Authentication is confirmed if the numbers match. The challenge response version has a few additional steps. After the user enters their user name and password, the RAS sends the user a six digit random number, called the challenge. The user enters the number in their token card via its calculator-like keypad. The RAS, knowing the user's algorithm and the challenge, performs the same operation.
Authentication occurs when the responses match.
Challenge response software is currently available in various operating systems. Both Windows 95 and NT embed it within their remote access clients. The answer will help to determine the amount of bandwidth required per user. You may find that a 28 Kbps analog connection may not be fast enough, requiring your design to support ISDN which can provide much higher data rates. This may force your design to support data encryption and possibly additional levels of authentication.