Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
Challenge-Handshake Authentication Protocol
open-in-new
<p>In <a href="/facts/Computing/Kghtm9fX">computing</a>, the Challenge-Handshake Authentication Protocol (CHAP) is an <a href="/facts/Authentication_protocol/pcX97lnA">authentication protocol</a> originally used by <a href="/facts/Point-to-Point_Protocol/XLaU6D71">Point-to-Point Protocol</a> (PPP) to validate users. CHAP is also carried in other authentication protocols such as <a href="/facts/RADIUS/NfNur5Q5">RADIUS</a> and <a href="/facts/Diameter_(protocol)/d6mkAmuI">Diameter</a>. </p><p>Almost all <a href="/facts/Network_operating_system/K9MlJLI3">network operating systems</a> support PPP with CHAP, as do most <a href="/facts/Network_access_server/QRNucJBh">network access servers</a>. CHAP is also used in <a href="/facts/PPPoE/dSfSRACH">PPPoE</a>, for authenticating DSL users. </p><p>As the PPP sends data unencrypted and "in the clear", CHAP is vulnerable to any attacker who can observe the PPP session. An attacker can see the user's name, CHAP challenge, CHAP response, and any other information associated with the PPP session. The attacker can then mount an offline <a href="/facts/Dictionary_attack/0DdvVvBM">dictionary attack</a> in order to obtain the original password. When used in PPP, CHAP also provides protection against <a href="/facts/Replay_attack/IpKW2kvf">replay attacks</a> by the peer through the use of a challenge which is generated by the authenticator, which is typically a <a href="/facts/Network_access_server/QRNucJBh">network access server</a>. </p><p>Where CHAP is used in other protocols, it may be sent in the clear, or it may be protected by a security layer such as <a href="/facts/Transport_Layer_Security/pGy16TnA">Transport Layer Security</a> (TLS). For example, when CHAP is sent over <a href="/facts/RADIUS/NfNur5Q5">RADIUS</a> using <a href="/facts/User_Datagram_Protocol/dxLU0D6q">User Datagram Protocol</a> (UDP), any attacker who can see the RADIUS packets can mount an offline <a href="/facts/Dictionary_attack/0DdvVvBM">dictionary attack</a>, as with PPP. </p><p>CHAP requires that both the client and server know the clear-text version of the password, although the password itself is never sent over the network. Thus when used in PPP, CHAP provides better security as compared to <a href="/facts/Password_Authentication_Protocol/YzWIg2yr">Password Authentication Protocol</a> (PAP) which is vulnerable for both these reasons. </p>