Can ECDH be used for authentication? Is it safe to use ECDH for challenge-response authentication, with server key being ephemeral?

The goal is that server does not store sensitive data (hashes) and allow clients to use additional security if needed (for example generate and store their key in a smartcard and skip key derivation).


Client derives private key from the password, using a strong hash algorithm (similar to bitcoin address generators using passwords)
Server generates a key and sends its (ephemeral) public key and a challenge string
Client must reply with the challenge, encrypted with the shared key
Server checks if decrypting response yields the challenge


Assumptions


A secure channel is already established
Server has the client's public key stored
Here’s a link that shows how to implement ECDH with long term public keys and ephemeral shared keys. You could just add this authentication after the TLS handshake as it’s own layer. Think about the openID protocol.  You can publish the keys at a well-known-endpoint,  it’s not necessary to wrap them in a certificate.