Would a challenge response HMAC authentication be secure?
- Client sends id
- Server sends a challenge(32byte value)
- Client calculates hmac_sha256 of the challenge value with its key and sends the reply
- Server verifies the reply
That's as secure as a symmetric challenge-response authentication can be. Some remarks:
The big problems are