[ekr____]

I would add Hugo Krawczyk's "SIGMA: the ‘SIGn-and-MAc’ Approach to Authenticated Diffie-Hellman and its Use in the IKE Protocols"

https://www.iacr.org/cryptodb/archive/2003/CRYPTO/1495/1495....