View source for Challenge Handshake Authentication Protocol

== Challenge Handshake Authentication Protocol (CHAP) ==

The '''Challenge Handshake Authentication Protocol''' (CHAP) is an authentication protocol used to verify the identity of a user or client device attempting to connect to a network. CHAP is a secure method that prevents transmission of plaintext passwords over the network. It is commonly used with Point-to-Point Protocol (PPP) connections.

=== Operation ===

When a user or client device initiates a connection to a network using PPP, the network access server (NAS) challenges the client to prove its identity. The NAS sends a random string, known as a challenge, to the client. The client combines the challenge with its password using a cryptographic hash function, such as MD5, and sends the result back to the NAS. The NAS independently performs the same calculation using its copy of the client's password. If the calculated values match, authentication is successful.

=== Security ===

CHAP provides stronger security compared to plaintext authentication protocols like Password Authentication Protocol (PAP) because it does not transmit passwords over the network. Instead, it uses a cryptographic hash function to verify passwords without exposing them to eavesdropping or password sniffing attacks.

=== Advantages ===

* CHAP provides stronger security compared to plaintext authentication protocols like PAP.
* It prevents transmission of passwords over the network, reducing the risk of unauthorized access.

=== Disadvantages ===

* CHAP requires both the client and server to store plaintext copies of the password or an equivalent reversible representation, which poses a security risk if these credentials are compromised.
* It requires more computational resources compared to plaintext authentication protocols.

=== Alternatives ===

Alternative authentication protocols include Password Authentication Protocol (PAP), which transmits passwords in plaintext, and Extensible Authentication Protocol (EAP), which supports a variety of authentication methods, including more secure mechanisms like Transport Layer Security (TLS) and digital certificates.

== See Also ==
* [[Point-to-Point_Protocol|Point-to-Point Protocol (PPP)]]
* [[Password_Authentication_Protocol|Password Authentication Protocol (PAP)]]
* [[Extensible_Authentication_Protocol|Extensible Authentication Protocol (EAP)]]
* [[MD5|Message Digest Algorithm 5 (MD5)]]

== References ==
* [https://tools.ietf.org/html/rfc1994 RFC 1994 - PPP Challenge Handshake Authentication Protocol (CHAP)]

[[Category:Protocols]]