Let's say we have a client
(the not trusted party) and the server
(wants to verify that the client is who he claims to be.
The client
has access to both the private key and the public key, whereas the server
only knows the public key.
Question Instead of the server being responsible for generating the challenge, would it be as safe if the the client himself generated a random challenge and later signed it (so that the server could later verify this). Is there a weakness in RSA that would make this scenario bad?
NOTE The public/private key pair will only be used once, and will be re-generated each time.