Password Authentication Protocol: Difference between revisions

Revision as of 19:24, 13 April 2022

Latest revision as of 04:16, 28 March 2025

(6 intermediate revisions by 6 users not shown)

Line 1:

'''Password Authentication Protocol''' ('''PAP''') is a [[password]]-based [[authentication protocol]] used by [[Point -to Point Protocol|Point to -Point Protocol]] (PPP)]] to validate users.<ref>{{Cite web|date=2018-07-17|title=Password Authentication Protocol (PAP)|url=https://www.geeksforgeeks.org/password-authentication-protocol-pap/|access-date=2020-11-08|website=GeeksforGeeks|language=en-US}}</ref> PAP is specified in {{IETF RFC|1334}}.

Almost all [[network operating system]]s support PPP with PAP, as do most [[network access server]]s. PAP is also used in [[PPPoE]], for authenticating DSL users.

As the [[Point -to Point Protocol|Point to -Point Protocol]] (PPP)]] sends data unencrypted and "in the clear", PAP is vulnerable to any attacker who can observe the PPP session. An attacker can see the users name, password, and any other information associated with the PPP session. Some additional security can be gained on the PPP link by using [[Challenge-handshakeHandshake authenticationAuthentication protocolProtocol|CHAP]] or [[Extensible Authentication Protocol|EAP]]. However, there are always tradeoffs when choosing an authentication method, and there is no single answer for which is more secure.

When PAP is used in PPP, it is considered a weak authentication scheme. Weak schemes are simpler and have lighter [[overhead (computing)|computational overhead]] than more complex schemes, such as [[TLS|Transport Layer Security]] (TLS)]], but they are much more vulnerable to attack. While weakWeak schemes are used where the transport layer is expected to be physically secure, such as a home [[DSL]] link. Where the transport layer is not physically secure a system such as [[TLS|Transport Layer Security (TLS)]] or [[IPSec|Internet Protocol Security]] (IPsec)]] is used instead.

===Other Usesuses of PAP===

PAP is also used to describe password authentication in other protocols such as [[RADIUS]] and [[Diameter (protocol)|Diameter]]. However, those protocols provide for transport or network layer security, and thistherefore that usage of PAP dodoes not have the security issues seen when PAP is used with PPP.

===Benefits of PAP===

PAP is also used to describe password authentication in other protocols such as [[RADIUS]] and [[Diameter]]. However, those protocols provide for transport or network layer security, and this do not have the security issues seen when PAP is used with PPP.

When the client sends a clear-text password, the authentication server will receive it, and compare it to a "known good" password. Since the authentication server has received the password in clear-text, the [[Password#Form_of_stored_passwordsForm of stored passwords|format of the stored password]] can be chosen to be secure "at rest". If an attacker were to steal the entire database of passwords, it is computationally infeasible to reverse the function to recover a plaintext password.

===Benefits of PAP===

When the client sends a clear-text password, the authentication server will receive it, and compare it to a "known good" password. Since the authentication server has received the password in clear-text, the [[Password#Form_of_stored_passwords|format of the stored password]] can be chosen to be secure "at rest". If an attacker were to steal the entire database of passwords, it is computationally infeasible to reverse the function to recover a plaintext password.

As a result, while PAP passwords are less secure when sent over a PPP link, they allow for more secure storage "at rest" than with other methods such as [[Challenge-handshake authentication protocol|CHAP]].

==Working cycle==

PAP authentication is only done at the time of the initial link establishment, and verifies the identity of the client using a [[HandshakingHandshake (computing)|two-way handshake]].

#Client sends username and password. This is sent repeatedly until a response is received from the server.

#Server sends authentication-ack (if credentials are OK) or authentication-nak (otherwise)<ref name="Forouzan2007">{{cite book|author=Forouzan|title=Data Commn & Networking 4E Sie|url=https://books.google.com/books?id=6HaNKmfBK1oC&pg=PA352|accessdate=24 November 2012|year=2007|publisher=McGraw-Hill Education (India) Pvt Limited|isbn=978-0-07-063414-5|pages=352–}}</ref>

==PAP Packetspackets==

{| class="wikitable"

|-

!

Description

Line 66 ⟶ 63:

C023 (hex).

{| class="wikitable"

|-

!Flag

!Address

Line 77 ⟶ 73:

==See also==

* SAP -– [[Service Access Point]]

==Notes==

Line 87 ⟶ 83:

{{Authentication APIs}}

{{DEFAULTSORT:Password Authentication Protocol}}

[[Category:Password authentication]]

[[Category:Internet protocols]]

[[Category:Authentication protocols]]

{{Compu-network-stub}}