Encrypting data with HMAC-SHA1 challenge response as the key
Yes, it is secure to generate the key as long as the $K$ is kept secret.  Although the collision of SHA-1 is broken, HMAC is a PRF under the sole assumption that the compression function is a PRF. It is not affected by the collision of the has function.
The security strength of the HMAC is relay on the size of the key. The usual attack is to search for the key $K$.
Keep in mind that, the attacker will go to search for $E$ if $E&lt;K$. In your case, since both are 20 bytes, so brute-forcing $K$ can be faster, though not possible.