Mutual authentication or two-way authentication (not to be confused with two-factor authentication) refers to two parties authenticating each other at the same time in an authentication protocol. It is a default mode of authentication in some protocols (IKE, SSH) and optional in others (TLS). Mutual authentication is a desired characteristic in verification schemes that transmit sensitive data, in order to ensure data security. Mutual authentication can be accomplished with two types of credentials: usernames and passwords, and public key certificates. Mutual authentication is often employed in the Internet of Things (IoT). Writing effective security schemes in IoT systems can become challenging, especially when schemes are desired to be lightweight and have low computational costs. Mutual authentication is a crucial security step that can defend against many adversarial attacks, which otherwise can have large consequences if IoT systems (such as e-Healthcare servers) are hacked. In scheme analyses done of past works, a lack of mutual authentication had been considered a weakness in data transmission schemes. Process steps and verification Schemes that have a mutual authentication step may use different methods of encryption, communication, and verification, but they all share one thing in common: each entity involved in the communication is verified. If Alice wants to communicate with Bob, they will both authenticate the other and verify that it is who they are expecting to communicate with before any data or messages are transmitted. A mutual authentication process that exchanges user IDs may be implemented as follows: Alice sends an encrypted message to Bob to show that Alice is a valid user. Bob verifies message: Bob checks the format and timestamp. If either is incorrect or invalid, the session is aborted. The message is then decrypted with Bob's secret key, giving Alice's ID. Bob checks if the message matches a valid user. If not, the session is aborted. Bob sends Alice a message back to show that Bob is a valid user. Alice verifies the message: Alice checks the format and timestamp. If either is incorrect or invalid, the session is aborted. Then, the message is decrypted with Alice's secret key, giving Bob's ID. Alice checks if the message matches a valid user. If not, the session is aborted. At this point, both parties are verified to be who they claim to be and safe for the other to communicate with. Lastly, Alice and Bob will create a shared secret key so