Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [challenge-response]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
1answer
98 views

Is there a password based challenge response authentication scheme with public key cryptography?

I was thinking about an authentication where the user only has to know a password but no salt, everything else the client retrieves from the server yet a user's password can't be retrieved from the ...
1
vote
2answers
770 views

Which is more secure Yubikey + Keepass using Challenge/Response or Yubikey + Keepass using OTP?

I use a Windows 10 PC and an Android phone with Keepass. I would like to add a second factor on top of my master password that works with both Windows 10 and my Android phone. Between the two ...
0
votes
1answer
124 views

How to prevent replay attacks without exposing stored password security?

A common way to prevent replay attacks when logging in is for the server to present a challenge (chall) and request a response in the form hash(chall+secret) where the secret is already known by the ...
1
vote
1answer
61 views

How to authenticate a specific client program? [duplicate]

I have a server application which provides functions to a client program. The client is also programmed by me. Now I want to authenticate the client program itself (not any user) before using my ...
3
votes
3answers
314 views

Given a secure channel, are there any benefits in using SCRAM over a username and password?

Given that a communication over HTTP uses SSL encryption uses public key pinning to prevent MiTM attacks is security in any way elevated by using Salted Challenge Response Authentication Mechanism (...
0
votes
1answer
39 views

Algorithms for 2FA over HTTPS?

I'm developing an Authenticator App for use towards my own API. I know about the TOTP standard RFC 6238 and the HOTP variant. Though I would prefer to use a public/private key based solution (by only ...
3
votes
1answer
66 views

ESP8266 Dash Button Security

I have built a dash button using ESP8266 microcontroller. The microcontroller should make a response to a ASP.NET WebApi Rest Service to trigger an action. How can i make this api call secure. The ...
3
votes
2answers
132 views

Should passwords and challenge questions & answers be migrated?

I am currently working on the migration of a user Identity and Access Management tool from a legacy platform (product + solution) to a new one (same product but upgraded + updated solution) My team ...
1
vote
2answers
148 views

Using PGP to answer account security questions with PKI

Security questions are well known/widely considered to decrease security or otherwise create more problems (e.g., remembering gibberish), but sometimes I am required to have and answer them anyway. ...
1
vote
1answer
147 views

Authentication providers for applications with no internet connection

I have an interesting use case where users need to authenticate to applications running in environments that might not have internet access or even access to an authentication server. Administrators ...
0
votes
1answer
1k views

Vulnerability of challenge-response (authentication) protocols to on-line man-in-the-middle attacks

Are all challenge-response (or other authentication) protocols vulnerable to on-line main-in-the-middle attacks? Let's say Alice wants to setup a connection with Bob (e.g. she wants to login on a ...
2
votes
1answer
1k views

Access-Challenge EAP Request

From my understanding, after the Access-Request, the authentication server (RADIUS) sends a reply (encapsulated in the Access-Challenge packet) to the authenticator (AP). The Access-Challenge packet ...
2
votes
5answers
2k views

How does SSH client ensure that SSH server bears the private key, which is the pair of the public key in client's “known_hosts” file?

An SSH client obviously authenticates an SSH server in some way. Because when the key of the server changes, the SSH client software gives us a loud warning about the key of the server being changed ...
1
vote
2answers
2k views

Securing authenticity of mifare cards, protection against cloning

I am designing a workflow for issuing and acquiring of voucher cards for a client and the chosen technology for the cards has been mifare desfire. I have a lot of experience with credit cards and we ...
1
vote
0answers
19 views

Offline request re-transmission prevention

I'm trying to do the following: I have 2 mobile devices, one acts as a server and the second as a client. The server device holds a secret key and advertises a challenge. Each request causes the ...
3
votes
1answer
394 views

Is my client challenge authentication secure?

I have an app installed on customers' machines, a server, and a regular website between the two. In order not to have the customers configure anything (user credentials, proxy settings...), the app ...
5
votes
1answer
151 views

Do human challenge-response authentication schemes exist?

As far as I know, challenge-response authentication schemes employ a shared secret (or two halves of a key pair) and an irreversible function which combines the secret and a challenge into a response ...
1
vote
0answers
30 views

Should a unique CRA password salt travel the wire?

In an authentication method I am using an auth-framework which runs an implementation of CRA which forwards salt (with key length / iterations), challenge to the client. With this information the ...
-1
votes
1answer
200 views

How PPP with CHAP for Cisco works

I'm learning to configure a simple PPP link with CHAP authentication for two Cisco routers. I'm trying to make sense of how router makes sense of the configuration in this example, as the logic of ...
1
vote
1answer
487 views

Challenge-Response Application in E-banking

Why is it important that Alice doesn't know K? What could happen if Alice knew K?
20
votes
2answers
3k views

Challenge/response authentication for garage door opener

I'm building an Arduino based radio garage door opener, and in order to protect it from replay attacks I've came up with this algorithm: sender initiates communication receiver sends a random 32 bit ...
2
votes
1answer
966 views

Attack Challenge/Response Authentication by requesting challenges

If a client/server application uses a challenge/response pattern for authentication, e.g. SCRAM or alike, it often involves the usage of nonces (client nonce and server nonce) for preventing replay ...
3
votes
2answers
82 views

Guidelines for password register size in embedded devices

I'm working on an embedded systems project for school in which we need to store a password (or key, whatever). The idea is that this design should eventually be reducible to bare-metal hardware and ...
-2
votes
1answer
174 views

Public key encryption for initial challenge-repsonse

I understand public key encryption, public key authentication, how digital signatures work and challenge-response authentication, but what confuses me is when they are all combined, and the question ...
0
votes
2answers
159 views

Challenge authentication without roundtrip

Is it possible to have a secure challenge/response authentication protocol, authenticated immediately? Too slow: a client request -> server challenge -> client response -> server response Fast ...
2
votes
1answer
1k views

How to secure a websocket connection with challenge-response?

TL;DR Given that all of the state information for a web browser is accessible to a (potentially hostile) user, how can challenge-response authentication between the browser and the server be ...
4
votes
2answers
616 views

Protect password/authenticating during transit over (insecure) TCP socket for a game

Background I am designing a multi-player game with a single server that handles multiple worlds. Each player logs into the server initially before requesting which world to join. The server has a ...
2
votes
1answer
117 views

Security bounds of TLS client authentication (from browsers)

Say that there are two servers that perform TLS. Both servers have valid end-point certificates. In other words, neither of them would raise a warning from the browsers after the connection has been ...