Putting it all together (contd) ...
Client:
- Verify X.509 certificates (public key) for CA signature and certification; store if ok
- Use private key to decrypt remote's password, and use this to decode the text portion. This may involve matching a result with a crypto-checksum
- If ok, then integrity, confidentiality guaranteed
- Use standard hash function on text to get a MAC
- Apply sender's public key to digital signature to get a MAC value.
- Compare the two MACs. If equal, then authenticated, non-repudiable.