The password element is a required child of the authentication element. It is used in combination with the user element to authenticate that the message is from a valid source.
The user element is a required child of the authentication element. It is a unique identifier of the user/merchant used to authenticate that the message is from a valid source.