If you need to authenticate on a Point-to-Point network,
then you need the Point-to-Point Protocol, or PPP,
to be able to provide authentication
on an analog dial-up and ISDN and other types
of Point-to-Point Networks.
There are also derivatives to PPP,
you may find PPTP which is Point-to-Point Tunneling
Protocol.
Commonly you'll see that in Windows operating systems.
And there's PPPoE, which is to Point-to-Point Protocol
over Ethernet, which is commonly used to authenticate over a DSL
network.
If you need to authenticate over these non-ethernet networks,
it's very common to use PAP, CHAP, or MS-CHAP
to be able to accomplish that.
One of the most basic authentication methods
is PAP, or Password Authentication Protocol.
You would commonly see PAP used on very old operating
systems or legacy systems.
And it's very unusual to see PAP used by itself these days.
That's because PAP communicates in the clear.
There's no encryption or any additional security
of the information that you're sending using this Password
Authentication Protocol.
We didn't need encryption over the dial-up lines
we were using because there was no mechanism for someone else
to sit-in the middle of that conversation
and grab that data.
PAP used this method of communication.
You would put your username and your password in at a prompt,
and you would login.
The response from your client might
say that your user name is James,
the password is password111.
And you can see that it's all sent across the network
in the clear.
The PAP server contains a database
that also contains my username and the password,
and it checks to see if those two things match.
And if they match, the client receives a message back,
saying the authentication was successful,
and you've now gained access to the network.
CHAP was created to provide additional security
to this authentication process.
CHAP is the Challenge Handshake Authentication Protocol,
and it's using an encrypted challenge
to be able to send these credentials across the network.
CHAP uses a three-way handshake to be able to authenticate.
Once the client and the server initially connect,
the server will send a challenge message to the client.
The client combines the password with that challenge message
and sends a hash back to the server.
The server then compares that hash
to the information it has in the database
and determines if the authentication is correct.
This same challenge response may continue multiple times
while these devices are connected.
This all happens behind the scenes and the user
never even knows it's occurring.
Here's the CHAP authentication.
We're going to use the same username, James,
and the same password of 111.
The client sends a message to the CHAP server that says,
I'd like to login, but only sends username information.
It says, my user name is James.
The CHAP server, obviously has the username
and the password information stored in it's local database.
And it creates a very specialized challenge message
that it sends back to the client.
You can see the challenge message
is sent across the network.
The client combines the challenge message
with the password and sends a very specialized hash
in response to the CHAP server.
The CHAP server performs exactly the same calculation
on its side, and it determines if that hash matches.
And if the hash does match, then the user
is allowed access to the network.
Microsoft uses a version of CHAP that they've customized,
and they call MS-CHAP.
This is something you'll see on Microsoft's Point-to-Point
Tunneling Protocol, or PPTP.
The most recent version of MS-CHAP
is referred to as MS-CHAP v-2.
Unfortunately MS-CHAP and MS-CHAP v-2,
suffer from vulnerabilities due to the use of the desk
protocol.
Instead of using MS-CHAP, many people
have migrated to L2TP, IPsec, or some other type of secure VPN
communication.