Authentication Permissions

I'm fairly certain that I understand the difference between the AUTHENTICATE SERVER and AUTHENTICATE permission, but I'm not positive.

For these purposes, I'm leaving off the authorization portion as well as assuming a TSQL endpoint.

My understanding:
The authentication process is broken into two stages - connection and authentication. In order to successfully authenticate to an instance, the following must apply:
1. I must have CONNECT SQL permission
2. I must have CONNECT permission on the endpoint that I am using
3. The endpoint that I am using must be in a STARTED state
4. The login that I am using must be enabled

Once the connection is established, I need AUTHENTICATE SERVER permission in order to authenticate to the instance. (Or do I simply need AUTHENTICATE permission?????)