File: rfc1334.txt

package info (click to toggle)
doc-rfc 20181229-2
  • links: PTS, VCS
  • area: non-free
  • in suites: buster
  • size: 570,944 kB
  • sloc: xml: 285,646; sh: 107; python: 90; perl: 42; makefile: 14
file content (899 lines) | stat: -rw-r--r-- 33,248 bytes parent folder | download | duplicates (8)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899






Network Working Group                                           B. Lloyd
Request for Comments: 1334                                           L&A
                                                              W. Simpson
                                                              Daydreamer
                                                            October 1992


                      PPP Authentication Protocols

Status of this Memo

   This RFC specifies an IAB standards track protocol for the Internet
   community, and requests discussion and suggestions for improvements.
   Please refer to the current edition of the "IAB Official Protocol
   Standards" for the standardization state and status of this protocol.
   Distribution of this memo is unlimited.

Abstract

   The Point-to-Point Protocol (PPP) [1] provides a standard method of
   encapsulating Network Layer protocol information over point-to-point
   links.  PPP also defines an extensible Link Control Protocol, which
   allows negotiation of an Authentication Protocol for authenticating
   its peer before allowing Network Layer protocols to transmit over the
   link.

   This document defines two protocols for Authentication: the Password
   Authentication Protocol and the Challenge-Handshake Authentication
   Protocol.  This memo is the product of the Point-to-Point Protocol
   Working Group of the Internet Engineering Task Force (IETF).
   Comments on this memo should be submitted to the ietf-ppp@ucdavis.edu
   mailing list.

Table of Contents

   1.  Introduction ...............................................    2
   1.1 Specification Requirements .................................    2
   1.2 Terminology ................................................    3
   2. Password Authentication Protocol ............................    3
   2.1 Configuration Option Format ................................    4
   2.2 Packet Format ..............................................    5
   2.2.1 Authenticate-Request .....................................    5
   2.2.2 Authenticate-Ack and Authenticate-Nak ....................    7
   3. Challenge-Handshake Authentication Protocol..................    8
   3.1 Configuration Option Format ................................    9
   3.2 Packet Format ..............................................   10
   3.2.1 Challenge and Response ...................................   11
   3.2.2 Success and Failure ......................................   13



Lloyd & Simpson                                                 [Page 1]

RFC 1334                   PPP Authentication               October 1992


   SECURITY CONSIDERATIONS ........................................   14
   REFERENCES .....................................................   15
   ACKNOWLEDGEMENTS ...............................................   16
   CHAIR'S ADDRESS ................................................   16
   AUTHOR'S ADDRESS ...............................................   16

1.  Introduction

   PPP has three main components:

      1. A method for encapsulating datagrams over serial links.

      2. A Link Control Protocol (LCP) for establishing, configuring,
         and testing the data-link connection.

      3. A family of Network Control Protocols (NCPs) for establishing
         and configuring different network-layer protocols.

   In order to establish communications over a point-to-point link, each
   end of the PPP link must first send LCP packets to configure the data
   link during Link Establishment phase.  After the link has been
   established, PPP provides for an optional Authentication phase before
   proceeding to the Network-Layer Protocol phase.

   By default, authentication is not mandatory.  If authentication of
   the link is desired, an implementation MUST specify the
   Authentication-Protocol Configuration Option during Link
   Establishment phase.

   These authentication protocols are intended for use primarily by
   hosts and routers that connect to a PPP network server via switched
   circuits or dial-up lines, but might be applied to dedicated links as
   well.  The server can use the identification of the connecting host
   or router in the selection of options for network layer negotiations.

   This document defines the PPP authentication protocols.  The Link
   Establishment and Authentication phases, and the Authentication-
   Protocol Configuration Option, are defined in The Point-to-Point
   Protocol (PPP) [1].

1.1.  Specification Requirements

   In this document, several words are used to signify the requirements
   of the specification.  These words are often capitalized.

   MUST
      This word, or the adjective "required", means that the definition
      is an absolute requirement of the specification.



Lloyd & Simpson                                                 [Page 2]

RFC 1334                   PPP Authentication               October 1992


   MUST NOT
      This phrase means that the definition is an absolute prohibition
      of the specification.

   SHOULD
      This word, or the adjective "recommended", means that there may
      exist valid reasons in particular circumstances to ignore this
      item, but the full implications should be understood and carefully
      weighed before choosing a different course.

   MAY
      This word, or the adjective "optional", means that this item is
      one of an allowed set of alternatives.  An implementation which
      does not include this option MUST be prepared to interoperate with
      another implementation which does include the option.

1.2.  Terminology

   This document frequently uses the following terms:

   authenticator
      The end of the link requiring the authentication.  The
      authenticator specifies the authentication protocol to be used in
      the Configure-Request during Link Establishment phase.

   peer
      The other end of the point-to-point link; the end which is being
      authenticated by the authenticator.

   silently discard
      This means the implementation discards the packet without further
      processing.  The implementation SHOULD provide the capability of
      logging the error, including the contents of the silently
      discarded packet, and SHOULD record the event in a statistics
      counter.

2.  Password Authentication Protocol

   The Password Authentication Protocol (PAP) provides a simple method
   for the peer to establish its identity using a 2-way handshake.  This
   is done only upon initial link establishment.

   After the Link Establishment phase is complete, an Id/Password pair
   is repeatedly sent by the peer to the authenticator until
   authentication is acknowledged or the connection is terminated.

   PAP is not a strong authentication method.  Passwords are sent over
   the circuit "in the clear", and there is no protection from playback



Lloyd & Simpson                                                 [Page 3]

RFC 1334                   PPP Authentication               October 1992


   or repeated trial and error attacks.  The peer is in control of the
   frequency and timing of the attempts.

   Any implementations which include a stronger authentication method
   (such as CHAP, described below) MUST offer to negotiate that method
   prior to PAP.

   This authentication method is most appropriately used where a
   plaintext password must be available to simulate a login at a remote
   host.  In such use, this method provides a similar level of security
   to the usual user login at the remote host.

      Implementation Note: It is possible to limit the exposure of the
      plaintext password to transmission over the PPP link, and avoid
      sending the plaintext password over the entire network.  When the
      remote host password is kept as a one-way transformed value, and
      the algorithm for the transform function is implemented in the
      local server, the plaintext password SHOULD be locally transformed
      before comparison with the transformed password from the remote
      host.

2.1.  Configuration Option Format

   A summary of the Authentication-Protocol Configuration Option format
   to negotiate the Password Authentication Protocol is shown below.
   The fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |    Length     |     Authentication-Protocol   |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Type

      3

   Length

      4

   Authentication-Protocol

      c023 (hex) for Password Authentication Protocol.

   Data

      There is no Data field.



Lloyd & Simpson                                                 [Page 4]

RFC 1334                   PPP Authentication               October 1992


2.2.  Packet Format

   Exactly one Password Authentication Protocol packet is encapsulated
   in the Information field of a PPP Data Link Layer frame where the
   protocol field indicates type hex c023 (Password Authentication
   Protocol).  A summary of the PAP packet format is shown below.  The
   fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Code      |  Identifier   |            Length             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |    Data ...
   +-+-+-+-+

   Code

      The Code field is one octet and identifies the type of PAP packet.
      PAP Codes are assigned as follows:

         1       Authenticate-Request
         2       Authenticate-Ack
         3       Authenticate-Nak

   Identifier

      The Identifier field is one octet and aids in matching requests
      and replies.

   Length

      The Length field is two octets and indicates the length of the PAP
      packet including the Code, Identifier, Length and Data fields.
      Octets outside the range of the Length field should be treated as
      Data Link Layer padding and should be ignored on reception.

   Data

      The Data field is zero or more octets.  The format of the Data
      field is determined by the Code field.

2.2.1.  Authenticate-Request

   Description

      The Authenticate-Request packet is used to begin the Password
      Authentication Protocol.  The link peer MUST transmit a PAP packet



Lloyd & Simpson                                                 [Page 5]

RFC 1334                   PPP Authentication               October 1992


      with the Code field set to 1 (Authenticate-Request) during the
      Authentication phase.  The Authenticate-Request packet MUST be
      repeated until a valid reply packet is received, or an optional
      retry counter expires.

      The authenticator SHOULD expect the peer to send an Authenticate-
      Request packet.  Upon reception of an Authenticate-Request packet,
      some type of Authenticate reply (described below) MUST be
      returned.

         Implementation Note: Because the Authenticate-Ack might be
         lost, the authenticator MUST allow repeated Authenticate-
         Request packets after completing the Authentication phase.
         Protocol phase MUST return the same reply Code returned when
         the Authentication phase completed (the message portion MAY be
         different).  Any Authenticate-Request packets received during
         any other phase MUST be silently discarded.

         When the Authenticate-Nak is lost, and the authenticator
         terminates the link, the LCP Terminate-Request and Terminate-
         Ack provide an alternative indication that authentication
         failed.

   A summary of the Authenticate-Request packet format is shown below.
   The fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Code      |  Identifier   |            Length             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   | Peer-ID Length|  Peer-Id ...
   +-+-+-+-+-+-+-+-+-+-+-+-+
   | Passwd-Length |  Password  ...
   +-+-+-+-+-+-+-+-+-+-+-+-+-+

   Code

      1 for Authenticate-Request.

   Identifier

      The Identifier field is one octet and aids in matching requests
      and replies.  The Identifier field MUST be changed each time an
      Authenticate-Request packet is issued.






Lloyd & Simpson                                                 [Page 6]

RFC 1334                   PPP Authentication               October 1992


   Peer-ID-Length

      The Peer-ID-Length field is one octet and indicates the length of
      the Peer-ID field.

   Peer-ID

      The Peer-ID field is zero or more octets and indicates the name of
      the peer to be authenticated.

   Passwd-Length

      The Passwd-Length field is one octet and indicates the length of
      the Password field.

   Password

      The Password field is zero or more octets and indicates the
      password to be used for authentication.

2.2.2.  Authenticate-Ack and Authenticate-Nak

   Description

      If the Peer-ID/Password pair received in an Authenticate-Request
      is both recognizable and acceptable, then the authenticator MUST
      transmit a PAP packet with the Code field set to 2 (Authenticate-
      Ack).

      If the Peer-ID/Password pair received in a Authenticate-Request is
      not recognizable or acceptable, then the authenticator MUST
      transmit a PAP packet with the Code field set to 3 (Authenticate-
      Nak), and SHOULD take action to terminate the link.

   A summary of the Authenticate-Ack and Authenticate-Nak packet format
   is shown below.  The fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Code      |  Identifier   |            Length             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Msg-Length   |  Message  ...
   +-+-+-+-+-+-+-+-+-+-+-+-+-

   Code

      2 for Authenticate-Ack;



Lloyd & Simpson                                                 [Page 7]

RFC 1334                   PPP Authentication               October 1992


      3 for Authenticate-Nak.

   Identifier

      The Identifier field is one octet and aids in matching requests
      and replies.  The Identifier field MUST be copied from the
      Identifier field of the Authenticate-Request which caused this
      reply.

   Msg-Length

      The Msg-Length field is one octet and indicates the length of the
      Message field.

   Message

      The Message field is zero or more octets, and its contents are
      implementation dependent.  It is intended to be human readable,
      and MUST NOT affect operation of the protocol.  It is recommended
      that the message contain displayable ASCII characters 32 through
      126 decimal.  Mechanisms for extension to other character sets are
      the topic of future research.

3.  Challenge-Handshake Authentication Protocol

   The Challenge-Handshake Authentication Protocol (CHAP) is used to
   periodically verify the identity of the peer using a 3-way handshake.
   This is done upon initial link establishment, and MAY be repeated
   anytime after the link has been established.

   After the Link Establishment phase is complete, the authenticator
   sends a "challenge" message to the peer.  The peer responds with a
   value calculated using a "one-way hash" function.  The authenticator
   checks the response against its own calculation of the expected hash
   value.  If the values match, the authentication is acknowledged;
   otherwise the connection SHOULD be terminated.

   CHAP provides protection against playback attack through the use of
   an incrementally changing identifier and a variable challenge value.
   The use of repeated challenges is intended to limit the time of
   exposure to any single attack.  The authenticator is in control of
   the frequency and timing of the challenges.

   This authentication method depends upon a "secret" known only to the
   authenticator and that peer.  The secret is not sent over the link.
   This method is most likely used where the same secret is easily
   accessed from both ends of the link.




Lloyd & Simpson                                                 [Page 8]

RFC 1334                   PPP Authentication               October 1992


      Implementation Note: CHAP requires that the secret be available in
      plaintext form.  To avoid sending the secret over other links in
      the network, it is recommended that the challenge and response
      values be examined at a central server, rather than each network
      access server.  Otherwise, the secret SHOULD be sent to such
      servers in a reversably encrypted form.

   The CHAP algorithm requires that the length of the secret MUST be at
   least 1 octet.  The secret SHOULD be at least as large and
   unguessable as a well-chosen password.  It is preferred that the
   secret be at least the length of the hash value for the hashing
   algorithm chosen (16 octets for MD5).  This is to ensure a
   sufficiently large range for the secret to provide protection against
   exhaustive search attacks.

   The one-way hash algorithm is chosen such that it is computationally
   infeasible to determine the secret from the known challenge and
   response values.

   The challenge value SHOULD satisfy two criteria: uniqueness and
   unpredictability.  Each challenge value SHOULD be unique, since
   repetition of a challenge value in conjunction with the same secret
   would permit an attacker to reply with a previously intercepted
   response.  Since it is expected that the same secret MAY be used to
   authenticate with servers in disparate geographic regions, the
   challenge SHOULD exhibit global and temporal uniqueness.  Each
   challenge value SHOULD also be unpredictable, least an attacker trick
   a peer into responding to a predicted future challenge, and then use
   the response to masquerade as that peer to an authenticator.
   Although protocols such as CHAP are incapable of protecting against
   realtime active wiretapping attacks, generation of unique
   unpredictable challenges can protect against a wide range of active
   attacks.

   A discussion of sources of uniqueness and probability of divergence
   is included in the Magic-Number Configuration Option [1].

3.1.  Configuration Option Format

   A summary of the Authentication-Protocol Configuration Option format
   to negotiate the Challenge-Handshake Authentication Protocol is shown
   below.  The fields are transmitted from left to right.









Lloyd & Simpson                                                 [Page 9]

RFC 1334                   PPP Authentication               October 1992


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Type      |    Length     |     Authentication-Protocol   |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |   Algorithm   |
   +-+-+-+-+-+-+-+-+

   Type

      3

   Length

      5

   Authentication-Protocol

      c223 (hex) for Challenge-Handshake Authentication Protocol.

   Algorithm

      The Algorithm field is one octet and indicates the one-way hash
      method to be used.  The most up-to-date values of the CHAP
      Algorithm field are specified in the most recent "Assigned
      Numbers" RFC [2].  Current values are assigned as follows:

         0-4     unused (reserved)
         5       MD5 [3]

3.2.  Packet Format

   Exactly one Challenge-Handshake Authentication Protocol packet is
   encapsulated in the Information field of a PPP Data Link Layer frame
   where the protocol field indicates type hex c223 (Challenge-Handshake
   Authentication Protocol).  A summary of the CHAP packet format is
   shown below.  The fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Code      |  Identifier   |            Length             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |    Data ...
   +-+-+-+-+






Lloyd & Simpson                                                [Page 10]

RFC 1334                   PPP Authentication               October 1992


   Code

      The Code field is one octet and identifies the type of CHAP
      packet.  CHAP Codes are assigned as follows:

         1       Challenge
         2       Response
         3       Success
         4       Failure

   Identifier

      The Identifier field is one octet and aids in matching challenges,
      responses and replies.

   Length

      The Length field is two octets and indicates the length of the
      CHAP packet including the Code, Identifier, Length and Data
      fields.  Octets outside the range of the Length field should be
      treated as Data Link Layer padding and should be ignored on
      reception.

   Data

      The Data field is zero or more octets.  The format of the Data
      field is determined by the Code field.

3.2.1.  Challenge and Response

   Description

      The Challenge packet is used to begin the Challenge-Handshake
      Authentication Protocol.  The authenticator MUST transmit a CHAP
      packet with the Code field set to 1 (Challenge).  Additional
      Challenge packets MUST be sent until a valid Response packet is
      received, or an optional retry counter expires.

      A Challenge packet MAY also be transmitted at any time during the
      Network-Layer Protocol phase to ensure that the connection has not
      been altered.

      The peer SHOULD expect Challenge packets during the Authentication
      phase and the Network-Layer Protocol phase.  Whenever a Challenge
      packet is received, the peer MUST transmit a CHAP packet with the
      Code field set to 2 (Response).

      Whenever a Response packet is received, the authenticator compares



Lloyd & Simpson                                                [Page 11]

RFC 1334                   PPP Authentication               October 1992


      the Response Value with its own calculation of the expected value.
      Based on this comparison, the authenticator MUST send a Success or
      Failure packet (described below).

         Implementation Note: Because the Success might be lost, the
         authenticator MUST allow repeated Response packets after
         completing the Authentication phase.  To prevent discovery of
         alternative Names and Secrets, any Response packets received
         having the current Challenge Identifier MUST return the same
         reply Code returned when the Authentication phase completed
         (the message portion MAY be different).  Any Response packets
         received during any other phase MUST be silently discarded.

         When the Failure is lost, and the authenticator terminates the
         link, the LCP Terminate-Request and Terminate-Ack provide an
         alternative indication that authentication failed.

   A summary of the Challenge and Response packet format is shown below.
   The fields are transmitted from left to right.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Code      |  Identifier   |            Length             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Value-Size   |  Value ...
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Name ...
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   Code

      1 for Challenge;

      2 for Response.

   Identifier

      The Identifier field is one octet.  The Identifier field MUST be
      changed each time a Challenge is sent.

      The Response Identifier MUST be copied from the Identifier field
      of the Challenge which caused the Response.

   Value-Size

      This field is one octet and indicates the length of the Value
      field.



Lloyd & Simpson                                                [Page 12]

RFC 1334                   PPP Authentication               October 1992


   Value

      The Value field is one or more octets.  The most significant octet
      is transmitted first.

      The Challenge Value is a variable stream of octets.  The
      importance of the uniqueness of the Challenge Value and its
      relationship to the secret is described above.  The Challenge
      Value MUST be changed each time a Challenge is sent.  The length
      of the Challenge Value depends upon the method used to generate
      the octets, and is independent of the hash algorithm used.

      The Response Value is the one-way hash calculated over a stream of
      octets consisting of the Identifier, followed by (concatenated
      with) the "secret", followed by (concatenated with) the Challenge
      Value.  The length of the Response Value depends upon the hash
      algorithm used (16 octets for MD5).

   Name

      The Name field is one or more octets representing the
      identification of the system transmitting the packet.  There are
      no limitations on the content of this field.  For example, it MAY
      contain ASCII character strings or globally unique identifiers in
      ASN.1 syntax.  The Name should not be NUL or CR/LF terminated.
      The size is determined from the Length field.

      Since CHAP may be used to authenticate many different systems, the
      content of the name field(s) may be used as a key to locate the
      proper secret in a database of secrets.  This also makes it
      possible to support more than one name/secret pair per system.

3.2.2.  Success and Failure

   Description

      If the Value received in a Response is equal to the expected
      value, then the implementation MUST transmit a CHAP packet with
      the Code field set to 3 (Success).

      If the Value received in a Response is not equal to the expected
      value, then the implementation MUST transmit a CHAP packet with
      the Code field set to 4 (Failure), and SHOULD take action to
      terminate the link.

   A summary of the Success and Failure packet format is shown below.
   The fields are transmitted from left to right.




Lloyd & Simpson                                                [Page 13]

RFC 1334                   PPP Authentication               October 1992


    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     Code      |  Identifier   |            Length             |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Message  ...
   +-+-+-+-+-+-+-+-+-+-+-+-+-

   Code

      3 for Success;

      4 for Failure.

   Identifier

      The Identifier field is one octet and aids in matching requests
      and replies.  The Identifier field MUST be copied from the
      Identifier field of the Response which caused this reply.

   Message

      The Message field is zero or more octets, and its contents are
      implementation dependent.  It is intended to be human readable,
      and MUST NOT affect operation of the protocol.  It is recommended
      that the message contain displayable ASCII characters 32 through
      126 decimal.  Mechanisms for extension to other character sets are
      the topic of future research.  The size is determined from the
      Length field.

Security Considerations

      Security issues are the primary topic of this RFC.

      The interaction of the authentication protocols within PPP are
      highly implementation dependent.  This is indicated by the use of
      SHOULD throughout the document.

      For example, upon failure of authentication, some implementations
      do not terminate the link.  Instead, the implementation limits the
      kind of traffic in the Network-Layer Protocols to a filtered
      subset, which in turn allows the user opportunity to update
      secrets or send mail to the network administrator indicating a
      problem.

      There is no provision for re-tries of failed authentication.
      However, the LCP state machine can renegotiate the authentication
      protocol at any time, thus allowing a new attempt.  It is



Lloyd & Simpson                                                [Page 14]

RFC 1334                   PPP Authentication               October 1992


      recommended that any counters used for authentication failure not
      be reset until after successful authentication, or subsequent
      termination of the failed link.

      There is no requirement that authentication be full duplex or that
      the same protocol be used in both directions.  It is perfectly
      acceptable for different protocols to be used in each direction.
      This will, of course, depend on the specific protocols negotiated.

      In practice, within or associated with each PPP server, there is a
      database which associates "user" names with authentication
      information ("secrets").  It is not anticipated that a particular
      named user would be authenticated by multiple methods.  This would
      make the user vulnerable to attacks which negotiate the least
      secure method from among a set (such as PAP rather than CHAP).
      Instead, for each named user there should be an indication of
      exactly one method used to authenticate that user name.  If a user
      needs to make use of different authentication method under
      different circumstances, then distinct user names SHOULD be
      employed, each of which identifies exactly one authentication
      method.

      Passwords and other secrets should be stored at the respective
      ends such that access to them is as limited as possible.  Ideally,
      the secrets should only be accessible to the process requiring
      access in order to perform the authentication.

      The secrets should be distributed with a mechanism that limits the
      number of entities that handle (and thus gain knowledge of) the
      secret.  Ideally, no unauthorized person should ever gain
      knowledge of the secrets.  It is possible to achieve this with
      SNMP Security Protocols [4], but such a mechanism is outside the
      scope of this specification.

      Other distribution methods are currently undergoing research and
      experimentation.  The SNMP Security document also has an excellent
      overview of threats to network protocols.

References

   [1] Simpson, W., "The Point-to-Point Protocol (PPP)", RFC 1331,
       Daydreamer, May 1992.

   [2] Reynolds, J., and J. Postel, "Assigned Numbers", RFC 1340,
       USC/Information Sciences Institute, July 1992.






Lloyd & Simpson                                                [Page 15]

RFC 1334                   PPP Authentication               October 1992


   [3] Rivest, R., and S. Dusse, "The MD5 Message-Digest Algorithm", MIT
       Laboratory for Computer Science and RSA Data Security, Inc.  RFC
       1321, April 1992.

   [4] Galvin, J., McCloghrie, K., and J. Davin, "SNMP Security
       Protocols", Trusted Information Systems, Inc., Hughes LAN
       Systems, Inc., MIT Laboratory for Computer Science, RFC 1352,
       July 1992.

Acknowledgments

   Some of the text in this document is taken from RFC 1172, by Drew
   Perkins of Carnegie Mellon University, and by Russ Hobby of the
   University of California at Davis.

   Special thanks to Dave Balenson, Steve Crocker, James Galvin, and
   Steve Kent, for their extensive explanations and suggestions.  Now,
   if only we could get them to agree with each other.

Chair's Address

   The working group can be contacted via the current chair:

      Brian Lloyd
      Lloyd & Associates
      3420 Sudbury Road
      Cameron Park, California 95682

      Phone: (916) 676-1147

      EMail: brian@lloyd.com

Author's Address

   Questions about this memo can also be directed to:

      William Allen Simpson
      Daydreamer
      Computer Systems Consulting Services
      P O Box 6205
      East Lansing, MI  48826-6205

      EMail: Bill.Simpson@um.cc.umich.edu








Lloyd & Simpson                                                [Page 16]