There is an idea by jhutz & cg2v to establish session keys using an authenticator in the message body and rely on checksums for subsequent auth.