I got confused which one is considered challenge-response mechanism which one is not.
3
-
$\begingroup$ Your question doesn't really show much attempted research into the problem, which almost suggests it might be an assignment question. What have you considered about the protocols? Why are you unsure whether they're challenge response or not? $\endgroup$– CryptographeurJan 26, 2014 at 20:54
-
$\begingroup$ I don't believe an assignment question in crypto based on YES/NO answer will be given ever ! $\endgroup$– TareqJan 27, 2014 at 1:00
-
$\begingroup$ I've seen it before, but you're probably right - not with these sorts of examples, sorry $\endgroup$– CryptographeurJan 27, 2014 at 1:01
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
Short: SRP.
For encrypted key exchange you need to add key confirmation to get challenge-response authentication.
These all are password-authenticated key exchange (PAKE) mechanisms. These mechanisms end-up into peers sharing an agreed key, which is only the same if the password agreement was successful.
Challenge-response authentication is usually considered to contain challenge, response and verification of response (authentication). In case of PAKE mechanism, key confirmation protocol is not strictly neccessary, as if the peers do not have compatible keys, the communication cannot successfully continue.
I would consider all of these to be primarily PAKE, because I consider that one as more important security feature than challenge-response authentication. As result of successful key exchange, both sides have a key they know third parties do not have and thus they can use it in further cryptographic operations to ensure confidentiality and authenticity of further communication.
SRP includes check where for keys agreed being the same, therefore, it can be seen as challenge-response authentication.
For DH-EKE, A-EKE, SPEKE, the protocol is concerned with generation of shared key, without third party (who cannot guess the password) being able to get the same key as the result. For authentication purposes (challenge-response authentication), key confirmation shall be added.
