I have come across some security implementations in which party A will compute MD = sha256(secret + rand) and transmit MD and rand to a counterpart B. If the second party knows the secret, then when it computes sha256(secret + rand), it will match that from sender A and validate it.
This may be a loaded question, but is this secure at all? Meaning, would it be very hard for an attacker to discover the secret given the resultant hash and the random number?
Part 2: Another potentially loaded question Would it be more/less secure to instead use an hmac using the secret as the 'data'? So HMAC(rand, secret) ?
The goal of both security systems is to ensure that both A and B possess the same key K without transmitting it, but is either more secure? Are these implementations 'traditional' or more of a 'cluge'?