Questions tagged [challenge-response]
The challenge-response tag has no usage guidance.
39
questions
0
votes
0
answers
48
views
ow do I move password securely between api and web?
I would like to ask how I should go about securely transmitting the password between two applications. I have two projects that work with each other. The first one is a project called AuthApi, which ...
- 1
1
vote
1
answer
148
views
Is SCRAM secure if both the communication channel and the database got compromised?
I was learning about SCRAM and liked its ability to protect against various attacks (as mentioned in this MongoDB blog post), specifically:
Eavesdropping - The attacker can read all traffic exchanged ...
- 13
1
vote
2
answers
970
views
Is the Seed-And-Key Challenge-Response used in Automotive Security really secure?
As an Automotive Security Professional, my state of the art approach to implement a Secure Access would be to have an ECU generate a challenge (nonce + ID), forward it to the tester who can pass the ...
- 3,026
0
votes
0
answers
691
views
How does Nessus offline registration work?
To use the free trial of Nessus, you need an email address to receive an activation key.
There are two modes to activate a Nessus server:
Online mode registration
If the computer running Nessus ...
- 173
1
vote
0
answers
98
views
Problems understanding the use of Distance Bounding against Man-In-The-Middle attacks
I currently have to write a paper for university in my Network Security lecture about methods of secure location verification. Therefore, I chose to write about several distance bounding protocols, e....
- 111
0
votes
1
answer
654
views
Challenge-Response authentication and SSL
I'm currently developing an Android Application that communicates with a server and needs the user to login.
The connection is secured with SSL and certificate pinning.
For user authentication I'm ...
0
votes
1
answer
248
views
Is this Wikipedia article about SCRAM wrong?
At my Company, we put a honeypot in our network and it raised us the Lansweeper SSH password used to connect to the scanned assets (and it is reusable over many boxes...).
So it is a way for an ...
- 1,328
0
votes
1
answer
475
views
How to implement challenge-response with keyed hash algorithm when 2 people share same key?
Suppose that 2 people have a keyed hash algorithm (that is, a MAC) with a key that they both know. How could they implement challenge-response using their keyed hash algorithm? This confuses me...
- 63
2
votes
0
answers
290
views
How challenge response password recovery mechanism works with disk encryption?
For the sole purpose of learning, I am trying to figure out how disk encryption software is able to recover password of an encrypted disk using a challenge response mechanism.
Th recovery process ...
- 133
3
votes
2
answers
1k
views
Why does WebAuthn require a challenge when asking the client to register a new credential?
When registering a new credential as part of WebAuthn, why does the client need to be sent a challenge?
Presumably this is to prevent a replay attack, but wouldn't a replay attack be prevented by TLS ...
- 163
5
votes
2
answers
470
views
Which user authentication measures are used nowadays?
I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, ...
- 185
2
votes
1
answer
328
views
Is there a password based challenge response authentication scheme with public key cryptography?
I was thinking about an authentication where
the user only has to know a password
but no salt, everything else the client retrieves from the server
yet a user's password can't be retrieved from the ...
- 21
5
votes
2
answers
10k
views
Which is more secure Yubikey + Keepass using Challenge/Response or Yubikey + Keepass using OTP?
I use a Windows 10 PC and an Android phone with Keepass.
I would like to add a second factor on top of my master password that works with both Windows 10 and my Android phone.
Between the two ...
- 63
0
votes
1
answer
617
views
How to prevent replay attacks without exposing stored password security?
A common way to prevent replay attacks when logging in is for the server to present a challenge (chall) and request a response in the form hash(chall+secret) where the secret is already known by the ...
- 111
1
vote
1
answer
194
views
How to authenticate a specific client program? [duplicate]
I have a server application which provides functions to a client program. The client is also programmed by me. Now I want to authenticate the client program itself (not any user) before using my ...
- 113
5
votes
3
answers
977
views
Given a secure channel, are there any benefits in using SCRAM over a username and password?
Given that a communication over HTTP
uses SSL encryption
uses public key pinning to prevent MiTM attacks
is security in any way elevated by using Salted Challenge Response Authentication Mechanism (...
- 253
0
votes
1
answer
85
views
Algorithms for 2FA over HTTPS?
I'm developing an Authenticator App for use towards my own API. I know about the TOTP standard RFC 6238 and the HOTP variant. Though I would prefer to use a public/private key based solution (by only ...
- 101
3
votes
1
answer
124
views
ESP8266 Dash Button Security
I have built a dash button using ESP8266 microcontroller. The microcontroller should make a response to a ASP.NET WebApi Rest Service to trigger an action. How can i make this api call secure. The ...
- 31
3
votes
2
answers
224
views
Should passwords and challenge questions & answers be migrated?
I am currently working on the migration of a user Identity and Access Management tool from a legacy platform (product + solution) to a new one (same product but upgraded + updated solution)
My team ...
- 131
1
vote
2
answers
296
views
Using PGP to answer account security questions with PKI
Security questions are well known/widely considered to decrease security or otherwise create more problems (e.g., remembering gibberish), but sometimes I am required to have and answer them anyway. ...
- 111
1
vote
1
answer
600
views
Authentication providers for applications with no internet connection
I have an interesting use case where users need to authenticate to applications running in environments that might not have internet access or even access to an authentication server. Administrators ...
- 111
0
votes
1
answer
3k
views
Vulnerability of challenge-response (authentication) protocols to on-line man-in-the-middle attacks
Are all challenge-response (or other authentication) protocols vulnerable to on-line main-in-the-middle attacks?
Let's say Alice wants to setup a connection with Bob (e.g. she wants to login on a ...
- 161
2
votes
1
answer
3k
views
Access-Challenge EAP Request
From my understanding, after the Access-Request, the authentication server (RADIUS) sends a reply (encapsulated in the Access-Challenge packet) to the authenticator (AP).
The Access-Challenge packet ...
- 177
5
votes
5
answers
4k
views
How does SSH client ensure that SSH server bears the private key, which is the pair of the public key in client's "known_hosts" file?
An SSH client obviously authenticates an SSH server in some way. Because when the key of the server changes, the SSH client software gives us a loud warning about the key of the server being changed ...
- 746
1
vote
2
answers
4k
views
Securing authenticity of mifare cards, protection against cloning
I am designing a workflow for issuing and acquiring of voucher cards for a client and the chosen technology for the cards has been mifare desfire.
I have a lot of experience with credit cards and we ...
- 513
1
vote
0
answers
58
views
Offline request re-transmission prevention
I'm trying to do the following:
I have 2 mobile devices, one acts as a server and the second as a client.
The server device holds a secret key and advertises a challenge. Each request causes the ...
- 111
3
votes
1
answer
465
views
Is my client challenge authentication secure?
I have an app installed on customers' machines, a server, and a regular website between the two. In order not to have the customers configure anything (user credentials, proxy settings...), the app ...
- 351
6
votes
1
answer
273
views
Do human challenge-response authentication schemes exist?
As far as I know, challenge-response authentication schemes employ a shared secret (or two halves of a key pair) and an irreversible function which combines the secret and a challenge into a response ...
- 379
1
vote
0
answers
93
views
Should a unique CRA password salt travel the wire?
In an authentication method I am using an auth-framework which runs an implementation of CRA which forwards salt (with key length / iterations), challenge to the client.
With this information the ...
- 111
-1
votes
1
answer
347
views
How PPP with CHAP for Cisco works
I'm learning to configure a simple PPP link with CHAP authentication for two Cisco routers. I'm trying to make sense of how router makes sense of the configuration in this example, as the logic of ...
1
vote
1
answer
725
views
Challenge-Response Application in E-banking
Why is it important that Alice doesn't know K? What could happen if Alice knew K?
- 145
21
votes
3
answers
4k
views
Challenge/response authentication for garage door opener
I'm building an Arduino based radio garage door opener, and in order to protect it from replay attacks I've came up with this algorithm:
sender initiates communication
receiver sends a random 32 bit ...
- 321
3
votes
1
answer
2k
views
Attack Challenge/Response Authentication by requesting challenges
If a client/server application uses a challenge/response pattern for authentication, e.g. SCRAM or alike, it often involves the usage of nonces (client nonce and server nonce) for preventing replay ...
3
votes
2
answers
186
views
Guidelines for password register size in embedded devices
I'm working on an embedded systems project for school in which we need to store a password (or key, whatever). The idea is that this design should eventually be reducible to bare-metal hardware and ...
- 211
-2
votes
1
answer
292
views
Public key encryption for initial challenge-repsonse
I understand public key encryption, public key authentication, how digital signatures work and challenge-response authentication, but what confuses me is when they are all combined, and the question ...
0
votes
2
answers
260
views
Challenge authentication without roundtrip
Is it possible to have a secure challenge/response authentication protocol, authenticated immediately?
Too slow: a client request -> server challenge -> client response -> server response
Fast ...
- 43
2
votes
1
answer
2k
views
How to secure a websocket connection with challenge-response?
TL;DR Given that all of the state information for a web browser is accessible to a (potentially hostile) user, how can challenge-response authentication between the browser and the server be ...
- 349
4
votes
2
answers
2k
views
Protect password/authenticating during transit over (insecure) TCP socket for a game
Background
I am designing a multi-player game with a single server that handles multiple worlds. Each player logs into the server initially before requesting which world to join.
The server has a ...
- 143
2
votes
1
answer
209
views
Security bounds of TLS client authentication (from browsers)
Say that there are two servers that perform TLS. Both servers have valid end-point certificates. In other words, neither of them would raise a warning from the browsers after the connection has been ...
- 4,633