Authentication challenge
An authentication challenge is a fresh, unpredictable verifier-provided value that binds a response to a specific authentication exchange.
Software Security for Developers
An authentication challenge is a fresh, unpredictable value supplied during an authentication ceremony to bind the response to that specific ceremony and demonstrate possession of a credential.
- How it is used
- Binds a WebAuthn authentication response to one login ceremony and demonstrates possession of the registered credential.
- How deep it goes
- Explains generation, storage, signing, and verification, but stops short of a production-ready implementation and persistent storage design.
- Examples
- Uses a 32-byte SecureRandom value, Java challenge and authentication endpoints, and a simulated JavaScript/WebAuthn exercise.
- What you can do after
- Build it from scratch by generating a challenge, requesting a signed response, and verifying it against the registered public key.
Read how Software Security for Developers explains authentication challenge →
Real-World Cryptography
A challenge is verifier-generated randomness sent to a prover to constrain the prover's response in an interactive proof.
- How it is used
- Constrains prover responses in interactive zero-knowledge identification protocols.
- How deep it goes
- Explains commitment, random challenge, and response steps, but stops short of formal proof details.
- Examples
- Uses Peggy, Victor, random values k and c, response s, and the Schnorr identification protocol.
- What you can do after
- Evaluate how verifier randomness prevents a prover from adapting a response after seeing the verification target.
Read how Real-World Cryptography explains authentication challenge →
Related concepts
- protocoluses · A protocol is a defined set of rules and conventions governing communication or interaction among systems, components, or participants.
- cryptographic primitiveuses · A cryptographic primitive is a fundamental algorithmic building block that provides a basic security function such as encryption, hashing, or digital signing.
- WebAuthnused by · WebAuthn is a web authentication standard and browser API that enables public-key authentication using credentials managed by platform or external authenticators.
- sigma protocolpart of · A sigma protocol is an interactive proof pattern consisting of a prover commitment, a verifier challenge, and a prover response.
- authentication flowpart of · An authentication flow is an ordered sequence of interactions through which a system verifies an entity’s identity and establishes authenticated access.
- replay attackaddresses · A replay attack is an attack in which previously captured valid messages, requests, or authentication data are retransmitted to produce an unauthorized effect.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.