Is it possible to have a secure challenge/response authentication protocol, authenticated immediately?
Too slow: a client request -> server challenge -> client response -> server response
Fast enough: client request -> server response
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
No. By sending a response to the request, you are not challenging the client, making it a different kind of authentication scheme.
The method you describe doesn't provide a challenge. There can be credentials provided such as a username/password pair, but it doesn't challenge the client to provide anything beyond what what it has already provided.
Let's take a look at an old example of challenge/response:
mappu sends me an email. Before my server accepts it at face value, it provides a challenge back to
mappu. That is where
mappu has the opportunity to confirm his identity and allow the email to be sent to my mailbox. Without that challenge, it is no longer a challenge authentication.
These proposals are based around the client generating both the challenge nonce and the challenge response. They all have downsides.
Client generates random challenge nonces. The server has to cache them to prevent replay attacks.
Client generates random challenge nonces along with a timestamp parameter. The server ensures the timestamp is recent and can expire sufficiently-old challenges from its cache.
Client generates monotonically-increasing challenge nonces. The server keeps track of only the last challenge, and enforces that lower-valued nonces are not accepted. It prevents relay attacks despite storing only a single value.