I am looking for, but not finding, a published protocol that does something similar to TLS 1.3 mutual authentication, but simplified by using assumptions to reduce the chattiness of TLS.
If we assume that some set of clients are configured with key/cert pairs and the server's root cert, and the server has a key/cert pair and the client's root cert, and that the clients and server already know the cipher suite, can mutual authentication and key establishment be done with two messages?
I am thinking something like this:
C: ECDHE key material, client cert chain, signature (of something)
S: ECDHE key material, server cert chain, signature (also of something), Encrypted Data using AE
At this point, the two sides have apparently agreed on a ECDH key, and both sides have validated a signature and a cert chain. So...good to go?
Does this sound like anything already out there, or is it obviously deeply flawed? Is this just authenticated DH?
Edit: This appears to be similar to RFC 3830, so I guess that answers the question of something already existing.