authentication protocol -- work in progress