papers/agent-communication/refs.bib

@misc{mcp2024,
  author       = {{Model Context Protocol}},
  title        = {Model Context Protocol Specification},
  year         = {2024},
  howpublished = {\url{https://modelcontextprotocol.io/specification}},
  note         = {JSON-RPC 2.0 transport over stdio, HTTP+SSE, and WebSocket}
}

@misc{a2a2025,
  author       = {{Agent2Agent Protocol Working Group}},
  title        = {Agent2Agent ({A2A}) Protocol Specification},
  year         = {2025},
  howpublished = {\url{https://a2a-protocol.org/specification}},
  note         = {Agent cards, tasks, artifacts; HTTP/JSON transport}
}

@misc{jsonrpc2,
  author       = {{JSON-RPC Working Group}},
  title        = {{JSON-RPC} 2.0 Specification},
  year         = {2013},
  howpublished = {\url{https://www.jsonrpc.org/specification}}
}

@misc{rfc8259,
  author       = {Tim Bray},
  title        = {{RFC 8259}: The {JavaScript} Object Notation ({JSON}) Data Interchange Format},
  year         = {2017},
  publisher    = {IETF}
}

@misc{rfc6455,
  author       = {Ian Fette and Alexey Melnikov},
  title        = {{RFC 6455}: The {WebSocket} Protocol},
  year         = {2011},
  publisher    = {IETF}
}

@misc{rfc8446,
  author       = {Eric Rescorla},
  title        = {{RFC 8446}: The Transport Layer Security ({TLS}) Protocol Version 1.3},
  year         = {2018},
  publisher    = {IETF}
}

@misc{rfc7519,
  author       = {Michael B. Jones and John Bradley and Nat Sakimura},
  title        = {{RFC 7519}: {JSON} Web Token ({JWT})},
  year         = {2015},
  publisher    = {IETF}
}

@misc{rfc6749,
  author       = {Dick Hardt},
  title        = {{RFC 6749}: The {OAuth} 2.0 Authorization Framework},
  year         = {2012},
  publisher    = {IETF}
}

@misc{nistmldsa,
  author       = {{NIST}},
  title        = {{FIPS 204}: Module-Lattice-Based Digital Signature Standard},
  year         = {2024},
  publisher    = {National Institute of Standards and Technology}
}

@misc{nistmlkem,
  author       = {{NIST}},
  title        = {{FIPS 203}: Module-Lattice-Based Key-Encapsulation Mechanism Standard},
  year         = {2024},
  publisher    = {National Institute of Standards and Technology}
}

@misc{nistslhdsa,
  author       = {{NIST}},
  title        = {{FIPS 205}: Stateless Hash-Based Digital Signature Standard},
  year         = {2024},
  publisher    = {National Institute of Standards and Technology}
}

@inproceedings{dilithium2018,
  author    = {L{\'e}o Ducas and Eike Kiltz and Tancr{\`e}de Lepoint and Vadim Lyubashevsky and Peter Schwabe and Gregor Seiler and Damien Stehl{\'e}},
  title     = {{CRYSTALS-Dilithium}: A Lattice-Based Digital Signature Scheme},
  booktitle = {{IACR} Transactions on Cryptographic Hardware and Embedded Systems},
  volume    = {2018},
  number    = {1},
  pages     = {238--268},
  year      = {2018}
}

@inproceedings{kyber2018,
  author    = {Joppe W. Bos and L{\'e}o Ducas and Eike Kiltz and Tancr{\`e}de Lepoint and Vadim Lyubashevsky and John M. Schanck and Peter Schwabe and Gregor Seiler and Damien Stehl{\'e}},
  title     = {{CRYSTALS-Kyber}: A {CCA}-Secure Module-Lattice-Based {KEM}},
  booktitle = {{IEEE} European Symposium on Security and Privacy, EuroS\&P},
  year      = {2018},
  pages     = {353--367}
}

@misc{ed25519,
  author       = {Daniel J. Bernstein and Niels Duif and Tanja Lange and Peter Schwabe and Bo-Yin Yang},
  title        = {High-speed High-security Signatures},
  year         = {2011},
  howpublished = {Journal of Cryptographic Engineering, 2(2):77--89}
}

@inproceedings{goldwasser1988,
  author    = {Shafi Goldwasser and Silvio Micali and Ronald L. Rivest},
  title     = {A Digital Signature Scheme Secure Against Adaptive Chosen-Message Attacks},
  booktitle = {{SIAM} J. Comput.},
  volume    = {17},
  number    = {2},
  pages     = {281--308},
  year      = {1988}
}

@misc{didcore,
  author       = {{W3C}},
  title        = {Decentralized Identifiers ({DIDs}) v1.0},
  year         = {2022},
  howpublished = {W3C Recommendation},
  url          = {https://www.w3.org/TR/did-core/}
}

@misc{didweb,
  author       = {Michael Prorock and Orie Steele and Manu Sporny},
  title        = {{did:web} Method Specification},
  year         = {2024}
}

@misc{didkey,
  author       = {Dmitri Zagidulin and Manu Sporny and Dave Longley},
  title        = {{did:key} Method Specification},
  year         = {2022}
}

@misc{vc20,
  author       = {{W3C}},
  title        = {Verifiable Credentials Data Model v2.0},
  year         = {2024},
  howpublished = {W3C Recommendation Candidate}
}

@inproceedings{sigma,
  author    = {Hugo Krawczyk},
  title     = {{SIGMA}: The {SIGn}-and-{MAc} Approach to Authenticated {Diffie-Hellman} and Its Use in the {IKE} Protocols},
  booktitle = {CRYPTO},
  series    = {LNCS},
  volume    = {2729},
  pages     = {400--425},
  year      = {2003}
}

@inproceedings{krawczyk2010hkdf,
  author    = {Hugo Krawczyk},
  title     = {Cryptographic Extraction and Key Derivation: The {HKDF} Scheme},
  booktitle = {CRYPTO},
  series    = {LNCS},
  volume    = {6223},
  pages     = {631--648},
  year      = {2010}
}

@misc{rfc8032,
  author       = {Simon Josefsson and Ilari Liusvaara},
  title        = {{RFC 8032}: Edwards-Curve Digital Signature Algorithm ({EdDSA})},
  year         = {2017},
  publisher    = {IETF}
}

@misc{harvest_now,
  author    = {Michele Mosca},
  title     = {Cybersecurity in an Era with Quantum Computers: Will We Be Ready?},
  howpublished = {{IEEE} Security \& Privacy},
  volume    = {16},
  number    = {5},
  pages     = {38--41},
  year      = {2018}
}

@inproceedings{shoupgame,
  author    = {Victor Shoup},
  title     = {Sequences of Games: A Tool for Taming Complexity in Security Proofs},
  booktitle = {IACR Cryptology ePrint Archive, Report 2004/332},
  year      = {2004}
}

@inproceedings{cremers2017ake,
  author    = {Cas Cremers and Marko Horvat and Jonathan Hoyland and Sam Scott and Thyla van der Merwe},
  title     = {A Comprehensive Symbolic Analysis of {TLS 1.3}},
  booktitle = {ACM CCS},
  year      = {2017},
  pages     = {1773--1788}
}

@inproceedings{tamarin,
  author    = {Simon Meier and Benedikt Schmidt and Cas Cremers and David A. Basin},
  title     = {The {TAMARIN} Prover for the Symbolic Analysis of Security Protocols},
  booktitle = {CAV},
  series    = {LNCS},
  volume    = {8044},
  pages     = {696--701},
  year      = {2013}
}

@misc{gdpr_art30,
  author       = {{European Parliament and Council}},
  title        = {Regulation ({EU}) 2016/679 ({GDPR}), Article 30: Records of Processing Activities},
  year         = {2016}
}

@misc{hipaa_security,
  author       = {{U.S. Department of Health and Human Services}},
  title        = {{HIPAA} Security Rule, 45 {CFR} Part 164, Subpart {C}},
  year         = {2003}
}

@misc{soc2,
  author       = {{AICPA}},
  title        = {Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy ({SOC} 2)},
  year         = {2017}
}

@misc{rfc6979,
  author       = {Thomas Pornin},
  title        = {{RFC 6979}: Deterministic Usage of the {DSA} and {ECDSA}},
  year         = {2013},
  publisher    = {IETF}
}

@misc{rfc5280,
  author       = {David Cooper and Stefan Santesson and Stephen Farrell and Sharon Boeyen and Russell Housley and Tim Polk},
  title        = {{RFC 5280}: Internet {X.509} Public Key Infrastructure Certificate and {CRL} Profile},
  year         = {2008},
  publisher    = {IETF}
}

@misc{rfc6066,
  author       = {Donald E. Eastlake},
  title        = {{RFC 6066}: Transport Layer Security ({TLS}) Extensions: Extension Definitions},
  year         = {2011},
  publisher    = {IETF}
}

@misc{rfc8555,
  author       = {Richard Barnes and Jacob Hoffman-Andrews and Daniel McCarney and James Kasten},
  title        = {{RFC 8555}: Automatic Certificate Management Environment ({ACME})},
  year         = {2019},
  publisher    = {IETF}
}

@inproceedings{prompt_injection_2023,
  author    = {Kai Greshake and Sahar Abdelnabi and Shailesh Mishra and Christoph Endres and Thorsten Holz and Mario Fritz},
  title     = {Not What You've Signed Up For: Compromising Real-World {LLM}-Integrated Applications with Indirect Prompt Injection},
  booktitle = {{ACM} Workshop on Artificial Intelligence and Security ({AISec})},
  year      = {2023}
}

@inproceedings{tool_attack_2024,
  author    = {Yi Zeng and Yu Yang and Andy Zhou and Jeffrey Tan and Yuheng Tu and Yifan Mai and Kevin Klyman and Minzhou Pan and Ruoxi Jia and Dawn Song and Percy Liang and Bo Li},
  title     = {Air-Bench: Benchmarking Safety of {LLM}s with Risk Categories},
  booktitle = {{NeurIPS} Datasets and Benchmarks Track},
  year      = {2024}
}

@misc{constitutional_ai,
  author       = {Yuntao Bai and Saurav Kadavath and Sandipan Kundu and Amanda Askell and Jackson Kernion and Andy Jones and Anna Chen and Anna Goldie and Azalia Mirhoseini and Cameron McKinnon and others},
  title        = {Constitutional {AI}: Harmlessness from {AI} Feedback},
  year         = {2022},
  howpublished = {arXiv:2212.08073}
}

@inproceedings{provenance_2022,
  author    = {Boyd-Graber, Jordan and Feng, Shi and Rudinger, Rachel},
  title     = {Provenance for Natural Language Generation: A Survey},
  booktitle = {Computational Linguistics},
  year      = {2022}
}

@inproceedings{agent_audit_2024,
  author    = {Yonadav Shavit and Sandhini Agarwal and Miles Brundage and Steven Adler and Cullen O'Keefe and Rosie Campbell and Teddy Lee and Pamela Mishkin and Tyna Eloundou and Alan Hickey and Katarina Slama and Lama Ahmad and Paul McMillan and Alex Beutel and Alexandre Passos and David G. Robinson},
  title     = {Practices for Governing Agentic {AI} Systems},
  booktitle = {OpenAI Research},
  year      = {2024}
}

@inproceedings{cog_signing,
  author    = {Karthikeyan Bhargavan and Bruno Blanchet and Nadim Kobeissi},
  title     = {Verified Models and Reference Implementations for the {TLS} 1.3 Standard Candidate},
  booktitle = {{IEEE} Symposium on Security and Privacy},
  year      = {2017}
}

@misc{zaprns,
  author       = {{ZAP Protocol Authors}},
  title        = {{ZAP-RNS}: Identity-Bound Resource Naming for Post-Quantum Transports},
  year         = {2025},
  howpublished = {ZAP Protocol Working Notes}
}

@misc{zaptransport,
  author       = {{ZAP Protocol Authors}},
  title        = {{ZAP}: A Post-Quantum, Authenticated, Zero-Copy Transport},
  year         = {2025},
  howpublished = {ZAP Protocol Working Notes}
}

@misc{proof,
  author       = {{ZAP Protocol Authors}},
  title        = {{ZAP-MCP} and {ZAP-A2A}: Formal Security Proofs (companion proof document)},
  year         = {2026},
  howpublished = {\url{https://zap-proto.io/proofs/agent-communication}}
}

@inproceedings{ake_security_2020,
  author    = {Colin Boyd and Anish Mathuria and Douglas Stebila},
  title     = {Protocols for Authentication and Key Establishment},
  publisher = {Springer},
  year      = {2020}
}

@inproceedings{logjam,
  author    = {David Adrian and Karthikeyan Bhargavan and Zakir Durumeric and Pierrick Gaudry and Matthew Green and J. Alex Halderman and Nadia Heninger and Drew Springall and Emmanuel Thom{\'e} and Luke Valenta and Benjamin VanderSloot and Eric Wustrow and Santiago Zanella-B{\'e}guelin and Paul Zimmermann},
  title     = {Imperfect Forward Secrecy: How {Diffie}-{Hellman} Fails in Practice},
  booktitle = {{ACM} CCS},
  year      = {2015}
}

@misc{cose,
  author       = {Jim Schaad},
  title        = {{RFC 9052}: {CBOR} Object Signing and Encryption ({COSE})},
  year         = {2022},
  publisher    = {IETF}
}

@misc{jose,
  author       = {Michael B. Jones and Joe Hildebrand},
  title        = {{RFC 7516}: {JSON} Web Encryption ({JWE})},
  year         = {2015},
  publisher    = {IETF}
}

@inproceedings{owasp_llm_2024,
  author    = {{OWASP Foundation}},
  title     = {{OWASP} Top 10 for {Large Language Model Applications}},
  year      = {2024}
}