CHAP

CHAP, or Challenge-Handshake Authentication Protocol, is a PPP authentication mechanism used to verify the identity of a peer on a point-to-point link. It provides protection over sending passwords in clear by using a challenge-response sequence and a shared secret.

Operation: When a link is established, the authenticator sends a randomly generated challenge to the peer. The peer responds with a value derived from the challenge and the shared secret using a one-way hash function, typically MD5. The authenticator verifies the response, and if it matches, authentication succeeds. CHAP can support mutual authentication by allowing the peer to challenge the authenticator as well, and the protocol may be repeated periodically to re-verify the peer during an ongoing connection.

Implementation and scope: CHAP is defined for PPP in standards such as RFC 1994. It is widely used in dial-up, VPNs, and other PPP-based connections. The security of CHAP depends on the strength of the shared secret; because it relies on hashing the challenge and secret, it does not transmit the password itself and helps defend against passive eavesdropping and replay attacks. However, if the secret is weak, it is vulnerable to guessing or dictionary attacks.

Variants and related topics: CHAP is distinct from MS-CHAP and EAP-based methods. Many systems support CHAP as part of PPP authentication, while modern deployments often favor EAP for stronger or multi-factor authentication. See also PAP, MS-CHAP, EAP, PPP.