V2

S1: the associated data is the canonical initiation transcript (domain, sender and recipient address, both identity keys, the whole ephemeral key, both prekey IDs), so every header field and both addresses are authenticated, and the initiation ID is derived from exactly those bytes.