Authentication and Key Exchange Protocol Design Questions

Design and analysis of authentication protocols including challenge-response mechanisms, multi-factor authentication schemes, and modern key agreement (ECDH-based constructions). Understanding of Kerberos-style architecture and OAuth/OpenID flows. Identify common vulnerabilities: weak nonce generation, insufficient verification, session fixation, impersonation attacks. Demonstrate ability to design authentication protocols secure against identified threats.

MediumTechnical

24 practiced

You are mentoring a junior engineer who designed an authentication handshake where the server signs (with its long-term key) the client's ephemeral public key but omits binding the server's ephemeral key to the transcript. Explain why the omission can be dangerous, how you would explain the bug to them, and provide a corrected message flow.

MediumTechnical

19 practiced

Compare password-authenticated key-exchange (PAKE) protocols SRP, SPAKE2, and OPAQUE. For each, describe which attack classes they mitigate (e.g., offline dictionary attacks), their server-side storage requirements, and where OPAQUE's asymmetric infrastructure gives it advantages over traditional PAKEs.

Sample Answer

**Brief comparison (purpose)** All three are PAKEs: they enable two parties who share a low-entropy secret (a password) to derive a strong shared key while preventing an eavesdropper or active attacker from learning the password.

**Attacks mitigated**- SRP (Secure Remote Password): resists passive eavesdropping, active man-in-the-middle, replay; prevents offline dictionary attacks against an on‑the‑wire transcript. If the server stores only a salted verifier, an attacker who steals transcripts still cannot validate guesses offline without the verifier.- SPAKE2: resists passive/active network attacks and provides mutual key confirmation when used correctly. Classical SPAKE2 assumes the server holds the password (or equivalent secret) and therefore does not by itself mitigate offline dictionary attacks if the server store is compromised.- OPAQUE (asymmetric PAKE with OPRF): resists passive/active network attacks and — critically — resists offline dictionary attacks even when the server storage is fully compromised. The server-only data is insufficient to verify password guesses offline without interacting (or without its OPRF key).

**Server-side storage requirements**- SRP: store (salt, verifier = f(password, salt)) per account. Verifier is a password-derived group element; compromise of verifier enables online impersonation and offline guessing to a degree more difficult than plaintext but still feasible with precomputation depending on parameters.- SPAKE2: typically requires either the plaintext password or a password-derived secret on the server (password-equivalent storage). Compromise generally enables straightforward offline dictionary attacks.- OPAQUE: store an “envelope” (encrypted client-secret) plus server OPRF key material and per-account public data (salt, envelope). The stored blob cannot be used to validate password guesses offline; an attacker needs the OPRF key or to run an interactive protocol to test guesses.

**Why OPAQUE's asymmetric infrastructure helps**- Separation of roles: the server holds an OPRF key and stored envelopes; without the key a breach leaks no offline-verifiable verifier. This converts the server compromise model from “password-equivalent leakage” to “no-offline-guessing” unless the attacker obtains additional server private key material.- Better phishing/resumption semantics: OPRF-based blindings avoid exposing password-derived values to the server during enrollment or auth, enabling safer resumption/transfer and easier integration with client-side key material.- Flexibility with PKI and account management: OPAQUE can be combined with TLS and server certificates more naturally; it supports account recovery and non-volatile client secrets without exposing passwords.- Stronger practical security: minimizes attacker capabilities after breach, allows forward secrecy when combined with ephemeral DH, and provides clearer security proofs in the augmented-PAKE model.

Summary: SRP and SPAKE2 are robust network PAKEs; SRP uses a verifier model that is better than plaintext storage but still has risks if verifier is abused, SPAKE2 is simple but often needs password-equivalent server storage. OPAQUE’s asymmetric/OPRF design gives the strongest protection against offline dictionary attacks on server compromise and cleaner integration with modern credential infrastructures.

EasyTechnical

23 practiced

Explain the difference between one-way authentication and mutual authentication in client-server systems. Provide examples of when mutual authentication is required and how a simple mutual-authenticated ECDH handshake would be structured at a message level.

EasyTechnical

19 practiced

Explain Elliptic Curve Diffie–Hellman (ECDH) key agreement at a protocol level. Describe the difference between ephemeral and static keys, and explain why ephemeral ECDH provides forward secrecy. Include potential pitfalls when mixing static and ephemeral keys in authenticated key exchange.

MediumBehavioral

35 practiced

Behavioral: Describe a time you discovered a subtle authentication or key-exchange vulnerability in a system you worked on (e.g., incorrect nonce use, token misbinding, certificate validation bug). Explain how you discovered it, the immediate remediation steps you took, how you communicated risk to stakeholders, and what longer-term design/process changes you instituted.

Unlock Full Question Bank

Get access to hundreds of Authentication and Key Exchange Protocol Design interview questions and detailed answers.

Join thousands of developers preparing for their dream job.