H3C Technologies H3C WA2600 Series WLAN Access Points - Manual (Page 12)

4-2
Figure 4-1 PAP Authentication
During PAP authentication, the password is transmitted on the link in plain text. In addition, the
authenticatee sends the username and the password repeatedly through the established PPP link until
the authentication is over. Therefore, PAP is not a secure authentication protocol. It cannot prevent
attacks.
CHAP authentication
CHAP is a three-way handshake authentication protocol using cipher text password.
Currently, two types of CHAP authentication exist: one-way CHAP authentication and two-way CHAP
authentication. In one-way CHAP authentication, one side of the link acts as the authenticator and the
other acts as the authenticatee. In two-way authentication, each side serves as both the authenticator
and the authenticatee. Normally, one-way CHAP authentication is adopted.
In one-way CHAP authentication, the authenticator may or may not be configured with a username. It is
recommended that you configure a username for the authenticator, which makes it easier to identify the
authenticator.
When the authenticator is configured with a username, CHAP authentication is performed as follows:
1) The authenticator initiates an authentication by sending a randomly-generated packet (Challenge)
to the authenticatee. The packet carries the local username with it.
2) When the authenticatee receives the authentication request, it searches the local user list for the
password of the username carried in the received packet, encrypts the packet using the MD5
algorithm, with the packet ID and the password as the parameters, and then sends the encrypted
packet and the local username to the authenticator (Response).
3) The authenticator encrypts the original randomly-generated packet using the MD5 algorithm, with
the password of the authenticatee it maintains as the parameter, compares the encrypted packet
with the one received from the authenticatee, and returns an Acknowledge or Not Acknowledge
packet depending on the comparison result.
When the authenticator is not configured with a username, the CHAP authentication is performed as
follows:
4) The authenticator initiates an authentication by sending a randomly-generated packet (Challenge)
to the authenticatee.