Before explaining my question, please let me introduce the scenario:

• There are 2 type of actors: 1 server and N clients
• Each actor has a RSA 2048 bit private/public key
• The server knows all the clients public keys
• The clients know the public key of the server

The desired goals are the following:

• Clients must authenticate themselves to the server
• Integrity must be guaranteed for all exchanged messages
• Secrecy is a plus but not mandatory

A solution that came to my mind is to share a secret between all server-client pairs and then proceed by sending the messages concatenated to the MAC

Server ---- M | MAC(M) ----> Client
Client <--- M | MAC(M) ----- Server

Then on top of this, a challenge-response protocol is used to guarantee the authenticity of the clients.

However by searching on-line I was not able to find a "standard" way to generate a shared secret using RSA. I was only able to find DH or ECC protocols for this.

There is a well defined scheme based on RSA to obtain a shared secret or the aforementioned goals?

Thank you