Challenge–response authentication: Difference between revisions

Revision as of 21:44, 28 March 2023

Revision as of 18:51, 6 July 2023

Line 9:

For example, when other [[communications security]] methods are unavailable, the [[United States|U.S.]] military uses the [[AKAC-1553]] TRIAD numeral cipher to authenticate and encrypt some communications. TRIAD includes a list of three-letter challenge codes, which the verifier is supposed to choose randomly from, and random three-letter responses to them. For added security, each set of codes is only valid for a particular time period which is ordinarily 24 hours.

A more interesting challenge–response technique works as follows. Say [[Alice and Bob|Bob]] is controlling access to some resource. Alice comes along seeking entry. Bob issues a challenge, perhaps "52w72y". Alice must respond with the one string of characters which "fits" the challenge Bob issued. The "fit" is determined by an algorithm agreed upon by Bob and Alice. (The correct response might be as simple as "63x83z", with the algorithm changing each character of the challenge using a [[Caesar cipher]]). In the real world, the algorithm would be much more complex.) Bob issues a different challenge each time, and thus knowing a previous correct response (even if it is not "hidden" by the means of communication used between Alice and Bob) is of no use.

==Other non-cryptographic protocols==