A Cryptographic Analysis of the TLS 1.3 Handshake Protocol
eprint.iacr.org