🤝Challenge-Handshake Authentication Protocol

NEW

Also known as: CHAP

An authentication protocol that uses a challenge-response handshake to verify identities without sending passwords over the link.

DESCRIPTION

CHAP authenticates a peer by sending a challenge and verifying a response computed with a shared secret and a one-way hash. It reduces exposure of credentials compared to PAP and can perform periodic re-authentication. CHAP is standardized for PPP environments and often used via RADIUS. Though stronger than PAP, CHAP is largely superseded by EAP methods in many modern deployments.

ALTERNATIVE DEFINITIONS

Wikipedia

Challenge-Handshake Authentication Protocol (CHAP) is an authentication scheme used by Point-to-Point Protocol (PPP) servers to validate the identity of remote clients.

Connects CHAP to PPP and remote client validation.

Source

IETF

This document describes the PPP Challenge Handshake Authentication Protocol (CHAP).

Establishes formal standardization context for CHAP.

Source

RELATED TERMS

Point-to-Point Protocol Microsoft Challenge-Handshake Authentication Protocol Extensible Authentication Protocol Remote Authentication Dial-In User Service TACACS+ TLS Replay Attack Hash Function

COMPETING TERMS

Password Authentication Protocol

RELATIONS

• Broader: Protocol
• Narrower: Microsoft Challenge-Handshake Authentication Protocol

KNOWLEDGE AREAS

Data Security Infrastructure

TARGET AUDIENCE

Cybersecurity Engineer Security Architect DevOps Engineer

EXTERNAL SOURCES

• Wikipedia - Challenge-Handshake Authentication Protocol
• IETF - Official CHAP specification.
• Cisco - Comparison and configuration of PAP/CHAP.

TOP QUESTIONS

How does Challenge-Handshake Authentication Protocol prevent password exposure?

It uses a challenge-response with a hash of the secret, so the password is never sent over the link.

Category: Concept

What is periodic re-authentication in CHAP?

Servers can issue new challenges during a session to verify the peer remains authenticated, limiting replay windows.

Category: BestPractice

Is CHAP still recommended?

It is better than PAP but typically replaced by EAP methods in modern networks for stronger security and flexibility.

Category: Opinion

What are common mistakes when configuring CHAP?

Mismanaging shared secrets, weak hashing choices, or inconsistent configurations across RADIUS and network devices.

Category: Mistakes

How does CHAP compare to MS-CHAPv2?

MS-CHAPv2 modifies the handshake and integrates with Microsoft ecosystems but has known cryptographic weaknesses.

Category: Comparison

Where is CHAP typically used?

In PPP links, legacy dial-up, and some VPN or NAS scenarios via RADIUS backends.

Category: Example

Does CHAP provide mutual authentication?

Standard CHAP authenticates the client to the server; mutual authentication requires other mechanisms.

Category: Concept

What attacks can still affect CHAP?

If secrets are weak or reused, offline guessing and replay attacks may succeed; strong secrets are essential.

Category: Risks

How to migrate from CHAP to EAP?

Adopt 802.1X with EAP-TLS or EAP-PEAP, integrate with RADIUS, and deploy PKI for strong credentials.

Category: Requirements