# Evaluation and Improvement of Internet Printing Protocol Based on HCPN Model Detection Method
## 3 Establishment of HCPN Model for IPP Authentication Process
### 0-RTT Authentication Model
#### 3.2.3 Middle-Level Model  
The middle layer of the 0-RTT authentication in PSK mode could also be called the entity layer, which was composed of three entities: client, network channel, and server. This section describes the internal implementation details of the three separately. As shown in Figure 3 below, the model of the client included 32 message places and 15 transitions. The client first sent its own parameters to the server to complete the ECDHE key exchange; then, it received the server certificate and signature to complete the server identity authentication, and at the same time, it provided its own certificate and signature to the server. Finally, if the server successfully verified the identity of the client, it generated relevant tickets to assist the client and optimize future sessions. To provide more detail, in the first step, client(A) determined its own encryption parameter suite OFFER (x25519, AES128 GCM, SHA256) and then attached the random number (nc), encapsulated them into MSG1, and sent it to the network channel in plain text. Note that since we did not include the calculation details of the DHE key-exchange algorithm in order to simplify the model, CID was used in MSG1 instead of the first parameter in Definition (1). In the second step, client(A) received the server parameter MSG2 (SID, ns, mode), the server random number (ns) and the selected cipher suite (mode) and passed it to the hash-based key-derivation function HKDF to generate a temporary key (tk), which could be used in the subsequent process to generate authentication packets. Note that since we did not include the calculation details of the DHE key exchange algorithm in order to simplify the model, MSG2 uses SID to replace the first parameter in Definition (2). \begin{table}
\begin{tabular}{c c c} \hline
**Stage** & **Type** & **Colset Def. ** \\ \hline \multirow{3}{*}{ParasExchange} & ID & \(\text{colset ID}=\text{string with }^{*}\text{A}^{*},\ldots,\text{ }^{*}\text{D}^{*}\); \\  & NONCE & \(\text{colset NONCE}=\text{int with }1,\ldots,3\); \\  & Group List & \(\text{colset GroupList}=\text{with secp256r1}\times\text{x25519}\); \\  & EncryptionList & \(\text{colset EncryptionList}=\text{with}\) \\  & AES128 GCM\(\,\)\(\,\)\(\,\)\(\,\)\(\,\)\(\,\)\(\,\)\(\,\)\(\,\)\(\,\)\(\,\)\(\,\,\)\(\,\)\(\,\,\)\(\,\)\(\,\,\)\(\,\,\)\(\,\,\)\(\,\,\)\(\,\,\)\(\,\,\)\(\,\,\)\(\,\,\)\(\,\,\,\)\(\,\,\,\)\(\,\,\,\)\(\,\,\,\)\(\,\,\,\,\)\(\,In the third step, the client received the server message MSG3, which contains four hashed ciphertexts c1, c2, c3, and c4. They were obtained by encrypting 4 hash values, h1, h2, h3, and h4, with the handshake key (HK) by the server. They were obtained by encrypting the four handshake messages with the temporary symmetric key TempKey by the server. The four messages were: certificate-request, certificate, certificate-verify, and finished. The first message, certificate-request, indicated that the server needed to verify the identity of the client, requiring the client to generate a handshake authentication message MSG4 and send it to the server. The second through the fourth messages were provided to the transition VerifyS to verify the identity of the server. After the verification was passed, the client generated its own certificate, signature, handshake message, and authentication code. After they were encrypted by the temporary symmetric key TempKey in turn, they were packaged as MSG4 and sent to the communication channel. In the fourth step, the client received the session resumption ticket MSG5, extracted the identity information identified by the server for the client, and calculated a binding value binder, which was bound to the initial session and identity. Then, it generated the pre-shared key PSK, and derive the early data key EDK to encrypt and send the early data ED. Then, it packaged the three as MSG6 and sent them to the server. Figure 3: Client entity. In the fifth step, the client received MSG7, which contained the server message authentication code \"Sfinished\".