I'm developing a system where mobile applications communicate with server through HTTPS. The communication consists of two phases: at first, app "registers" at server: among other stuff, user chooses his PIN and it's being sent to server and stored there. Let's for now assume that this phase is secure and all information has been exchanged securely and no information was leaked.
The second phase of communication begins after the registration. App sends requests to server, and with each request user is requested to enter PIN which is added to the request in order to authenticate the user (it's actually just one of authentication steps as we also use client cert authentication). My question is as follows: is it possible to prevent this PIN from being exposed in case of an attacker being able to decrypt our HTTPS communication? Most solutions seem to fail because the attacker is able to enumerate PINs as they are usually about 4-6 characters long (for example passing through a hash of PIN fails because of this).
We can exchange some additional data in registration phase, as needed.