Prove it with a challenge
A password sent again and again is the same every time. A challenge that changes each time makes each answer good for one use only.
Car key fobs, tap-to-pay cards and building passes do not send a fixed code. The reader sends a random number, and the card answers in a way only it can. Next time the number is different.
In the XOR lesson the keypad sent the same locked PIN every time. Anyone who ever heard that number has a number that works today, tomorrow and next week, without ever knowing the key.
The fix is a challenge and response:
- The key micro:bit knocks.
- The lock picks a random challenge and sends it.
- The key micro:bit works out an answer from the challenge and the secret key, and sends it.
- The lock works out the same answer itself and opens only if they match.
The secret key never goes through the air, and the answer is different whenever the challenge is.
In the code the challenge travels under the name chall, not challenge: send value names are 8 characters at most (Agreeing a key in the open), and challenge has 9.
- Predict: Read the code and say what it will do before you run anything. A wrong guess is fine: it shows you what to look for.
- Run: Run it and compare the result with your prediction.
- Investigate: Trace how each line of code connects to what you see.
- Modify: Change the code on purpose and check the result.
- Make: Build something new using what you have learned. Expect a few tries; that is normal.
Make your prediction first. Help opens once you've locked it in.
Predict
Show as code
let secretKey = 7
let challenge = 0
function answer(n: number): number {
return (n * secretKey + 3) % 100
}
radio.setGroup(5)
input.onButtonPressed(Button.A, function () {
radio.sendString("KNOCK")
})
radio.onReceivedString(function (receivedString) {
if (receivedString == "KNOCK") {
challenge = randint(10, 99)
radio.sendValue("chall", challenge)
}
})
radio.onReceivedValue(function (name, value) {
if (name == "chall") {
radio.sendValue("answer", answer(value))
} else if (name == "answer") {
if (value == answer(challenge)) {
basic.showIcon(IconNames.Yes)
} else {
basic.showIcon(IconNames.No)
}
}
})
Run
Press A a few times. Open Show data and compare the challenge and answer numbers each time.
Show as code
let secretKey = 7
let challenge = 0
function answer(n: number): number {
return (n * secretKey + 3) % 100
}
radio.setGroup(5)
input.onButtonPressed(Button.A, function () {
radio.sendString("KNOCK")
})
radio.onReceivedString(function (receivedString) {
if (receivedString == "KNOCK") {
challenge = randint(10, 99)
radio.sendValue("chall", challenge)
}
})
radio.onReceivedValue(function (name, value) {
if (name == "chall") {
radio.sendValue("answer", answer(value))
} else if (name == "answer") {
if (value == answer(challenge)) {
basic.showIcon(IconNames.Yes)
} else {
basic.showIcon(IconNames.No)
}
}
})
Investigate
Show as code
let secretKey = 7
let challenge = 0
function answer(n: number): number {
return (n * secretKey + 3) % 100
}
radio.setGroup(5)
input.onButtonPressed(Button.A, function () {
radio.sendString("KNOCK")
})
radio.onReceivedString(function (receivedString) {
if (receivedString == "KNOCK") {
challenge = randint(10, 99)
radio.sendValue("chall", challenge)
}
})
radio.onReceivedValue(function (name, value) {
if (name == "chall") {
radio.sendValue("answer", answer(value))
} else if (name == "answer") {
if (value == answer(challenge)) {
basic.showIcon(IconNames.Yes)
} else {
basic.showIcon(IconNames.No)
}
}
})
The lock picks the challenge 20. What answer opens the lock? (n × 7 + 3, remainder after dividing by 100.)
For each item, does it cross the air in the challenge-and-response?
Modify
Make the lock count how many times it opened, and show the count when B is pressed.
Need a hint?
Make a variable opened. Add one to it when the answer is right. B shows it.
The lock counts how many times it opened; B shows the count.
This ticks by itself when your blocks do what is asked.
Make
Make the lock safer. After three wrong answers it shows a skull and ignores knocks for five seconds. Why does this help against someone who just guesses?
Need a hint?
Add one to wrong when an answer is wrong and set wrong to 0 when it is right.
Another hint
On a knock, if wrong is 3 or more: show a skull, pause 5 seconds, set wrong to 0. Otherwise send the challenge.
After three wrong answers the lock refuses to give a challenge for five seconds.
This ticks by itself when your blocks do what is asked.
For teachers
Students build a challenge-and-response lock so that a heard answer cannot be used again, then add a lockout after three wrong answers. About 50 minutes.
Open the teacher guide: answers, solutions, slides and a worksheet.
Students will be able to
- I can describe the four steps of a challenge and response.
- I can explain why an answer heard once does not open the lock again.
- I can say what never crosses the air.
Before class
The idea: to prove you know a secret without saying it, the other side sets a random question, the challenge, and you answer it using the secret. A fresh challenge each time means an old answer fits only the old challenge.
Everyday picture: a bank clerk who asks for a random character of your password each time. Where it breaks: if the same question comes up, the answer works again; the challenge must be random and not repeat.
Honest limits: the answer function here, (n × key + 3) mod 100, is a toy: someone who collects enough challenges and answers can work out the key, and with only 90 possible challenges they repeat soon. Real systems use a hash function (a one-way mix) and huge challenges. Tell students the toy is for learning the shape of the idea.
Same program on both micro:bits: the simulator runs two copies. The one where A is pressed acts as the key; the other acts as the lock.
Running the lesson
- Predict: ask for the working before the options.
- Investigate: ask what a listener has after hearing one full exchange (a challenge and its answer), and whether it helps with the next one.
The hard part (on purpose)
Why a fixed password fails once heard, and a fresh challenge doesn't. Ask what a listener could reuse, and whether the answer ever repeats.
When students get stuck
- The lock always shows a cross. Ask: Do both micro:bits have the same secretKey? Is the answer function the same? Fix: Use the same secretKey and answer function on both.
- The tick appears on the wrong micro:bit. Ask: Which micro:bit checks the answer? Fix: The micro:bit that picked the challenge also checks the answer; the knocker only answers.
Stretch and support
Stretch: Make the challenge 3 digits and store it as a number. Why does a longer challenge repeat less often?
Support: Give the lockout in outline: students fill in the conditions.
Where it leads
Next: capture-the-flag puzzles, then defend a whole system.
What each step is for
- Investigate: A fixed answer works forever once it has been heard. An answer that depends on a fresh challenge works once. The key proves itself without ever being sent.
- Modify: The lock can keep a record of what happened, such as how many times it opened.
- Describe the four steps of a challenge and response.
- Explain why an answer heard once does not open the lock again.
- Say what never crosses the air.