However, there is still one hole in this solution: the server has not yet authenticated the client, so while the client knows that it is talking to the server it wants to, the server has no assurances that it is talking to the client that it wants to.