Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I have been reading about the Challenge-Handshake authentication Protocol (aka CHAP).

Why send a challenge to the user and ask them to hash that challenge with the symmetric key and send that hash back to the server? Why not just ask for a hash value of a symmetric key? And what is the point of this protocol at all when you both have symmetric keys?

share|improve this question
    
suggested an edit - if that is not the protocol you're referring to can you update your post to clarify what is. –  figlesquidge Nov 18 '13 at 17:26
add comment

1 Answer 1

up vote 3 down vote accepted

The Wikipedia article points out a good reason for using a random challenge value: preventing replay attacks.

If the hash was always the same (as the hash of the symmetric key would be), then having listened in on one challenge-response cycle, a malicious listener could pass further handshake tests.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.