Identity authentication

The present invention relates to a method of authenticating the identity of one or more users (101, 102) who are communicating with each other. The users (101, 102) share one or more secrets with each other, and use those secrets to verify their identities at a remote authentication system (103). A server (104) of the system (103) receives a secret from a first user (102) and hashes it with a salt (206), sending a reference code (207) back to the first user (102) in response. The server (104) then receives the secret from a second user (101), along with the reference code (207) and hashes the secret with the same salt (206) used to hash the first secret. The outputs (208, 209) of the hashes are then compared to determine whether the secrets matched, authenticating the identities of each user.