static vs dynamic vs challenge response

Question

I am taking a security class. The slides say that smartcards usually use one of three types of authentication protocols: static, dynamic and challenge response. What is the difference between these?

Answer 1

Warning: the terminology is a bit fuzzy, so there cannot be a completely authoritative and clear-cut answer.

A static authentication protocol means that the device which does the authentication does not compute anything. If embeds some secret value but can, at best, show it. The human user, when he types his password in a login page or interface, is a static authentication device. The smallest, dumbest, cheapest kind of smartcard does the same: after having been duly unlocked (users typed his PIN code), the card spouts a secret value always the same.

A dynamic authentication protocol is the opposite: the device computes things. There are many types and sub-types of dynamic authentication protocols:

• The protocol can be a challenge-response: the system which runs the authentication submits a challenge, e.g. a random sequence of bytes, to which the device responds by computing a cryptographic function which uses both the challenge and a secret data contained in the device. The cryptographic function can be, for instance, a MAC which the device computes over the challenge, with the secret as key; the authenticating system will verify that MAC (this scenario assumes that the secret value is known to both the smartcard and the authenticating system). Another kind of challenge-response is based on digital signatures: this requires heavier computations (hence a less cheap smart card) but means that the authenticating server needs not know the secret value which is embedded in the smart card.

• Some cards generate one-time passwords. This can be viewed as a challenge-response protocol in which the challenge is not sent by the server, but is a publicly known everchanging value (e.g. a counter, as in HOTP, or the current time, as in TOTP). RSA SecurID tokens are of that type. Devices which use that kind of protocol must maintain some permanent state which resists resets (e.g. a battery-powered internal clock, or a counter value stored in EEPROM); but they are easier to integrate into existing systems (as with RSA SecurID tokens, the user just has to type what is displayed on his token; he does not have to plug the token in his desktop machine).

Answer 2

NIST Publication 800-12 explains

There are many possible protocols a smart token can use for authentication. In general, they can be divided into three categories: static password exchange, dynamic password generators, and challenge-response.

Static tokens work similarly to memory tokens, except that the users authenticate themselves to the token and then the token authenticates the user to the computer.

A token that uses a dynamic password generator protocol creates a unique value, for example, an eight-digit number, that changes periodically (e.g., every minute). If the token has a manual interface, the user simply reads the current value and then types it into the computer system for authentication. If the token has an electronic interface, the transfer is done automatically. If the correct value is provided, the log-in is permitted, and the user is granted access to the system.

Tokens that use a challenge-response protocol work by having the computer generate a challenge, such as a random string of numbers. The smart token then generates a response based on the challenge. This is sent back to the computer, which authenticates the user based on the response. The challenge-response protocol is based on cryptography. Challenge-response tokens can use either electronic or manual interfaces.

Answer 3

A good example of Challenge-Response Password Token is shown on the diagram below taken from Gemalto's Gold OTP authenticator page: