title: Creating challenge-response sign-in
body: <p>I'm currently trying to create user authorization that follows:
  <a href="https://stackoverflow.com/questions/549/the-definitive-guide-to-forms-based-website-authentication">The definitive guide to form-based website authentication</a>
  I already implemented crsf tokens, passwords are encrypted in database etc. Now I need to add some encryption to data being send at user sign-in (can't use SSL).</p>
  <p>I've been looking for some some good solution but I've found only:
  <a href="http://unitstep.net/blog/2008/03/29/a-challenge-response-ajax-php-login-system/" rel="nofollow noreferrer">http://unitstep.net/blog/2008/03/29/a-challenge-response-ajax-php-login-system/</a>
  I'm not security expert so I don't want to write such system by myself (but I guess I have to).</p>
  <p>Do you know any class / lib that provides challenge-response feature?
  Data must be hashed at client side before sending to server - isn't that unsafe by definition?</p>