Typically, when considering both EAP and GSS-API channel binding, people think of channel binding in combination with mutual authentication. This is sufficiently common that, without additional qualification, channel binding should be assumed to imply mutual authentication. In GSS-API, without mutual authentication, only the acceptor has authenticated the initiator. Similarly, in EAP, only the EAP server has authenticated the peer. Sometimes, one-way authentication is useful. Consider, for example, a user who wishes to access a protected resource for a shared whiteboard in a conference room. The whiteboard is the acceptor; it knows that the initiator is authorized to give it a presentation, and the user can validate that the whiteboard got the correct presentation by visual means. (The presentation should not be confidential in this case.) If channel binding is used without mutual authentication, it is effectively a request to disclose the resource in the context of a particular channel. Such an authentication would be similar in concept to a holder-of-key SAML Assertion. However, note also that although it is not happening in the protocol, mutual authentication is happening in the overall system: the user is able to visually authenticate the content. This is consistent with all uses of channel binding without protocol-level mutual authentication found so far.