PAP and CHAP - SY0-601 CompTIA Security+ : 3.8
Authentication Methods: PAP vs. CHAP
Overview of Authentication in Networking
- The video introduces two common authentication methods used in networking: Password Authentication Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP).
- It describes a scenario where a client outside an organization accesses a VPN concentrator to reach an internal file server, emphasizing the need for authentication.
Role of AAA Server
- The VPN concentrator forwards the authentication request to an AAA server, which handles authentication, authorization, and accounting.
- The AAA server checks the provided username and password against its records and sends back approval or disapproval.
Understanding PAP (Password Authentication Protocol)
- PAP is described as a basic method for authentication that transmits credentials in clear text without encryption, making it vulnerable.
- Originally designed for dial-up connections, PAP lacks modern security features; however, some applications may encrypt passwords before sending them through PAP.
How PAP Works
- An example illustrates how a client sends their username "james" and password "password111" using PAP.
- The server authenticates these credentials and grants access if they are correct.
Introduction to CHAP (Challenge Handshake Authentication Protocol)
- CHAP improves upon PAP by introducing an encrypted challenge-response mechanism that enhances security during the authentication process.
- A three-way handshake occurs where the server sends a challenge message to the client, who responds with a hashed combination of the challenge and their password.
CHAP's Mechanism Explained
- This challenge-response process can occur multiple times throughout an active session without user awareness.
- In this scenario with CHAP, when "james" attempts to log in again, the server sends a challenge based on his known password.
Security Features of CHAP
- The client calculates its response using both the password and received challenge before sending it back to the server.
- Unlike PAP, CHAP does not transmit passwords over the network; only challenges or responses are sent.
MS-CHAP: Microsoft’s Version of CHAP