IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
S 5.50 Authentication via PAP/CHAP
Initiation responsibility: IT Security Management, Administrators
Implementation responsibility: Administrators
Many ISDN cards support communications via a Point-to-Point Protocol
(RFC 1661) after an ISDN switched connection has been established. This
Internet standard also offers authentication protocols such as the Password
Authentication Protocol (PAP) and the Challenge Handshake Authentication
Protocol (CHAP) (RFC 1994). If the ISDN card in use provides these
functions, authentication should be performed with the Challenge-Handshake
Authentication Protocol instead of the Password Authentication Protocol,
because in the case of the latter, the password used for authentication is
transmitted in plain-text form.
As a rule, the passwords used by PAP and CHAP are stored in the IT systems,
so that they do not have to be entered by the user each time authentication is
required. To allow continued use of these processes following a re-installation,
the required passwords should be noted down and kept in a safe place (refer to
S 2.22 Depositing of passwords).
Mode of operation:
CHAP always distinguishes between two types of communication partner:
authenticator and peer. The authenticator is the communication partner
requesting authentication, while the peer is the communication partner
needing to submit authentication. In general therefore, the authenticator
comprises the server which users need to log into as peers from their
respective IT systems.
CHAP checks for the recognition of a common secret (password) on both
communicating sides. This password is not transferred as plain text through
the communications lines, and is protected against replay by integrating
random numbers.
A Challenge-Response-Protocol is sequenced as follows:
To start with, the authenticator computes a random number. The hash value of
the computed, random number is then formed using a hash algorithm. A hash
function is a computing instruction which converts inputs of any length into
outputs of a fixed (usually shorter) length. A one-way hash function only
works in one direction, i.e. it easily allows hash values to be calculated from
inputs, but makes it very difficult, if not impossible, to calculate inputs
corresponding to hash values.
In the next step, the authenticator transfers the challenge, i.e. the random
number just calculated, to the peer. As the authenticator and peer both possess
the same hash algorithm, the peer is able to form the hash value of the
transferred random number in a fourth step. The peer calculates the hash value
using three parameters: the identifier (user ID), secret (password) and the
transferred random number. It then transmits the hash value as a response to
the authenticator. The authenticator checks the correctness of the password by
also calculating the corresponding hash value and comparing it with the
received one. If the comparison is positive, the peer has been successfully
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000