Server-side state kept between login respond and client verification.
Hex-encoded session key (server-side).
Expected client MAC for mutual authentication.
Server-side state kept between login respond and client verification.