How can I authenticate a client connection in a secure way?
Let's say I have a server listening on port 1234.  I have some client software that needs to be able to connect to this port.  But I want to prevent malicious users from bypassing the client software and connecting to the port by some other means (such as in a console or another piece of software).  

The trusted client software and the server may share a secret key, if necessary.  I'd prefer not to send such a key in plaintext, but data after the authentication can be in plaintext. Specifically, I'm trying to figure out how to defeat a man-in-the-middle attack where the malicious user is using the trusted client software to calculate correct responses to server challenges.

Can I get there from here?

I could have the server's listening port bind only to localhost and require that clients first gain access to the machine via ssh.  Then the client software could use an ssh library to run a command on the server that connects to the local port (in this scenario, the malicious user would be unable to use ssh to access the machine because he would not have the password).  But then all my traffic is encrypted, which is additional overhead.  Perhaps there is a program similar to ssh that only does the authentication but then leaves the channel in plaintext after that?

How can I authenticate a client connection in a secure way?
===

Let's say I have a server listening on port 1234.  I have some client software that needs to be able to connect to this port.  But I want to prevent malicious users from bypassing the client software and connecting to the port by some other means (such as in a console or another piece of software).  

The trusted client software and the server may share a secret key, if necessary.  I'd prefer not to send such a key in plaintext, but data after the authentication can be in plaintext. Specifically, I'm trying to figure out how to defeat a man-in-the-middle attack where the malicious user is using the trusted client software to calculate correct responses to server challenges.

Can I get there from here?

I could have the server's listening port bind only to localhost and require that clients first gain access to the machine via ssh.  Then the client software could use an ssh library to run a command on the server that connects to the local port (in this scenario, the malicious user would be unable to use ssh to access the machine because he would not have the password).  But then all my traffic is encrypted, which is additional overhead.  Perhaps there is a program similar to ssh that only does the authentication but then leaves the channel in plaintext after that?
