Making sense of remote access

DIAL-UP AUTHENTICATION

PROTOCOL

WHEN USED

NOTES

Password Authentication Protocol (PAP)

Used only when the server requires a plaintext password.

This protocol passes the password without encryption and so is not secure.

Shiva Password Authentication Protocol (SPAP)

Developed as an improvement to PAP for use with Shiva LAN Rover products.

Uses a very weak encryption scheme.

Challenge Handshake Authentication Protocol (CHAP)

Probably the most commonly used dial-up protocol for authentication.

Uses reversibly encrypted passwords for greater security.  However, the passwords are stored on the RAS server in plaintext.

Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) Version 1

As a Microsoft proprietary protocol, MS-CHAP was developed for use with the Windows operating system.

Similar to CHAP but allows storage of passwords on the server in encrypted format.

Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) Version 2

As a Microsoft proprietary protocol, MS-CHAP was developed for use with the Windows operating system.

Similar to MS-CHAP Version 1 but requires mutual authentication and different encryption keys when sending and receiving, and so is more secure than MS-CHAP v. 1.

Extensible Authentication Protocol (EAP)

EAP was designed as an extension to PPP to be able to use newer authentication methods such as one-time passwords, smart cards, or biometric techniques.

There are two different types of EAP, and both the server and client must be using the same type:
·  

EAP-MD5 CHAP Used primarily for password-based security·  

EAP-TLS Used primarily for certificate-based security.