Talk:Challenge–response authentication

message: This page has an unusual style that is quite distracting to read, in which half the words are quoted despite not being terms of art. I will go through and clean it up over time if no one objects.
Amrsaadiq (talk) 20:21, 3 June 2022 (UTC)
thread_title: Excessive use of "Quotation Marks"

message: I think it would be cool if someone with good writing skills wrote a paragraph or sentence somewhere in the article about how many fraternities and sororities have challenges to enter their chapter meetings.  — Preceding unsigned comment added by 68.97.82.7 (talk) 03:56, 29 June 2012 (UTC)
replies: text: That is actually called a Countersign_(military). But is often referred to as a challenge response.  I'll add a link because I am sure others land here looking for the Countersign. Halcyonforever (talk) 16:22, 18 September 2023 (UTC)
thread_title: Fraternities and Sororities

message: Hello, can someone clarify whether challenge-response authentication or challenge-reply authentication is the right term? thanks
--195.145.211.194 12:02, 28 November 2006 (UTC)
replies: text: This is the first time I've heard the phrase "challenge-reply authentication". A Google search for the former yields about 118,000 results  while challenge-reply yields only 38 . It's a safe bet to say "challenge-response authentication". -- intgr 15:32, 28 November 2006 (UTC)
thread_title: "Challenge-response" or "challenge-reply"

message: This paragraph is wack and the logic is flawed and convoluted.  —Preceding unsigned comment added by 212.146.94.66 (talk) 16:04, August 30, 2007 (UTC) 
:It makes sense to me, but it's not well written indeed; I have added a "confusing" template. -- intgr #%@! 23:56, 30 August 2007 (UTC)
thread_title: "Unix passwords"

message: Most security professionals would disagree with:
"The simplest example of a challenge-response protocol is password authentication, where the challenge is asking for the password and the valid response is the correct password."
The key feature of challenge/response is that the responder is forced to give a different answer every time. Passwords are often contrasted with challenge response systems. For references see: RFC 4949, Network Security by kaufman et al or any good book on Information Security.
It is possible to distinguish between cryptographic challenge response systems where a well vetted cryptographic algorithm is performed to compute the output from the input and non-cryptographic systems where some other sort of prearranged scheme is used. See for example the O'Henry Story: Calloway's Code. In the story a reporter transmits the first word in a common phrase and the receivers fill in the rest of the phrase. In the story it is not used for authentication, but it could be. Perhaps a better example would recognition systems used by navies and other military organizations. They simply issue a secret code book containing challenges and their corresponding responses. Hal lockhart 21:38, 24 October 2007 (UTC)
replies: text: Indeed. Saying that asking for the password makes password-based authentication a simple form of challenge response is ludicrous. You could then say, by the same logic that *any* authentication is challenge-response, as every authenentication method is challenging the user to authenticate him/herself. Gerbennn (talk) 10:19, 7 June 2011 (UTC)
replies: text: Agreed. I believe the "challenge" has to cause the required response to vary or it's not challenge-response authentication. A fixed "what's the password?" 'challenge' is not enough because it doesn't vary the response. I think the source cited is simply incorrect in its definition of the "challenge" in CRAM - the "challenge" part of CRAM refers to the challenge-response sequence described in CRAM-MD5, rather than the "challenge" being the Authentication Required message. I just went ahead and changed it. Binkyuk (talk) 12:17, 10 August 2012 (UTC)

text: Then again, I take it back. RFC4949 defines the term as including simple password authentication in response to a request for one. Silly, but there it is. Binkyuk (talk) 12:31, 10 August 2012 (UTC)
thread_title:  password as challenge/response 

message: Pull-down menus are used at http://languagetesting.info/mail/email.php. -- Wavelength (talk) 17:54, 14 April 2010 (UTC)
thread_title:  Pull-down menus 

message: From my experience, most people do not realize that there exist simple algorithms (not involving public key crypto) that avoid the need for the server to store plaintext equivalents.  This is reflected even in Internet RFCs (such as on APOP, CRAM, CHAP) - the authors probably did not realize!  I am not aware of a more appropriate Wikipedia article to have this mentioned in, and my understanding is that publishing the algorithms right in Wikipedia (and only in Wikipedia) would be inappropriate - need to refer to an external source.  Similarly, making a statement and not backing it up with algorithms would be inappropriate.
For the reasons above, I had added a link to my external wiki page describing two such algorithms of my own and linking to an external website with a third algorithm invented by another person.  Although I am biased when linking to my own stuff, I think it is highly relevant to the article, and is desirable to have in here.  However, another editor eventually thought otherwise and removed the link.
I propose that the info/reference/link be re-introduced, maybe along with other edits to the article such that the link does not "stand out" (sort of contradicting what was just said in the paragraph), like it did (which could have contributed to the link appearing "irrelevant" to someone possibly not very familiar with the problem).  I'd appreciate any comments, votes for/against (with reasoning), any other suggestions, and actual edits to the article.   -- Solardiz (talk) 01:54, 13 January 2011 (UTC)
thread_title:  Storage of plaintext-equivalents can be avoided with simple C/R schemes 

message: The proposed mutual authentication scheme doesn't actually provide mutual authentication, since the server's hashB equals the client's hashA, which the client has just sent to the server.
Possibly sr was meant to be defined like so, with the challenges reversed?
* Server computes sr = hashB(sc + cc + secret)
For some hash functions it would also probably be somewhat safer to use an HMAC.
-- Alberge204 (talk) 06:05, 12 February 2013 (UTC)
thread_title:  Simple example mutual-authentication sequence 

message: Why would the intruder need the password, if the server only asks him for a hash during challenge-response?
In terms of reusability to impersonate the legitimate client, stealing the hash becomes equivalent to stealing the password. --217.140.96.21 (talk) 08:32, 11 April 2013 (UTC)
replies: text: You are correct. A simple password hash won't suffice in a true challenge–response system. I've rewritten the section in question.--agr (talk) 11:19, 11 April 2013 (UTC)
thread_title:  "If the intruder somehow obtains a password hash, he or she can use any password that generates the same hash." 

message: Hello fellow Wikipedians,
I have just modified one external link on Challenge–response authentication. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
*Added archive https://web.archive.org/web/20041014002830/http://www.cag.lcs.mit.edu/~rugina/ssh-procedures/ to http://www.cag.lcs.mit.edu/~rugina/ssh-procedures/
When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.
Cheers.—InternetArchiveBot (Report bug) 14:41, 2 August 2017 (UTC)
thread_title:  External links modified