Authentication of users is important to ensure protection against 'man in the middle' attacks. Loki uses Pre-Shared Key authentication where users have multiple options for the establishment of a PSK. They can establish a key out of band, or alternatively, they can agree on a PSK over Loki by asking the other a question which no third-party would know the answer.