just "hashing the password" is not a "challenge-response" protocol.