DataTerminology.comNEW
Also known as: MS-CHAP
A challenge-response authentication protocol used in Microsoft environments, now considered insecure due to known cryptographic weaknesses.
DESCRIPTION
MS-CHAP is a Microsoft variant of CHAP used primarily with PPP and RADIUS for network authentication. Version 2 improved mutual authentication but remains vulnerable due to weaknesses in the underlying hash and challenge response design. Modern environments favor stronger methods like EAP-TLS or Kerberos, especially for VPNs and Wi‑Fi. Organizations should phase out MS-CHAP to reduce credential compromise risks.
ALTERNATIVE DEFINITIONS
IETF
This document describes version 2 of the Microsoft Challenge-Handshake Authentication Protocol (MS-CHAP v2).
Defines MS-CHAP v2 formally in an RFC context.
IETF
This document describes the Microsoft Challenge-Handshake Authentication Protocol (MS-CHAP).
Original RFC for MS-CHAP specification.
Microsoft Learn
MS-CHAP is Microsoft’s version of the Challenge Handshake Authentication Protocol (CHAP).
Vendor glossary positioning MS-CHAP as CHAP variant.
RELATED TERMS
Challenge-Handshake Authentication Protocol Password Authentication Protocol Extensible Authentication Protocol Remote Authentication Dial-In User Service NTLM Point-to-Point Protocol Virtual Private Network TLS
COMPETING TERMS
EAP-TLS Kerberos
RELATIONS
KNOWLEDGE AREAS
Data Security Infrastructure Software Engineering
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Chief Information Security Officer Application Administrator IT Manager
EXTERNAL SOURCES
- Wikipedia - MS-CHAP
- IETF - Official MS-CHAP v2 specification
- IETF - Original MS-CHAP specification
- Microsoft Learn - Microsoft security glossary entry
TOP QUESTIONS
Why is Microsoft Challenge-Handshake Authentication Protocol considered weak?
Its reliance on outdated hashing and challenge-response mechanisms enables practical credential recovery attacks, making it insecure by modern standards.
Category: Risks
Where was MS-CHAP commonly used?
In PPP-based VPNs, RADIUS authentication, and legacy Windows network environments for dial-up and Wi‑Fi authentication.
Category: Topic
What should replace MS-CHAP today?
EAP-TLS with mutual certificate authentication or Kerberos-based authentication for stronger cryptographic guarantees.
Category: Alternatives
How does MS-CHAP differ from CHAP?
MS-CHAP uses Microsoft-specific hashing and message formats, and MS-CHAP v2 adds mutual authentication features.
Category: Definition
What are common mistakes when using MS-CHAP?
Continuing to allow MS-CHAP on VPNs or Wi‑Fi without strong policies, and neglecting certificate-based alternatives.
Category: Mistakes
How to manage migration away from MS-CHAP?
Audit authentication methods, enforce EAP-TLS, deploy PKI, and update RADIUS/NAS configurations with user communication and phased rollouts.
Category: Management
Does MS-CHAP support mutual authentication?
MS-CHAP v2 offers mutual authentication, but it’s still cryptographically weak compared to certificate-based methods.
Category: Misunderstanding
What is the origin of MS-CHAP?
Microsoft developed MS-CHAP as a proprietary variant of CHAP to integrate with Windows authentication ecosystems.
Category: Origin
Is MS-CHAP compliant with modern security standards?
No. Current best practices and standards recommend stronger protocols like EAP-TLS and modern cryptography.
Category: Regulation