The processing of this step differs between versions only in these details:
(A) the bucket containing DH params:
pre-4.9 = kXRS_puk, 4.9 = kXRS_cipher
(B) DH parameters are signed using the private key:
pre-4.9 no, 4.9 yes
(C) the public key of the client is included in a separate bucket:
pre-4.9 no, 4.9 in kXRS_puk
(D) a username bucket is included
pre-4.9 no, 4.9 yes
Otherwise, all the following must be done:
- validate cipher and digest
- extract and validate the server certificate
- verify the rtag challenge sent previously
- finalize the dh session from the dh params sent by server
- create the main bucket with signed challenge, new challenge
and serialized certificate of client
- add buckets for cipher, digest, dhParams, and optionally publicKey
and username.