HP-UX IPSec version A.02.01 Administrator's Guide

Using Certificates with HP-UX IPSec
Overview
Chapter 5 155
The initiator sends an authentication “challenge” to the responder: the
initiator sends data, including a random number (nonce), encrypted
using the responder’s public key. To authenticate itself to the sender, the
responder decrypts the data using its private key, then sends a hash of
the data back, encrypted using the symmetric key negotiated for the IKE
SA. The reciprocal process is used by the responder to authenticate the
identity of the initiator.