Can you tell me how can you do security, challenger, mutual authentication before you send the encrypt APDU with INS 21 ( verify)