regarding nonce and secret key

Question

Consider the following challenge-response protocol for $A$ to convince $B$ that he is indeed $A$. Here we are assuming:

• at the start when the virtual circuit is being set up, $A$ has to convince $B$ that he is indeed $A$.
• once a virtual circuit has been set up, the BG cannot alter messages in the middle.
• $A$ and $B$ share a secret value $S$.

$B$ sends $A$ a nonce $N$.

$A$ calculates $C$ to be the first 64 bits of $N$ XORed with the first 64 bits of $S$.

$A$ returns $C$ back to $B$.

$B$ checks whether $C$ = first 64 bits of $N$ XORed with the first 64 bits of $S$.

If it is, $B$ accepts that $A$ is indeed $A$. is it good idea to use this kind of functionality?

Answer 1

Since N xor C reveals the first 64 bits of S, the secret cannot be reused. Also, a MITM attacker can observe the message sent from A to B then drop it. Then the protocol cannot restart with a new nonce. If you prefer a challenge-response protocol, maybe just use S to hash the nonce and send the result to the other party.