Questions tagged [challenge-response]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
53 views

Is the Seed-And-Key Challenge-Response used in Automotive Security really secure?

As an Automotive Security Professional, my state of the art approach to implement a Secure Access would be to have an ECU generate a challenge (nonce + ID), forward it to the tester who can pass the ...
user avatar
  • 3,006
1 vote
0 answers
201 views

How to decrypt a KeePass database using YubiKey Challenge-Response, but without token?

Imagine the following situation: You created a KeepassXC database and secured it with a strong passphrase, as well as the HMAC-SHA1 based Challenge-Response mechanism provided by a YubiKey. The secret ...
user avatar
0 votes
0 answers
170 views

How does Nessus offline registration work?

To use the free trial of Nessus, you need an email address to receive an activation key. There are two modes to activate a Nessus server: Online mode registration If the computer running Nessus ...
user avatar
  • 173
1 vote
0 answers
87 views

Problems understanding the use of Distance Bounding against Man-In-The-Middle attacks

I currently have to write a paper for university in my Network Security lecture about methods of secure location verification. Therefore, I chose to write about several distance bounding protocols, e....
user avatar
  • 111
0 votes
1 answer
382 views

Challenge-Response authentication and SSL

I'm currently developing an Android Application that communicates with a server and needs the user to login. The connection is secured with SSL and certificate pinning. For user authentication I'm ...
user avatar
0 votes
1 answer
197 views

Is this Wikipedia article about SCRAM wrong?

At my Company, we put a honeypot in our network and it raised us the Lansweeper SSH password used to connect to the scanned assets (and it is reusable over many boxes...). So it is a way for an ...
user avatar
  • 1,316
0 votes
1 answer
293 views

How to implement challenge-response with keyed hash algorithm when 2 people share same key?

Suppose that 2 people have a keyed hash algorithm (that is, a MAC) with a key that they both know. How could they implement challenge-response using their keyed hash algorithm? This confuses me...
user avatar
  • 63
2 votes
0 answers
196 views

How challenge response password recovery mechanism works with disk encryption?

For the sole purpose of learning, I am trying to figure out how disk encryption software is able to recover password of an encrypted disk using a challenge response mechanism. Th recovery process ...
user avatar
  • 133
3 votes
2 answers
476 views

Why does WebAuthn require a challenge when asking the client to register a new credential?

When registering a new credential as part of WebAuthn, why does the client need to be sent a challenge? Presumably this is to prevent a replay attack, but wouldn't a replay attack be prevented by TLS ...
user avatar
5 votes
2 answers
443 views

Which user authentication measures are used nowadays?

I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, ...
user avatar
2 votes
1 answer
306 views

Is there a password based challenge response authentication scheme with public key cryptography?

I was thinking about an authentication where the user only has to know a password but no salt, everything else the client retrieves from the server yet a user's password can't be retrieved from the ...
user avatar
  • 21
5 votes
2 answers
8k views

Which is more secure Yubikey + Keepass using Challenge/Response or Yubikey + Keepass using OTP?

I use a Windows 10 PC and an Android phone with Keepass. I would like to add a second factor on top of my master password that works with both Windows 10 and my Android phone. Between the two ...
user avatar
0 votes
1 answer
433 views

How to prevent replay attacks without exposing stored password security?

A common way to prevent replay attacks when logging in is for the server to present a challenge (chall) and request a response in the form hash(chall+secret) where the secret is already known by the ...
user avatar
  • 111
1 vote
1 answer
149 views

How to authenticate a specific client program? [duplicate]

I have a server application which provides functions to a client program. The client is also programmed by me. Now I want to authenticate the client program itself (not any user) before using my ...
user avatar
  • 113
5 votes
3 answers
734 views

Given a secure channel, are there any benefits in using SCRAM over a username and password?

Given that a communication over HTTP uses SSL encryption uses public key pinning to prevent MiTM attacks is security in any way elevated by using Salted Challenge Response Authentication Mechanism (...
user avatar
  • 253
0 votes
1 answer
80 views

Algorithms for 2FA over HTTPS?

I'm developing an Authenticator App for use towards my own API. I know about the TOTP standard RFC 6238 and the HOTP variant. Though I would prefer to use a public/private key based solution (by only ...
user avatar
3 votes
1 answer
112 views

ESP8266 Dash Button Security

I have built a dash button using ESP8266 microcontroller. The microcontroller should make a response to a ASP.NET WebApi Rest Service to trigger an action. How can i make this api call secure. The ...
user avatar
  • 31
3 votes
2 answers
200 views

Should passwords and challenge questions & answers be migrated?

I am currently working on the migration of a user Identity and Access Management tool from a legacy platform (product + solution) to a new one (same product but upgraded + updated solution) My team ...
user avatar
1 vote
2 answers
254 views

Using PGP to answer account security questions with PKI

Security questions are well known/widely considered to decrease security or otherwise create more problems (e.g., remembering gibberish), but sometimes I am required to have and answer them anyway. ...
user avatar
1 vote
1 answer
365 views

Authentication providers for applications with no internet connection

I have an interesting use case where users need to authenticate to applications running in environments that might not have internet access or even access to an authentication server. Administrators ...
user avatar
0 votes
1 answer
2k views

Vulnerability of challenge-response (authentication) protocols to on-line man-in-the-middle attacks

Are all challenge-response (or other authentication) protocols vulnerable to on-line main-in-the-middle attacks? Let's say Alice wants to setup a connection with Bob (e.g. she wants to login on a ...
user avatar
2 votes
1 answer
2k views

Access-Challenge EAP Request

From my understanding, after the Access-Request, the authentication server (RADIUS) sends a reply (encapsulated in the Access-Challenge packet) to the authenticator (AP). The Access-Challenge packet ...
user avatar
5 votes
5 answers
3k views

How does SSH client ensure that SSH server bears the private key, which is the pair of the public key in client's "known_hosts" file?

An SSH client obviously authenticates an SSH server in some way. Because when the key of the server changes, the SSH client software gives us a loud warning about the key of the server being changed ...
user avatar
  • 714
1 vote
2 answers
3k views

Securing authenticity of mifare cards, protection against cloning

I am designing a workflow for issuing and acquiring of voucher cards for a client and the chosen technology for the cards has been mifare desfire. I have a lot of experience with credit cards and we ...
user avatar
  • 503
1 vote
0 answers
53 views

Offline request re-transmission prevention

I'm trying to do the following: I have 2 mobile devices, one acts as a server and the second as a client. The server device holds a secret key and advertises a challenge. Each request causes the ...
user avatar
  • 111
3 votes
1 answer
460 views

Is my client challenge authentication secure?

I have an app installed on customers' machines, a server, and a regular website between the two. In order not to have the customers configure anything (user credentials, proxy settings...), the app ...
user avatar
  • 351
5 votes
1 answer
226 views

Do human challenge-response authentication schemes exist?

As far as I know, challenge-response authentication schemes employ a shared secret (or two halves of a key pair) and an irreversible function which combines the secret and a challenge into a response ...
user avatar
  • 369
1 vote
0 answers
88 views

Should a unique CRA password salt travel the wire?

In an authentication method I am using an auth-framework which runs an implementation of CRA which forwards salt (with key length / iterations), challenge to the client. With this information the ...
user avatar
-1 votes
1 answer
307 views

How PPP with CHAP for Cisco works

I'm learning to configure a simple PPP link with CHAP authentication for two Cisco routers. I'm trying to make sense of how router makes sense of the configuration in this example, as the logic of ...
user avatar
1 vote
1 answer
655 views

Challenge-Response Application in E-banking

Why is it important that Alice doesn't know K? What could happen if Alice knew K?
user avatar
  • 125
21 votes
3 answers
4k views

Challenge/response authentication for garage door opener

I'm building an Arduino based radio garage door opener, and in order to protect it from replay attacks I've came up with this algorithm: sender initiates communication receiver sends a random 32 bit ...
user avatar
2 votes
1 answer
1k views

Attack Challenge/Response Authentication by requesting challenges

If a client/server application uses a challenge/response pattern for authentication, e.g. SCRAM or alike, it often involves the usage of nonces (client nonce and server nonce) for preventing replay ...
user avatar
3 votes
2 answers
135 views

Guidelines for password register size in embedded devices

I'm working on an embedded systems project for school in which we need to store a password (or key, whatever). The idea is that this design should eventually be reducible to bare-metal hardware and ...
user avatar
-2 votes
1 answer
263 views

Public key encryption for initial challenge-repsonse

I understand public key encryption, public key authentication, how digital signatures work and challenge-response authentication, but what confuses me is when they are all combined, and the question ...
user avatar
0 votes
2 answers
233 views

Challenge authentication without roundtrip

Is it possible to have a secure challenge/response authentication protocol, authenticated immediately? Too slow: a client request -> server challenge -> client response -> server response Fast ...
user avatar
  • 43
2 votes
1 answer
2k views

How to secure a websocket connection with challenge-response?

TL;DR Given that all of the state information for a web browser is accessible to a (potentially hostile) user, how can challenge-response authentication between the browser and the server be ...
user avatar
  • 349
4 votes
2 answers
1k views

Protect password/authenticating during transit over (insecure) TCP socket for a game

Background I am designing a multi-player game with a single server that handles multiple worlds. Each player logs into the server initially before requesting which world to join. The server has a ...
user avatar
2 votes
1 answer
190 views

Security bounds of TLS client authentication (from browsers)

Say that there are two servers that perform TLS. Both servers have valid end-point certificates. In other words, neither of them would raise a warning from the browsers after the connection has been ...
user avatar