I have been reading about the Challenge-Handshake authentication Protocol (aka CHAP).

Why send a challenge to the user and ask them to hash that challenge with the symmetric key and send that hash back to the server? Why not just ask for a hash value of a symmetric key? And what is the point of this protocol at all when you both have symmetric keys?

  • $\begingroup$ suggested an edit - if that is not the protocol you're referring to can you update your post to clarify what is. $\endgroup$ – Cryptographeur Nov 18 '13 at 17:26

The Wikipedia article points out a good reason for using a random challenge value: preventing replay attacks.

If the hash was always the same (as the hash of the symmetric key would be), then having listened in on one challenge-response cycle, a malicious listener could pass further handshake tests.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.