Let's begin by assuming that we're operating in either a corporate or Governmental environment where SSL man-in-the-middle interceptions are a given and that *all* traffic on the network between the client and the server is being intercepted and viewed.
Are there any strong authentication schemes that can validate both the client (to the server) and the server (to the client). Ordinarily this can easily be accomplished by an SSL Certificate authentication scheme. Since these are being actively MITM'd this solution isn't adequate.
Any thoughts on a strong authentication scheme that allows both sides to authenticate each other while preventing replay attacks?
(I'm thinking more along the lines of a web-application versus a desktop application)