To validate a decryption, the client must decrypt all of the returned text after the IV and apply the appropriate function to the plaintext minus the check field. If the check field returned matches the calculated check field, the decryption is correct. The techniques outlined above require no changes to the IPsec server, nor do they impose any requirements on the location of the authentication server. It is, however, desirable to configure the latter to accept all certificates of a certain format if signed by an authentication server. The latter in turn can possess certificates signed by a root key whose certificate is known to the IPsec servers, providing further decoupling.
Authentication is performed as in the previous two cases.
Transmission of the secret to the IPsec server is beyond the scope of this document. Although this document is carefully agnostic about the user authentication techniques to be used, there are two underlying assumptions. All are believed to be accomodated by this framework. Certificate Characteristics Signed or generated certificates should, as noted, have a distinctive name format that can be recognized and accepted by the IPsec servers. The expiration time of the certificates is limited by local policy on reuse.