Microsoft pptp vpn vulnerabilities Exploits in Action

CHAP (Challenge Handshake Authentication Protocol)
RFC 1994 
http://www.ietf.org/rfc/rfc1994.txt
describes CHAP in 
detail. A (very) brief summary follows:
RFC Abstract 
“The Point-to-Point Protocol (PPP) [1] provides a 
standard method for transporting multi-protocol datagrams over point-to-point 
links. PPP also defines an extensible Link Control Protocol, which allows 
negotiation of an Authentication Protocol for authenticating its peer before 
allowing Network Layer protocols to transmit over the link…”
[a method which] “…
uses a random Challenge, with a cryptographically hashed 
Response which depends upon the Challenge and a secret key.”
After PPP establishes a LCP link PPP makes available the OPTION (not 
required) to use an authentication method before going to the next phase, NCP.
CHAP is used during the initial connection and might be repeated 
occasionally throughout the session to verify identity.
A three-way “handshake” is used during these events.
The three steps (possibly repeated regularly) are:
Authenticator sends a “Challenge” message request to the peer.
0

---