 A private key is known by the user only.The user shares a unique key with an authentication server.When the user sends a randomly generated message (the challenge) encrypted by the secret key to the authentication server, if the message can be matched by the server using its shared secret key, the user is authenticated.