I'm not a security expert and can only point out one thing that I noticed from my knowledge from network security class in college: >Upon successful verificati

I'm not a security expert and can only point out one thing that I noticed from my knowledge from network security class in college: >Upon successful verification of the signature contained in the third message (and verification that the eight-byte timestamp is current), the server proceeds to send three symmetrical messages: a long term server public key, an ephemeral server public key, and a signature message authenticating the ephemeral key. This might be vulnerable to replay attacks. The user proves freshness of his request by sending a signed unix timestamp, the server however doesn't seem to do that. Shouldn't compromise the security of the protocol, just one thing that I noticed.