again. For the simulation oracles SO T , the oracle consists in a list that contains elements of the form (str, Z, (X, Y ); λ), where when first set, either Z or (X, Y ) is non-empty. Indeed, when making a call to a random oracle, the official query is of the form (str, Z), where str is any bit string, that can be empty or a pseudo-random key, and Z is a Diffie-Hellman value. Then, the simulator checks in the list for an entry matching with (str, Z, * ; λ). If such an element is found, one outputs λ, otherwise one randomly set λ $ ← {0, 1} κ and append (str, Z, ⊥; λ) to the list. But later, the simulator will also ask queries of the form (str, (X, Y )), where (X, Y ) is a pair of group elements. Then one checks in the list for an entry matching with either (str, * , (X, Y ); λ) or (str, Z, * ; λ) such that DDH(g, X, Y, Z) = 1. If such an element is found, one outputs λ, otherwise one randomly set λ $ ← {0, 1} κ and append (str, ⊥, (X, Y ); λ) to the list. When such new kinds of elements exist in the list, for the first kind of queries (str, Z), one checks in the list for an entry matching with either (str, Z, * ; λ) as before, or (str, * , (X, Y ); λ) such that DDH(g, X, Y, Z) = 1. Thanks to the DDH oracle, this simulation is perfect, and is thus indistinguishable to the adversary:

Pr[Succ 1 ] = Pr[Succ 0 ]. Game G 2 .
In order to prevent collisions in the future PRK generation, we modify the simulation oracles SO T , SO ℓ hash P and SO H , such that if a collision occurs, the simulator stops. From the birthday paradox bound, we have:

Pr[Succ 2 ] -Pr[Succ 1 ] ≤ q SO T 2 + q SO ℓ hash P 2 + q SO H 2 2 ℓ hash +1 .
Game G 3 . One can note that thanks to the above simulation of the random oracles, the simulator does not need anymore to compute Diffie-Hellman values. Then, for every simulated player, the simulator generates X e or Y e at random in the group, and the simulation is still performed as in the previous game. As corruption queries only reveal long-term secret, still known to the simulator, the view of the adversary is perfectly indistinguishable of the previous game and we have: and salt 3e2m are different from the values obtained by a possibly simulated responder, thanks to the absence of collisions as they are respectively computed using SO H and SO ℓ hash P . Otherwise, sk 2 is not modified. So if the ciphertext c 2 is forged, thanks to the injective property of the one-time pad encryption scheme (E, D) when the key is fixed, m 2 , then TH 3 and salt 4e3m are different from the values obtained by a possibly simulated responder. In order to detect the inconsistency of PRK 3e2m with respect to the public oracle answer, the adversary must have asked SO T on the correct Diffie-Hellman value X e ys . We denote the event F 1 , that query X e ys is asked whereas y s is the long-term secret key of a non-corrupted user and X e has been generated by the simulator. If this event happens (which can easily be checked as the simulator knows y s ), one stops the simulation:

Pr[Succ 3 ] = Pr[Succ 2 ]. Game G 4 . In
| Pr[Succ 4 ] -Pr[Succ 3 ]| ≤ Pr[F 1 ].
Game G 4 ′ . We now provide an upper-bound on Pr[F 1 ]: given a GDH challenge (X = g x , Y = g y ), one simulates all the X e as X e = X • g r , for random r $ ← Z p , but chooses one user to set Y s = Y . Even if y s is therefore not known, simulation is still feasible as the simulator can make query to the SO T oracle with input (X e , Y s ). Then, one can still answer all the corruption queries, excepted for that user. But anyway, if F 1 happens on that user, this user must be non-corrupted at that time: one has solved the GDH problem, and one can stop the simulation. If the guess on the user is incorrect, one can also stop the simulation:

Pr[F 1 ] ≤ N • Adv GDH G (t, q RO ),
where N is the number of users in the system. Game G 5 . In this game, when simulating any responder receiving a forged message m 1 from the adversary in the name of a non-corrupted user, still non-corrupted when sending c 3 to RespRun2, one simulates PRK 4e3m thanks to a private oracle SO PRK4e3m , which makes it perfectly unpredictable to the adversary. Since m 1 is forged, thanks to the absence of collisions, TH 2 ,TH 3 , and salt 4e3m are different from the values obtained by a possibly simulated responder. In order to detect the inconsistency of PRK 4e3m with respect to the public oracle answer, the adversary must have asked SO T on the correct Diffie-Hellman value Y e xs . We denote the event F 2 , that query Y e xs is asked whereas x s is the long-term secret key of a non-corrupted user and Y e has been generated by the simulator. If this event happens, as above, one stops the simulation:

| Pr[Succ 5 ] -Pr[Succ 4 ]| ≤ Pr[F 2 ].
Game G 5 ′ . We now provide an upper-bound on Pr[F 2 ]: given a GDH challenge (X = g x , Y = g y ), one simulates all the Y e as Y e = Y • g r ′ , for random r ′ $ ← Z p , but chooses one user to set X s = X. Then, one can still answer all the corruption queries, excepted for that user. But anyway, if F 2 happens on that user, this user must be non-corrupted at that time: one has solved the GDH problem, and one can stop the simulation. If the guess on the user is incorrect, one can also stop the simulation:

Pr[F 2 ] ≤ N • Adv GDH G (t, q RO ).
Game G 6 . In this game, we simulate the key generation of PRK 2e , for all the passive sessions (m 1 received by a simulated responder comes from a simulated initiator, or (Y e , c 2 , C R ) received by a simulated initiator comes from a simulated responder, and both used the same m 1 as first message), thanks to a private oracle SO PRK2e , acting in the same vein as SO T , but not available to the adversary. This makes a difference with the previous game if the key PRK 2e has also been generated by asking SO T on the correct Diffie-Hellman value Z = g xeye . We denote by F 3 the latter event, and stop the simulation in such a case:

| Pr[Succ 6 ] -Pr[Succ 5 ]| ≤ Pr[F 3 ]. Game G 6 ′ .
We now provide an upper-bound on Pr[F 3 ]. Given a GDH challenge (X = g x , Y = g y ), one simulates all the X e as X e = X • g r , for random r $ ← Z p , and all the Y e as Y e = Y •g r ′ , for random r ′ $ ← Z p . As the key PRK 2e now depends on the session context, any query Z to the SO T oracle can make F 3 occurs on a single pair (X e = X • g r , Y e = Y • g r ′ ). Hence, q RO DDH-oracle queries might be useful to detect ]. Game G 9 . In this game, when simulating any responder receiving c 3 , from the adversary in the name of a non-corrupted user, one simulates PRK 4e3m thanks to the private oracle SO PRK4e3m . This makes a difference with the previous game only if this is not a passive session, in which case PRK 2e is unpredictable, and thus different from the public one excepted with probability 2 -ℓ hash . As there are no collisions, salt 3e2m , PRK 3e2m , and salt 4e3m are different from the values obtained by a possibly simulated responder. In order to detect the inconsistency of PRK 4e3m with respect to the public oracle answer, the adversary must have asked SO T on the correct Diffie-Hellman value Y xs e , which is not possible as event F 2 already stops the simulation:

F 3 on an input Z = CDH(X e , Y e ) = g xy • X r ′ • Y r • g rr ′ , solving the GDH challenge (X, Y ): Pr[F 3 ] ≤ Adv GDH G (t, q RO ). Game G 7 .
| Pr[Succ 9 ] -Pr[Succ 8 ]| ≤ 2 -ℓ hash .
Game G 10 . In this game, for any fresh session, one simulates PRK out thanks to the private oracle SO PRKout . A session being fresh means that no corruption of the party or of the partner occurred before the time of acceptance: the initiator is not corrupted before receiving (Y e , c 2 , C R ) and the responder is not corrupted before receiving c 3 . By consequent, they are not corrupted before PRK 4e3m was computed. We have seen above that in those cases, the key PRK 4e3m is generated using the private oracle SO PRK4e3m : it is unpredictable.

The use of the private oracle SO PRKout can only be detected if the query PRK 4e3m is asked to SO P : | Pr[Succ 10 ] -Pr[Succ 9 ]| ≤ q SO ℓ hash P × 2 -ℓ hash . Globally, one can note that the gap between the initial and the last games is upper-bounded by

(2N + 1) • Adv GDH G (t, q RO ) + q SO T 2 + q SO ℓ hash P 2 + q SO H 2 2 ℓ hash +1 + 2 + q SO ℓ hash P 2 ℓ hash ≤ (2N + 1) • Adv GDH G (t, q RO ) + q RO 2 + 4 2 ℓ hash +1
Eventually, for all the fresh sessions, in the real case (b = 0), the private oracle is used, and outputs a random key, while in the random case (b = 1), the session key is random too: Pr[Succ 10 ] = 1/2. This concludes the proof.

Explicit Authentication

Explicit authentication (or mutual authentication) aims to ensure each participant has the material to compute the final session key (accepts) when the partner terminates. In the EDHOC protocol, this means the responder (resp. the initiator) owns the private long-term key y s (resp x s ) associated to the long-term public key Y s (resp. X s ), and the private ephemeral keys, when the partner terminates. To do so, the responder uses y s in RespRun1 to compute PRK 3e2m used for the tag t 2 and the key sk 3 . In the same way, the initiator uses x s to compute PRK 4e3m , used for the tag t 3 . Furthermore, they both have to use their ephemeral keys to compute PRK 2e , used for sk 2 .

π i u .status = terminated π i u .tacc < revltk π i u .peerid , ∃π j v s.t.              π i u .peerid = v π j v .peerid = u π i u .sid = π j v .sid π i u .role ̸ = π j v .role π j v .status = accepted
Responder Authentication. Consider a simulated initiator receiving a forged message (Y e , c 2 , C R ) from the adversary in the name of a non-corrupted user. In such a case, consider the modifications made in the key privacy proof up to the game G 7 . Hence, we have replaced the generation of PRK 3e2m with a private oracle. Then the advantage of the adversary in breaking the explicit authentication of the responder in this game is bounded by 2 -ℓmac , added to the gap induced by the modifications made up to the game G 7 . This leads to the following theorem:

In both cases, we consider the modifications made in the key privacy proof up to the game G 7 , making PRK 2e and PRK 3e4m random, and by consequent, so are sk 2 and sk 3 .

Responder Identity Protection The responder's identity has to be protected against passive adversaries only. To distinguish Exp ID-resp-0 EDHOC and Exp ID-resp-1 EDHOC , one must distinguish between an encryption of ID R0 and ID R1 , as sk 2 is random, this implies breaking the injective property and the indistinguishability of Π = (E, D), both being perfect with the one-time pad.

Initiator Identity Protection The initiator's identity has to be protected against active adversaries. However, if the adversary plays in the name of a responder, he will be detected with high probability with the tag t 2 before reaching game G 7 . Therefore, distinguish between Exp ID-init-0 EDHOC and Exp ID-init-1 EDHOC also implies breaking the injective property and the indistinguishability of Π = (E, D), both being perfect with the one-time pad.

Theorem 4. The above EDHOC protocol protects Initiator and Responder's Identity under the Gap Diffie-Hellman problem in the Random Oracle model. More precisely, with q RO representing the global number of queries to the random oracles, N the number of users, and ℓ hash the hash digest length, both advantages Adv ID-init-b EDHOC (t; q RO , N ) and Adv ID-resp-b EDHOC (t; q RO , N ) are upper-bounded by

(2N + 1) • Adv GDH G (t, q RO ) + q RO 2 + 2 2 ℓ hash +1 .

Conclusion

Our computational analysis proved the EDHOC protocol instantiated with the STAT-STAT authentication method, with ℓ mac = 64 and κ sec = 128, provides nearly a 128-bit security level for key privacy and identity protection for both the responder and the initiator. In a three-flow scenario, Initiator Authentication reaches a 128-bit security level, using our improvements without extra-cost in our settings, but only a 64-bit security level for the responder. However, as suggested in their documentation, a fourth message using authenticated encryption (AEAD) from the responder to the initiator increases this security up to a 128-bit level. Hence, our improvement of EDHOC, at no communication cost, provides a global 128-bit security level.

  should protect message-privacy (IND-CPA, for Indistinguishability under Chosen-Plaintext Attacks). More precisely, we consider the Experiment Exp ind-cpa Π ′ (A) in which we randomly choose b ∈ {0, 1} and a secret key sk, A can ask multiple queries (IV, a, m 0 , m 1 ), all with different IV, and for each we compute and send c = E ′ (sk, IV; m b ; a) to A. Let b ′ ∈ {0, 1} be the output of A. Then, the Experiment Exp ind-cpa Π ′ (A) outputs 1 if b ′ = b and 0 otherwise. We define the advantage of A in violating IND-CPA security of Π ′ as Adv ind-cpa Π ′ (A) = Pr[Exp ind-cpa Π (A) = 1] and the advantage function Adv ind-cpa Π ′ (t), as the maximum value of Adv ind-cpa Π ′

Fig. 1 .

 1 Fig. 1. Key Derivation (for the STAT-STAT Method) from [NSB21]. Green vertical hatchs denote additions and red horizontal hatchs denote removals compared to the initial version.

Fig. 3 .

 3 Fig. 3. Optimized EDHOC with four messages in the STAT/STAT Authentication Method. Our modifications compared to [SMP22] (draft-ietf-lake-edhoc-15) are represented by previous | new and additions by gray highlights

Finalize

Fig. 5 .

 5 Fig. 5. Finalize Function for the Explicit Authentication Security Game

  Cyclic group generated by g, of size p H Hash function SHA-256 (256 bits digest) Xe, xe Initiator Ephemeral DH Public and Secret Key Xs, xs Initiator Static DH Public and Secret Key Ye, ye Responder Ephemeral DH Public and Secret Key Ys, ys Responder Static DH Public and Secret Key EAD

		External Authorization Data
	E, D	One-time Pad Encryption and Decryption
	E ′ , D ′ AEAD Encryption and Decryption
	sk	Secret key	t2, t3 MAC tags
	TH	Transcript Hash	⊥	Protocol abortion
	C R , C I Connection Identifiers	κsec	Expected bit-security
		Lengths
	ℓ

G =< g > C

Connection Identifiers ℓmac, ℓ hash MAC and Hash output ℓ2, ℓ id m2 and ID ℓ key , ℓ iv Key and IV Fig.

2

. Notations

  this game, when simulating any initiator receiving a forged tuple (Y e , c 2 , C R ) from the adversary in the name of a non-corrupted user, one simulates PRK 3e2m thanks to a private oracle SO PRK3e2m , which makes it perfectly unpredictable to the adversary. If the pair (Y e , C R ) is forged, TH 2

  In this game, when simulating any initiator receiving the second message (Y e , c 2 , C R ), from the adversary in the name of a non-corrupted user, one simulates PRK 3e2m thanks to a private oracle SO PRK3e2m . This makes a difference with the previous game only if this is a passive session, in which case PRK 2e is unpredictable, and thus different from the public one excepted with probability 2 -ℓ hash . As there are no collisions, salt 3e2m is different from the value obtained by a possibly simulated responder. In order to detect the inconsistency of PRK 3e2m with respect to the public oracle answer, the adversary must have asked SO T on the correct Diffie-Hellman value X ys e , which is not possible as event F 1 already stops the simulation. Hence, we just have| Pr[Succ 7 ] -Pr[Succ 6 ]| ≤ 2 -ℓ hash . Game G 8 . Inthis game, when simulating any initiator receiving the second message (Y e , c 2 , C R ), from the adversary in the name of a non-corrupted user, one simulates PRK 4e3m thanks to a private oracle SO PRK4e3m . In this case, PRK 3e2m is unpredictable, as well as salt 4e3m and PRK 4e3m : Pr[Succ 8 ] = Pr[Succ 7

We use semicolons here to distinguish keying material, message and Additional Data.

One can move EAD3 in m3, if privacy is required. It is still secure with any one-time secure encryption, but increasing the key size in the particular case of one-time pad.

Acknowledgments

This work was supported in part by the French ANR Project Crypto4Graph-AI.

Send(u, i, m)

(peerid, role) ← m 3 :

(π i u , m ′ ) ←$ Activate(u, sku, peerid, peerpk, role) Game G 0 . This game is the key privacy security game G kp-ake AKE,A (defined in Figure 4) played by A using the KeyGen, Activate and Run algorithms(defined in Figure 6). The KeyGen algorithm generates a long term pair of key, calling Activate with an user with identity u, A creates its i-th session with u, denoted π i u .

Pr[Succ 0 ] = Pr[G kp-ake AKE,A ], where the event Succ means b ′ = b. We stress that in this security model, with Perfect Forward Secrecy, we use the weak definition of corruption, meaning that a query to LongTermKeyReveal only reveals the long-term key, while the ephemeral key remains unre-Theorem 2. The above EDHOC protocol satisfies the responder-authentication property under the Gap Diffie-Hellman problem in the Random Oracle model. More precisely, with q RO representing the global number of queries to the random oracles, N the number of users, ℓ hash the hash digest length and ℓ mac the MAC digest length, we have Adv auth-resp EDHOC (t; q RO , N ) is upper-bounded by

Optimal Reduction. One cannot expect more after these three flows, as the adversary can play the role of the responder with known y e . Without knowing y s , it just gets stuck to compute PRK 3e2m and thus t 2 . But it can guess it (with probability 2 -ℓmac ), breaking authentication. But it will not know SK. However, by waiting for the fourth message containing an authenticated encryption c 4 , as said in the documentation, this will add a factor Adv uf-cma Π ′ (t) ≈ 2 -ℓmac to the Responder Authentication security: Adv auth-resp EDHOC (t; q RO , N ) is upper-bounded by

Initiator Authentication. We now consider any responder receiving a forged message c 3 from the adversary in the name of a non-corrupted user. As above, considering the modifications made in the key privacy proof up to the game G 8 , we have replaced the generation of PRK 4e3m with a private oracle. Then the advantage of the adversary in breaking the explicit authentication of the initiator in this game is bounded by 1 2 κsec . Added to the gap induced by the modifications made up to the game G 7 . This leads to the following theorem:

Theorem 3. The above EDHOC protocol satisfies the initiator-authentication property under the Gap Diffie-Hellman problem in the Random Oracle model. More precisely, with q RO representing the global number of queries to the random oracles, N the number of users, ℓ hash the hash digest length and κ sec the expected bit-security, we have Adv auth-init EDHOC (t; q RO , N ) upper-bounded by

Identity Protection

Let us now consider anonymity, with identity protection. More precisely, we want to show that the initiator's identity (ID I ) is protected against active adversaries, while responder's identity (ID R ) is protected only against passive adversaries.

The values ID I and ID R are the authentication credentials containing the public authentication keys of the Initiator and the Responder, respectively.

Both those values are sent to the other respective party using One-Time Pad encryption, that perfectly protects the privacy. Then, in one hand we have ID R that is part of CTX 2 used to compute t 2 and in the other hand, we have ID I that is part of CTX 3 used to compute t 3 . We thus define the similar responder and initiator identity protection experiment as follows:

status ← rejected 12 :

return ⊥ 13 : TH3 ← H(TH2, m2) 14 : sk3 ← RO P (PRK3e2m, 3, TH3, ℓ id ) 15 : IV3 ← RO P (PRK3e2m, 4, TH3, ℓ iv ) 16 : salt4e3m ← RO P (PRK3e2m, 5, TH3, ℓ hash ) 17 : PRK4e3m ← RO T (salt4e3m, Ye