title: Security, cryptography: Stupid Challenge - Response protocol?
body: <p>Ok guys just a small game:</p>
  
  <p>I have some specifications for a project. At some point they ask for the following to encrypt a password over the net, saying that it is a challenge response protocol:</p>
  
  <pre>
  CLIENT ----------------------------- SERVER
  
  (1)ask for challenge --------------&gt;
  
  (2)    &lt;---------------------------- send SHA1 taken from the time
                                         (this is the challenge)
  (3) make SHA1 xor PASSWORD --------&gt; if it's equal to SHA1 xor stored password
  
  (4)    &lt;---------------------------- Grant access
  </pre>
  
  <p>For those who don't know it SHA stands for Secure Hashing Algorithm, a standard algorithm for cryptography.</p>
  
  <p>I hope it's clear. Question is: If I sniff packets 2 and 3 (the "challenge" and the "challenge xor password", I do have the actual password just with another xor between them both!?!? There is other way to implement this kind of protocol?? </p>