Challenge-response authentication

As explained in Authorization in Action

Challenge-response authentication is a technique or protocol that verifies identity by requiring a claimant to produce a valid response to a fresh system-provided challenge.

Challenge-response authentication verifies an account claim by requiring a valid response to a fresh system-provided challenge. Unlike a static password, the challenge and response are derived in real time, allowing control of a secret to be proven without revealing it. section 3.6.4

Fresh, nonreusable exchanges make intercepted responses difficult to reuse. This provides resistance to phishing and replay attacks and supports cryptographic protocols, device authentication, and phishing-resistant authentication flows. section 3.10 section 3.6.4

A public-key challenge-response flow can proceed as follows:

• During registration, associate an identifier with a public key stored by the authentication service. section 3.6.4
• At authentication, submit the identifier and receive a distinct challenge. section 3.6.4
• Sign the challenge with the paired private key and return the signature. section 3.6.4
• Verify the signature with the stored public key without exposing the private key. section 3.6.4

Alice authenticates to ACME

Alice first identifies the account she is claiming. The service sends a challenge; her device signs it with the registered private key, and the service checks the signature using the stored public key. A CAPTCHA is another real-time challenge-response example, but it generally establishes that the requester is human rather than proving control of a particular secret. section 3.6 section 3.6.4

Figure 3.8 Challenge–response authentication flow using public-key cryptography. Alice registers by providing an identifier and a public key. At login, the service sends a challenge, which Alice signs with her private key. The service verifies the signature using the stored public key, confirming heridentity without exposing the private key. This method offers strong resistance to phishing and replay attacks.

Diagram of registration, challenge delivery, private-key signing, and public-key verification. section 3.6.4

How Authorization in Action covers it

How deep it goes

Defines the method, contrasts it with passwords, explains replay resistance, and sketches public-key registration and login without detailing protocol variants.

Examples

Uses Alice’s account claim, CAPTCHA, and a public-key signing flow as concrete examples.

What it assumes

Assumes basic identity and authentication concepts while introducing challenge–response within a comparison of authentication methods.

What you can do after

Evaluate phishing- and replay-resistant authentication flows and understand how public-key verification confirms control of a private key.

How it connects

Connects authentication with cryptographic protocols, public-key cryptography, phishing, replay attacks, and authorization.

liveBookmanning.com

Read Authorization in Action on liveBook Get the book at manning.com

Related concepts

• replay attackaddresses · A replay attack is an attack in which previously captured valid messages, requests, or authentication data are retransmitted to produce an unauthorized effect.
• authenticationkind of · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
• public key cryptographyuses · Public-key cryptography is asymmetric cryptography that uses mathematically related public and private keys for encryption, decryption, signing, and verification.

This explainer was generated by Manning's knowledge graph from the text of Authorization in Action. The section links point to the parts of the book it draws on.