The S3 protocol (particularly the authentication) is unnecessarily complex and could have used existing simpler choices.