MSCHAP

MSCHAP stands for Microsoft Challenge-Handshake Authentication Protocol, a family of challenge-response authentication protocols used by Microsoft Windows in PPP dial-up and VPN contexts. It is designed to authenticate a user without sending the password in clear over the network, though it relies on the security of the user’s password and the strength of the underlying cryptographic methods.

The MS-CHAP family includes two main variants: MS-CHAP v1 and MS-CHAPv2. MS-CHAP v1, introduced in the 1990s, uses a server-issued challenge and a client response derived from the user’s password. The password is converted to an NT hash, and the response is formed by encrypting the challenge with DES using three keys derived from that hash, producing a 24-byte response. The server verifies by computing the expected response from its copy of the user’s password.

MS-CHAPv2, introduced later, adds mutual authentication and uses improved response calculations based on NTLMv2. In MS-CHAPv2, both sides can verify each other, and the authentication material includes additional client-side randomness. While MS-CHAPv2 is more secure than v1, it remains vulnerable to certain offline password-guessing attacks if an attacker can capture the negotiation transcript or if weak passwords are used. Consequently, many security guides recommend stronger authentication methods where feasible (for example, EAP-TLS, or PEAP with a strong inner method).

Usage and status: MS-CHAP and MS-CHAPv2 were widely used with PPP-based remote access and some VPN configurations (such as PPTP). Support persists for compatibility, but modern deployments often favor more robust EAP-based methods to improve security and reduce exposure to password-guessing attacks.