Diffie-Hellman key agreement with both Server Authentication and Perfect Forward Secrecy
$Adversary\:$ receives $C^1_{publ}$

$Adversary\:$ adaptively queries an oracle that implements:

take $C^2$ as input, generate $S^1_{publ}$, set $\: k_{adv} = KDF\left(\left(C_2\right)^{S^0_{priv}},label_0\right) \:$, $\:$ output $\: AE_{k_{adv}}\left(S^1_{publ}\right)$

Note that $\:Adversary\:$ can (with, heuristically, overwhelming accuracy) test whether or not a given

value was used as $k_{adv}$ on a given query to that oracle (since the encryption is authenticated).

$Adversary\:$ guesses $k_{tmp}$ and then runs the rest of the protocol with $\:Client\:$.

If the guess was correct, then $\:Client\:$ will accept with $k_S$ and $k_C$ known to $\:Adversary\:$.

(There is slightly more that the adversary can do, which I'll

explain if you don't think the above justifies my next sentence)

It seems that it would be very difficult to prove security against the above sort of attack

without proving that even if the oracle instead outputs [if $\: C^2 = C^1_{publ} \:$ then $\perp$ else $k_{adv}$],

it would still be infeasible to distinguish $k_{tmp}$ from a randomly chosen key.

That is the analogue of CCA2 security for Diffie-Hellman+your-KDF.



You could reduce the main security assumption to KDF-Diffie-Hellman by having

$Server$'s$\:$ long
term key pair be for signatures, replacing the step 6 message with

$S^1_{publ}\;||\;\text{sign}_{S^0_{priv}}\left(C^1_{publ}\:||\:S^1_{publ}\right)\;$, $\;\;$ and then removing step 4 and the "decrypt" part of step 7.

Both of these methods use two messages, and I will assume they are done using Elliptic Curves

and that the $AE$ in step 6 of yours does not include an IV (since the plaintext has high min-entropy,

and that particular plaintext doesn't actually need to be confidential). $\;\;$ In both of these protocols,

the length of the first message is $\:2\hspace{-0.03 in}\cdot\hspace{-0.03 in}k\:$,$\:$ where $k$ is the (confidentiality) security parameter.

In your protocol, the length of the second message if $\:(2\hspace{-0.03 in}\cdot\hspace{-0.03 in}k)+\sigma\:$,$\:$ where $\:Adversary$

has a trivial attack that will violate explicit authentication with probability $1/(2^{\sigma})$

and cause $\:Client\:$ to reject otherwise. $\;\;$ In my protocol, the length of the second

message is $\:(2\hspace{-0.03 in}\cdot\hspace{-0.03 in}k)+(4\hspace{-0.035 in}\cdot\hspace{-0.03 in}k_{\hspace{.01 in}0})\:$,$\;$ where $\hspace{.02 in}k_{\hspace{.01 in}0}\hspace{.01 in}$ is the authentication security parameter.