 in computer security, challenge-response authentication is a family of protocols in which one party presents a question ("challenge") and another party must provide a valid answer ("response") to be authenticated. the simplest example of a challenge-response protocol is password authentication, where the challenge is asking for the password and the valid response is the correct password. clearly an adversary who can eavesdrop on a password authentication can then authenticate itself in the same way. one solution is to issue multiple passwords, each of them marked with an identifier. for instance, p1=pv4oafx1q2cq, p2=dsyfx3ke, and so on. the verifier can ask for any of the passwords, and the prover must have that correct password for that identifier. assuming that the passwords are chosen independently, an adversary who intercepts one challenge-response message pair has no clues to help with a different challenge at a different time. for example, when other communications security methods are unavailable, the u.s. military uses the akac-1553 triad numeral cipher to authenticate and encrypt some communications. triad includes a list of three-letter challenge codes, which the verifier is supposed to choose randomly from, and random three-letter responses to them. for added security, each set of codes is only valid for a particular time period which is ordinarily 24 hours. software in the 1980s and 1990s often used a similar method for copy protection: challenges would be questions like "what is the second word in the third paragraph on page 418 of the manual?". the security assumption was that copying the manual was more difficult than copying the software disk. sometimes the manual would be printed in such a way that contemporary photocopy machines couldn't duplicate the pages. == other non-cryptographic protocols == challenge-response protocols are also used to assert things other than knowledge of a secret value. captchas, for example, are a sort of variant on the turing test, meant to determine whether a viewer of a web application is a real person. the challenge sent to the viewer is a distorted image of some text, and the viewer responds by typing in that text. the distortion is designed to make automated optical character recognition (ocr) difficult and preventing a computer program from passing as a human. ==cryptographic techniques== non-cryptographic authentication were generally adequate in the days before the internet, when the user could be sure that the system asking for the password was really the system they were trying to access, and that nobody was likely to be eavesdropping on the communication channel to observe the password being entered. to address the insecure channel problem, a more sophisticated appro
Cryptographic_protocols