KRB_AP_REP question

[matt]

greetings,

my understanding is that the KRB_AP_REP is returned by the host when
mutual authentication is requested by the client.  as part of the
client authenticator, it can choose to provide (among others)
checksum, seq_no, subkey.  however, in the KRB_AP_REP message, only
seq_no and subkey are returned (negotiated).  how come the host side
checksum is omitted?  what if the client wants to validate the
server's response payload?

thanks.