Introduction

About libedhoc

libedhoc is a C implementation of the EDHOC protocol — a lightweight authenticated key exchange for IoT and constrained devices. A successful handshake gives both peers mutual authentication, forward secrecy and identity protection, and yields fresh keying material — most often to bootstrap an OSCORE Security Context. EDHOC is standardised by the IETF as RFC 9528; libedhoc is verified against the RFC 9529 test vectors.

To see code, jump to the Quick Start.

Roles

A handshake runs between two peers: the Initiator and the Responder. libedhoc is role-agnostic — both sides use the same context type and the role is implied by which compose / process calls the application makes. The library is transport-agnostic too: the message buffers it produces can be carried over CoAP (see Protocol Flow) or any other transport.

Features

  • Standards-based — implements RFC 9528 and passes the RFC 9529 test vectors.

  • Handle-only key material — secrets stay in the backend key store and are used by reference (see Security & Key Handling).

  • Post-quantum ready — a KEM-shaped crypto interface; classical ECDH plugs in as a shim with no change on the wire.

  • Small callback interfaces — cryptography, credentials, platform and optional EAD; CBOR is fully hidden.

  • OSCORE-ready — exports the OSCORE Security Context, with CoAP + EDHOC framing helpers (RFC 9668).

  • Predictable memory — stack (VLA, default, no heap), heap or a custom backend.

  • Quality-gated — cppcheck, clang-tidy, Valgrind, ASan, UBSan and LibFuzzer run in CI.

  • Zephyr-native — usable as a Zephyr module via a west manifest.

EDHOC methods

Supported authentication methods.

Value

Initiator authentication key

Responder authentication key

0

Signature key

Signature key

1

Signature key

Static DH key

2

Static DH key

Signature key

3

Static DH key

Static DH key

EDHOC cipher suites

Supported cipher suites.

Suite

Key exchange

Signature

AEAD

Hash

0

X25519

EdDSA

AES-CCM-16-64-128

SHA-256

2

P-256

ES256

AES-CCM-16-64-128

SHA-256

4

X25519

EdDSA

ChaCha20/Poly1305

SHA-256

24

P-384

ES384

A256GCM

SHA-384

-24

ML-KEM-512

ML-DSA-44

AES-CCM-16-128-128

SHAKE256

Suite -24 is an experimental PQC suite on a private-use code point, tracking draft-ietf-lake-pqsuites; enable it only when you need post-quantum security.

Authentication credentials

Each peer presents a credential (CRED_I or CRED_R), identified on the wire by one of the COSE credential types:

Label

Type

Carried value

4

kid

Key identifier

33

x5chain

Ordered chain of X.509 certificates

34

x5t

Hash of an X.509 certificate

libedhoc embeds no credential storage or validation: the application supplies the select_local / authenticate_peer callbacks and may consult a CRL or any other trust policy. See Authentication Credentials.

Where next?