I'm struggling to see how this was ever allowed. My understanding of a secure authentication is something like this (I've ignored arriving securely at a session

I'm struggling to see how this was ever allowed. My understanding of a secure authentication is something like this (I've ignored arriving securely at a session key): Alice ------> Bob: Hello, I'm Alice, my public key is A and here's a random number, R1. Alice <----- Bob: Hello Alice, I'm Bob, my public key is B and heres another random number, R2. Alice ------> Bob: OK Bob, I know B, here's Proof1 that I have arrived at a session key between us. I've used both R1 and R2 in my math, which you can verify, and be assured that this proof is fresh and unique to this handshake. Alice <----- Bob: Thanks Alice, I accept Proof1, here's Proof2 that I have arrived at the same session key. I've have also used R1 and R2 in my math, which you can verify and be assured that this proof is fresh and unique to this handshake. Is the problem in client auth TLS that R1 simply doesn't exist or that Proof1 can be replayed?