We are creating an app and registration of user happens in following way.
- User sends via app: email-id/phone and username.
- Server sends a pin to enter in app via phone/email.
- User enters the pin in the app.
After this we are thinking of two ways we could store some authentication information on app.
A. Server send a token which used by app with all subsequent requests.
B. We negotiate on a secure key using Diffie–Hellman. Then there is a login function which includes server sending challenge and user answering. After this token is generated, used, and later discarded.
All communication is happening over https. Though option B looks better, option A is easier. Any particular reason we should choose B ? One reason I see is unable to change token, but are there any obvious security risks ?
Also comments to improve A or B are welcome.