CHAP: Challenge Handshake Authentication Protocol for PPP

Challenge Handshake Authentication Protocol (CHAP) is used to periodically verify the identity of the peer using a 3-way handshake. This is done upon initial link establishment and may be repeated any time after the link has been established.

• After the Link Establishment phase is complete, the authenticator sends a "challenge" message to the peer.
• The peer responds with a value calculated using a "one-way hash" function.
• The authenticator checks the response against its own calculation of the expected hash value. If the values match, the authentication is acknowledged; otherwise the connection SHOULD be terminated.
• At random intervals, the authenticator sends a new challenge to the peer, and repeats steps 1 to 3.

CHAP provides protection against playback attack by the peer through the use of an incrementally changing identifier and a variable challenge value. The use of repeated challenges is intended to limit the time of exposure to any single attack. The authenticator is in control of the frequency and timing of the challenges.

This authentication method depends upon a "secret" known only to the authenticator and that peer. The secret is not sent over the link.

Although the authentication is only one-way, by negotiating CHAP in both directions the same secret set may easily be used for mutual authentication.

Since CHAP may be used to authenticate many different systems, name fields may be used as an index to locate the proper secret in a large table of secrets. This also makes it possible to support more than one name/secret pair per system, and to change the secret in use at any time during the session.

Protocol Structure - CHAP: Challenge Handshake Authentication Protocol
Configuration Option for CHAP:

8	16	32	40bit
Type	Length	Authentication-Protocol	Algorithm

• Type - 3
• Length - 5
• Authentication-Protocol - C223 (Hex) for CHAP
• Algorithm The Algorithm field is one octet and indicates the authentication method to be used.

One CHAP packet is encapsulated in the Information field of a PPP data link layer frame where the protocol field indicates type hex c223. The structure of the CHAP packet is shown in the following illustration.

• Code - Identifies the type of CHAP packet. CHAP codes are assigned as follows:
• Challenge
• Response
• Success
• Failure
• Identifier - Aids in matching challenges, responses and replies.
• Length - Length of the CHAP packet including the Code, Identifier, Length and Data fields.
• Data - Zero or more octets, the format of which is determined by the Code field.
• For Success and Failure, the data field contains a variable message field which is implementation dependent.

CHAP is defined by IETF (http://www.ietf.org ) RFC 1994.

http://www.javvin.com/protocol/rfc1994.pdf : PPP Challenge Handshake Authentication Protocol (CHAP).