challenge-response authentication system uses hash lib