Some more thoughts on AES-CTR encryption for large message_2

[emanjon]

EDHOC-17 uses HMAC and KMAC as stream ciphers for encryption of message_2.

KEYSTREAM_2 = EDHOC-KDF( PRK_2e, 0, TH_2, plaintext_length )
A reason for this is that COSE does not have IND-CPA encryption algorithms like AES-CTR and ChaCha20. It was also seen as hard to do remove the tag from an AEAD call such as AES-CCM(K_2, P_2, A, N). Something I think was missed in the discussion was to use the AEAD with a plaintext consisting of zeroes.

`KEYSTREAM_2 = AES-CCM(K_2, 0000000......, A, N) and then XOR PLAINTEXT_2 with the beginning of KEYSTREAM_2. This implements AES-CTR with AES-CCM.

[emanjon]

Discussed and decided not to do