I got confused which one is considered challenge-response mechanism which one is not.
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
closed as unclear what you're asking by e-sushi, DrLecter, AFS, Maeher, John Deters Jan 29 '14 at 5:52
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.
For encrypted key exchange you need to add key confirmation to get challenge-response authentication.
These all are password-authenticated key exchange (PAKE) mechanisms. These mechanisms end-up into peers sharing an agreed key, which is only the same if the password agreement was successful.
Challenge-response authentication is usually considered to contain challenge, response and verification of response (authentication). In case of PAKE mechanism, key confirmation protocol is not strictly neccessary, as if the peers do not have compatible keys, the communication cannot successfully continue.
I would consider all of these to be primarily PAKE, because I consider that one as more important security feature than challenge-response authentication. As result of successful key exchange, both sides have a key they know third parties do not have and thus they can use it in further cryptographic operations to ensure confidentiality and authenticity of further communication.
SRP includes check where for keys agreed being the same, therefore, it can be seen as challenge-response authentication.
For DH-EKE, A-EKE, SPEKE, the protocol is concerned with generation of shared key, without third party (who cannot guess the password) being able to get the same key as the result. For authentication purposes (challenge-response authentication), key confirmation shall be added.