Would a challenge response HMAC authentication be secure?
- Client sends id
- Server sends a challenge(32byte value)
- Client calculates hmac_sha256 of the challenge value with its key and sends the reply
- Server verifies the reply
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
That's as secure as a symmetric challenge-response authentication can be. Some remarks:
The big problems are