The only true way to authenticate is if two parties know who they should be talking to prior to initiating the conversation. Then, both parties can sign all communications between them with their "private key" to ensure they are who they say they are. Other schemes have been produced which attempt to get around knowing anything about someone else before communicating, but they are all able to be cracked in one way or another. The most secure way to set it up would be to store all user public keys, and have all users store the server public key. Then, each user communicates by hashing the message, signing the hash, creating a symmetrical key, encrypting the sym key with the other party's public key, then encrypting the message with the symmetrical key, and sending the information to the other party. Jeff