private void processChallengeResponse(HttpServletRequest request, HttpServletResponse response) {
		try {
			String base64_key = request.getParameter(CommunityConstants.BASE64_PUBLIC_KEY);
			String base64_response = request.getParameter(CommunityConstants.CHALLENGE_RESPONSE);
				
			/**
			 * First the easy cases -- do we even _know_ about this key? If not,
			 * no need to do crypto.
			 * 
			 * This may also happen if we 1) just pruned the database, 2) and this user was in the middle of a refresh
			 * (although this is pretty unlikely)
			 */
			if (CommunityDAO.get().isRegistered(base64_key) == false) {
				response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
				logger.finer("Challenge request with unknown key, dropping (unauthorized) " + request.getRemoteAddr());
				return;
			}

			if (recentChallenges.containsKey(base64_key) == false) {
				response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
				logger.finer("Challenge request without recent issue, dropping (unauthorized) " + request.getRemoteAddr());
				return;
			}

			long originalChallenge = recentChallenges.get(base64_key);

			byte[] key_bytes = Base64.decode(base64_key);
			if (key_bytes == null) {
				logger.warning("Couldn't decode key bytes from " + request.getRemoteAddr() + " / " + base64_key);
				response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
				return;
			}

			byte[] response_bytes = Base64.decode(base64_response);
			if (response_bytes == null) {
				logger.warning("Couldn't decode challenge response from " + request.getRemoteAddr() + " / " + base64_response);
				response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
				return;
			}

			X509EncodedKeySpec pubKeySpec = new X509EncodedKeySpec(key_bytes);
			KeyFactory factory = KeyFactory.getInstance("RSA");

			PublicKey pub = null;
			try {
				pub = factory.generatePublic(pubKeySpec);
			} catch (InvalidKeySpecException e) {
				logger.warning("Couldn't decode valid public key from " + request.getRemoteAddr() + " / " + base64_response);
				response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
				return;
			}

			Signature sig = Signature.getInstance("SHA1withRSA");
			sig.initVerify(pub);
			sig.update(ByteManip.ltob(originalChallenge + 1));

			if (sig.verify(response_bytes)) {
				logger.fine("Signature verified, generating response " + request.getRemoteAddr());
				generateAndSendKeyList(request, response);
			} else {
				logger.warning("Key failed challenge/response. Expected: " + (originalChallenge + 1) + " received signature didn't verify from " + request.getRemoteAddr());
				response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
				return;
			}
			
		} catch (NoSuchAlgorithmException e) {
			e.printStackTrace();
			logger.severe(e.toString());
		} catch (InvalidKeyException e) {
			System.err.println(e);
			e.printStackTrace();
		} catch (SignatureException e) {
			System.err.println(e);
			e.printStackTrace();
		}
	}