- [Instructor] Many access control systems
rely upon password-based mechanisms
to implement something-you-know security.
One of the most common applications of password security
is to secure virtual private networks
and other remote access technologies.
Let's take a look at the protocols used
to implement remote access password security.
The Password Authentication Protocol, or PAP,
is the earliest of these protocols.
In this protocol,
the client wishes to authenticate to a server,
and both the client and server know the user's password.
The client simply transmits the username
and password to the server,
and the server validates the password.
That's about as simple as it gets
and successfully implements password authentication,
but there's one major flaw to this protocol.
PAP does not use any encryption
to protect this communication.
Anyone able to eavesdrop on the connection
can read the username and password right off the network.
For this reason, PAP should not be used,
except under circumstances where the transmission
is encrypted by other means.
The Challenge Handshake Authentication Protocol, or CHAP,
is a secure alternative to PAP
that accomplishes the same objective
by a much more secure mechanism.
In CHAP, both the client and the server
have prior knowledge of a shared secret.
Neither wishes to transmit that secret over the network
because it would compromise the security of the system.
Instead, they work through a process where they prove
to each other that they both know the secret
without actually exchanging the secret value
over the network.
Here's how it works.
Once they establish the link,
the server sends a random value to the client.
This is known as the challenge value.
When the client receives the challenge,
it combines the challenge with the secret
and computes a cryptographic hash of the two values.
This hash is irreversible,
meaning that it is not possible to retrieve the input
if you have the hash output.
The client then transmits the hash value to the server.
This is known as the response value.
The server receives the response and stores it in memory.
The server then computes its own hash value
by using the same hash function
on the challenge it sent to the client
and the shared secret that they both know.
The server then compares the response it computed
with the response received from the client.
If the two values match,
the server knows that the client's secret
is identical to the server's secret,
and it authenticates the client without ever having
to send the actual secret password over the network.
CHAP is a much more secure alternative to PAP
and an acceptable technology for use
in modern secure applications.