Apparently, challenge-response authentication is typically used when using keyboard-interactive authentication, not with key-based authentication (using public/private key pairs).
Speaking of which, ssh keys are not exactly secure, is it? Someone can steal your phone & laptop (possibly at the same time) and get your finger prints off a cup/glass that you have used, or from some other public place and you stand to lose everything?
also I checked the RFC for ssh public key authentication, the signature signed with your private key includes the "session identifier" which "uniquely identifies this session and is suitable for signing in order to prove ownership of a private key."
@Mgetz actually that's not applicable to my case due to the CA that is involved
We've got 100+ groups of embedded devices out in the field. Every group is constituted of 4 systems. I was considering certificates when doing SSH from one device to another inside that group.
BUt that doesn't seem to be suited for such use-case.
@LandonZeKepitelOfGreytBritn Biometric log-in to your laptop, on which keys and passwords are stored, also finger prints to unlock phone for 2 step verification, after which, can just proceed to steal all your stuff.