Cheating CHAP

The Challenge Handshake Authentication Protocol (CHAP) is used to verify the identity of a peer in a 3-way handshake and is usually embedded in other protocols, commonly PPP. Several extensions (MS-CHAP) exist to allow the encryption of link layer packets via CHAP authenticated connections. In this paper I will describe how CHAP may be attacked, gaining unauthorized access to CHAP protected dialins or VPN’s and show that CHAP is not the right protocol to authenticate clients in IP networks. Disclaimer This material 1 is for educational purposes only. It demonstrates weaknesses within authentication schemes often used in wireless networks for example. All described tests and captures have been done in my own private LAN. It is strongly recommended that you do not test these programs without prior written permission of the local authorities.