  Ephemeral Diffie-Hellman Over COSE (EDHOC) aims at being a very compact and
lightweight authenticated Diffie-Hellman key exchange with ephemeral keys. It
is expected to provide mutual authentication, forward secrecy, and identity
protection, with a 128-bit security level.A formal analysis has already been
proposed at SECRYPT '21, on a former version, leading to some improvements, in
the ongoing evaluation process by IETF. Unfortunately, while formal analysis
can detect some misconceptions in the protocol, it cannot evaluate the actual
security level.In this paper, we study the last version. Without complete
breaks, we anyway exhibit attacks in 2^64 operations, which contradict the
expected 128-bit security level. We thereafter propose improvements, some of
them being at no additional cost, to achieve 128-bit security for all the
security properties (i.e. key privacy, mutual authentication, and
identity-protection).
