title: What are some efficient ways to generate challenge/response for a backdoor entry scheme?
body: <p>We have a system that uses password authentication to access a database, the usernames and encrypted passwords are stored in the database. when a user forgets their password, (or the administrator leaves for greener pastures) we want to be able to generate a new password for the current administrator or generate a new administrator.</p>
  
  <p>We deal with our clients via telephone support. So we want to use this scenario:</p>
  
  <p>user rings up - forgotten password.</p>
  
  <p>client software generates a challenge code based on their site license</p>
  
  <p>user tells phone support staff the challenge code</p>
  
  <p>phone support staff give a response code</p>
  
  <p>user enters challenge and response code, and goes in the backdoor (either new user created or password of current user reset)</p>
  
  <p>We want the challenge/response to only work once, we dont want to leave the backdoor open.</p>
  
  <p>how should we go about it?</p>