Re: implicit authentication and waiting for service request response

[Bill Sommerfeld <sommerfeld%sun.com@localhost>]

On Mon, 2004-11-08 at 10:20, denis bider wrote:
> I'm probably lacking background here to understand this, but if I lack the
> background after working in SSH for years, this will also be a mystery to
> new implementors. I'd like this to be clear and explicit enough at least for
> me to understand it.

The server authentication is "implicit" because the client doesn't know
whether the server successfully did its part of the key exchange until
the client receives a subsequent message from the server, not part of
the key exchange, which demonstrates knowledge of K by the server.

(Kerberos can be used this way)

> :    A key exchange method uses "implicit server
> :    authentication" if, in order to prove its autenticity, the server
> :    also has to prove that it knows the shared secret K, by sending a
> :    message and a corresponding MAC which the client can verify. [1]

I'd suggest changing "by sending a message" to "by sending a subsequent
message"

					- Bill