Challenge-Handshake Authentication Protocol: Difference between revisions

Revision as of 09:06, 23 November 2022

Revision as of 15:33, 23 April 2024

Line 10:

==Benefits of CHAP==

When the peer sends CHAP, the authentication server will receive it, and obtain the "known good" password from a database, and perform the CHAP calculations. If the resulting hashes match, then the user is deemed to be authenticated. If the hashes do not match, then the usersuser's authentication attempt is rejected.

Since the authentication server has to store the password in clear-text, it is impossible to use different [[Password#Form of stored passwords|formats for the stored password]]. If an attacker were to steal the entire database of passwords, all of those passwords would be visible "in the clear" in the database.