3.2.5 Message Processing Events and Sequencing Rules
The server-side processing of messages can happen in response to two different messages from the client:
The server receives a NEGOTIATE_MESSAGE (section 2.2.1.1) from the client (the server responds with a CHALLENGE_MESSAGE (section 2.2.1.2)).
The server receives an AUTHENTICATE_MESSAGE (section 2.2.1.3) from the client (the server verifies the client's authentication information that is embedded in the message).