How do two parties put together the AUTH data in the SKEME protocol? SKEME is a Key Exchange protocol used in the Internet Key Exchange (IKE).  It contains three phases:  SHARE, EXCH, and AUTH -- these are defined in Section 3.2 of the linked SKEME document.  

I am trying to understand a confusing part (to me at least) about the AUTH phase of SKEME. There is a bit of background to cover before I can get to my actual question, please bear with me...


SHARE



  Phase SHARE is intended to establish a key $K_0$
  between $A$ and $B$
  
  In SHARE the parties exchange "half-keys" encrypted
  under each other's public key and then combine
  the half-keys via a hash function to produce $K_0$


But this whole phase is skipped if the two parties instead use a Pre-Shared-Key instead of Public Keys. This is defined here:


  3.3.2 Pre-shared key and PFS
  
  In this mode, the protocol assumes that the parties already share a
  secret key, and that they use this key in order to derive a new and
  fresh key
  
  In this mode of SKEME the SHARE phase can be skipped and the
  pre-shared key used as $K_0$


This is the mode of SKEME that I am concerned with, so we take it at face value that $A$ and $B$ have Pre-Shared-Key $K_0$


EXCH



  The next phase, EXCH, is used to exchange Diffie-Hellman exponents.
  Notice that this phase is independent of SHARE.
  
  EXCH:  
  $A$ --> $B$: $g^x$ $mod$ $p$ 
  $B$ --> $A$: $g^y$ $mod$ $p$


Standard Diffie-Hellman exchange, nothing too complicated here. Both parties now have the DH shared secret.


AUTH



  The authentication of this Diffie-Hellman exchange is accomplished in
  the following phase, AUTH, which uses the shared key $K_0$ from SHARE to
  authenticate the Diffie-Hellman exponents.
  
  AUTH: 
  $A$ --> $B$: $F_{K_0}$ ($g^y$; $g^x$; $id_A$; $id_B$) 
  $B$ --> $A$: $F_{K_0}$ ($g^x$; $g^y$; $id_B$; $id_A$)
  
  Notice that the key $K_0$ shared in the SHARE phase can be known only to
  A and B ... 
  The inclusion of $g^x$ in the first message serves to authenticate (to $B$)
  that $g^x$ came from $A$; the value $g^y$ in the same message is used to prove
  to $B$ the freshness of this message (assuming $g^y$ was freshly chosen by
  $B$);


And this is where I get confused.

I know $A$ put calculated $g^x$, and can understand how $A$ knows this value. But from what I understand, $B$ calculated $g^y$, and only shared $g^y$ $mod$ $p$.  

Therefore, how does $A$ know $g^y$ to include in the formula above? Similarly, how does $B$ know $g^x$ to calculate the same $F_{K_0}$ to validate the value provided by $A$?
how does $A$ know $g^y$ to include in the formula above?


Actually, what they mean here is, in fact, $g^y \bmod p$; that is, the value that $A$ received.  It wouldn't work to insert the literal values $g^x$ and $g^y$; apart from the fact that $A$ doesn't know the second one, there's also the practical difficulty that since $x$ and $y$ are (perhaps) 256 bit random values, the bit representation of $g^x$ and $g^y$ may consist of circa $2^{256}$ bits in length; rather too long to process.

In general, when the group we're working in is understood, we often write $g^y$, with the fact that we're talking about operations in the group, and not as an integer, being implied.