Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been reading about the Challenge-Handshake authentication Protocol (aka CHAP).

Why send a challenge to the user and ask them to hash that challenge with the symmetric key and send that hash back to the server? Why not just ask for a hash value of a symmetric key? And what is the point of this protocol at all when you both have symmetric keys?

share|improve this question
suggested an edit - if that is not the protocol you're referring to can you update your post to clarify what is. – figlesquidge Nov 18 '13 at 17:26
up vote 3 down vote accepted

The Wikipedia article points out a good reason for using a random challenge value: preventing replay attacks.

If the hash was always the same (as the hash of the symmetric key would be), then having listened in on one challenge-response cycle, a malicious listener could pass further handshake tests.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.