Initiator                             Responder

HDR, SAi1, KEi, Ni [,N+]      --->
                              <---    HDR, N(INVALID_KE_PAYLOAD)

HDR, SAi1, KEi, Ni [,N+]      --->
                              <---    HDR, SAr1, KEr, Nr 
                                           [,CERTREQ] [,N+]

HDR, SK {IDi, [CERT,] 
     [CERTREQ,] [IDr,] [N+,] 
     AUTH, SAi2, TSi, TSr}    --->
                              <---    HDR, SK {IDr, [CERT,] [N+,] 
                                           AUTH, SAr2, TSi, TSr}