CHAP Authentication Definition

What is the CHAP Protocol?

The Challenge Handshake Authentication Protocol (CHAP) is an authentication protocol developed by the Internet Engineering Task Force (IETF). It was originally used to set up authenticated sessions by the Point-to-Point Protocol (PPP) but is also used by RADIUS and Diameter.

CHAP authentication is more secure than the Password Authentication Procedure (PAP) — which sends passwords in plaintext — and offers replay protection. However, it is potentially vulnerable to on-path and dictionary attacks and requires a pre-shared key for authentication.

How Does CHAP Authentication Work?

The CHAP Protocol uses a three-way handshake to set up an authenticated session between a user and a server. Before CHAP can be used, the client and server need to establish a shared secret that will be used as part of CHAP’s challenge-response process.

The three steps of CHAP authentication include:

• Challenge Packet: The Challenge Packet is sent by the server and includes an identifier value (which increments), a random challenge value, and a name field used to look up the shared secret.
• Response Packet: After receiving the Challenge Packet, the client calculates the response value using a one-way hash function to hash the challenge value, identifier, and shared secret. The client then sends this hash value, identifier, and name back to the server.
• Success/Failure Packet: When the server receives the result packet, it calculates the same hash value using the challenge, identifier, and shared secret. If the result matches the hash in the Response Packet, the server sends a Success Packet. Otherwise, it sends the Failure Packet.

If the authentication process succeeds, then the user is authenticated. The server will also periodically send challenges throughout the session to verify that it is still communicating with the authenticated user.

Benefits of the CHAP Protocol

CHAP offers a few advantages compared to similar authentication protocols (such as PAP), including:

• Security: CHAP provides greater security than PAP, which sends authentication information in plaintext rather than using a hash function.
• Replay Protection: CHAP’s incremental identifier and random challenge value prevent an attacker from replaying a legitimate response from a legitimate user to gain access.

Downsides of CHAP

However, CHAP also has its disadvantages as well, which include:

• Pre-Shared Key: CHAP is reliant on a pre-shared key to authenticate users. This can limit the protocol’s scalability.
• One-Way Authentication: CHAP authenticates the client to the server but doesn’t offer mutual authentication.
• Vulnerability to On-Path Attacks: CHAP is vulnerable to on-path attacks in which an attacker intercepts CHAP packets between a client and server and uses them to authenticate itself to the server.
• Vulnerability to Dictionary Attacks: If CHAP packets are not encrypted, an attacker can intercept CHAP messages and perform a dictionary attack or brute-force search to determine the shared secret.

Conclusion

CHAP is an authentication protocol originally used by PPP that has been adopted by other protocols as well. It uses a three-step process to authenticate users and is more secure than PAP but also has its drawbacks, such as vulnerability to on-path attacks and a reliance on a pre-shared key for authentication.