# Is this authentication system insecure or not

So I want to create a simple, fast and yet secure authentication in two steps for a PC - microcontroller communication.

The first step is a seed request, the second step is an authentication request.

The encryption that is being used is AES-128.

There should be a fixed key k with a length of 16 bytes.

Whenever a seed request is coming a random 16 bytes authentication message m should be generated and then be encrypted with k and sent back to the client as a seed s.

(NOTE: E(k, m) will always output the same s)

The seed s then should be decrypted with k by the client and then the original authentication message m should be sent to the server as an authentication request.

The server compares the auth message m with the message of the request, and grants access if they are equal or rejects the request otherwise.

Also assume that an adversary can collect as many m and s pairs as he wants.

Based on the information above is it feasible to easily break this system or not?

• Authentication is nice, but what are you going to do afterwards? How do you know that you are communicating with the right party? Don't you need to establish a secret? Or dual authentication? PS removed previous answer, shouldn't be answering in the morning. – Maarten Bodewes Mar 18 '17 at 12:25
• Consider it as a one to one communication, and after a successful auth you can access higher level functions of the controller, like modifying expert parameters and so on. – Szabolcs Mar 18 '17 at 12:46

• I don't think replay attack is an efficient approach here, because there are 2^128 (s, m) pairs. So the probability you get a seed that was already sent before is really low. – Szabolcs Mar 18 '17 at 12:20
No. This authentication scheme is secure. What this means is that when the protocol is done (server checks m = m'), the server can be sure that—some time before—an authentication request has been done by a party that knows k.
• Excuse me but what happens if the attacker intercepts the message $m'$ and forward it ? How can I make this scheme secure over the "Internet"? – thinker.92 May 27 at 16:12