Definition
Challenge-Response Method
A challenge-response method is an authentication protocol in which the server sends a challenge
to the user, who then computes a response by applying a cryptographic operation to using a shared secret. Conceptually similar to a one-time password generator, but the one-time password depends on server-generated data rather than on time alone.
Protocol
Challenge
The authentication server sends a challenge
to the user.
must include a randomly generated component to prevent replay attacks. can partially depend on the operation to be authorised.
Response
The user performs a cryptographic operation on
to compute the response .
- The response is usually computed by an authenticator app installed on the user’s smartphone or PC.
- The ability to compute
proves possession of the required secret or cryptographic key.
Variations
Hash-Based
The response is computed by hashing the challenge together with a shared secret
:
Symmetric Encryption
The response is the encryption of the challenge under a shared secret key
:
Signature-Based
The response is a digital signature on the challenge using the user’s private key
:
Security
Replay Resistance
Because the challenge contains a fresh random component, an attacker who intercepts a previous response cannot reuse it.
Proof of Possession
The response demonstrates that the user holds the secret key, without transmitting the key itself.