HTTPsec Authentication Protocol

2.3.1. Initialization

The requester begins the initialization stage by sending a request containing its initialize parameters. The responder returns with a response containing its initialize parameters. Both these messages contain the peer's identifier, ephemeral Diffie-Hellman key, and optionally their authentication public key. See Initialization Request and Initialization Response for the form these messages take.

This initialization transaction establishes an authenticated shared-secret arrangement between both peers, indexed by a token chosen by the responder. Forward secrecy is ensured by the ephemeral Diffie-Hellman shared-secret exchange. Both peers identically derive temporary message authentication keys and cipher keys from the shared-secret, to be employed in the protection of subsequent continuation messages.

Whereas the protocol mandates certain conditions under which these temporary keys must be discarded, either peer may choose to discard them according to rules of their own, for instance based on elapsed time since last usage.