Concept - Challenge-Response

Authentication over a network is more complex: eavesdropping and replay are the problems; generally use challenge-response (s.26).

Steps (s.26-27)

1. User sends identity ($U$).
2. Host responds with a random number $r$ (and the functions $h()$, $f()$).
3. User computes $f(r,h(P))$ and sends it back.
4. Host compares with its own computed value; if they match, the user is authenticated (yes/no).

Check on the host: $f(r^{\prime },h(P^{\prime }))=f(r,h(P(U)))$ (s.27). The same approach works for token and biometric verification (s.27). It protects against a number of attacks, notably replay (s.31). Smartcards can use challenge-response too (s.23).

Why it works: $r$ is fresh each time, so a captured response is useless later.

Added context

The explanation “fresh r makes old responses useless” is the reasoning behind the slide’s claim that it counters replay (s.31).

Related: Concept - Authentication Security Issues, Concept - Memory Card and Smartcard. Appears in 03 User Authentication - Chunk 01 (s.1-33).