Difference between revisions of "RFC1334"
From RFC-Wiki
imported>Admin (Created page with " Network Working Group B. Lloyd Request for Comments: 1334 L&A ...") |
|||
| Line 1: | Line 1: | ||
| − | |||
| Line 10: | Line 9: | ||
Daydreamer | Daydreamer | ||
October 1992 | October 1992 | ||
| − | |||
PPP Authentication Protocols | PPP Authentication Protocols | ||
| − | |||
Status of this Memo | Status of this Memo | ||
| − | |||
This RFC specifies an IAB standards track protocol for the Internet | This RFC specifies an IAB standards track protocol for the Internet | ||
community, and requests discussion and suggestions for improvements. | community, and requests discussion and suggestions for improvements. | ||
| Line 21: | Line 17: | ||
Standards" for the standardization state and status of this protocol. | Standards" for the standardization state and status of this protocol. | ||
Distribution of this memo is unlimited. | Distribution of this memo is unlimited. | ||
| − | |||
Abstract | Abstract | ||
| − | |||
The Point-to-Point Protocol (PPP) [1] provides a standard method of | The Point-to-Point Protocol (PPP) [1] provides a standard method of | ||
encapsulating Network Layer protocol information over point-to-point | encapsulating Network Layer protocol information over point-to-point | ||
| Line 30: | Line 24: | ||
its peer before allowing Network Layer protocols to transmit over the | its peer before allowing Network Layer protocols to transmit over the | ||
link. | link. | ||
| − | |||
This document defines two protocols for Authentication: the Password | This document defines two protocols for Authentication: the Password | ||
Authentication Protocol and the Challenge-Handshake Authentication | Authentication Protocol and the Challenge-Handshake Authentication | ||
| Line 37: | Line 30: | ||
Comments on this memo should be submitted to the [email protected] | Comments on this memo should be submitted to the [email protected] | ||
mailing list. | mailing list. | ||
| + | Table of Contents | ||
| + | 1. Introduction ............................................... 2 | ||
| + | 1.1 Specification Requirements ................................. 2 | ||
| + | 1.2 Terminology ................................................ 3 | ||
| + | 2. Password Authentication Protocol ............................ 3 | ||
| + | 2.1 Configuration Option Format ................................ 4 | ||
| + | 2.2 Packet Format .............................................. 5 | ||
| + | 2.2.1 Authenticate-Request ..................................... 5 | ||
| + | 2.2.2 Authenticate-Ack and Authenticate-Nak .................... 7 | ||
| + | 3. Challenge-Handshake Authentication Protocol.................. 8 | ||
| + | 3.1 Configuration Option Format ................................ 9 | ||
| + | 3.2 Packet Format .............................................. 10 | ||
| + | 3.2.1 Challenge and Response ................................... 11 | ||
| + | 3.2.2 Success and Failure ...................................... 13 | ||
| + | |||
| + | |||
| + | |||
| − | |||
| + | |||
| + | |||
| + | SECURITY CONSIDERATIONS ........................................ 14 | ||
| + | REFERENCES ..................................................... 15 | ||
| + | ACKNOWLEDGEMENTS ............................................... 16 | ||
| + | CHAIR'S ADDRESS ................................................ 16 | ||
| + | AUTHOR'S ADDRESS ............................................... 16 | ||
| + | == Introduction == | ||
PPP has three main components: | PPP has three main components: | ||
| − | |||
1. A method for encapsulating datagrams over serial links. | 1. A method for encapsulating datagrams over serial links. | ||
| − | |||
2. A Link Control Protocol (LCP) for establishing, configuring, | 2. A Link Control Protocol (LCP) for establishing, configuring, | ||
and testing the data-link connection. | and testing the data-link connection. | ||
| − | |||
3. A family of Network Control Protocols (NCPs) for establishing | 3. A family of Network Control Protocols (NCPs) for establishing | ||
and configuring different network-layer protocols. | and configuring different network-layer protocols. | ||
| − | |||
In order to establish communications over a point-to-point link, each | In order to establish communications over a point-to-point link, each | ||
end of the PPP link must first send LCP packets to configure the data | end of the PPP link must first send LCP packets to configure the data | ||
| Line 55: | Line 68: | ||
established, PPP provides for an optional Authentication phase before | established, PPP provides for an optional Authentication phase before | ||
proceeding to the Network-Layer Protocol phase. | proceeding to the Network-Layer Protocol phase. | ||
| − | |||
By default, authentication is not mandatory. If authentication of | By default, authentication is not mandatory. If authentication of | ||
the link is desired, an implementation MUST specify the | the link is desired, an implementation MUST specify the | ||
Authentication-Protocol Configuration Option during Link | Authentication-Protocol Configuration Option during Link | ||
Establishment phase. | Establishment phase. | ||
| − | |||
These authentication protocols are intended for use primarily by | These authentication protocols are intended for use primarily by | ||
hosts and routers that connect to a PPP network server via switched | hosts and routers that connect to a PPP network server via switched | ||
| Line 66: | Line 77: | ||
well. The server can use the identification of the connecting host | well. The server can use the identification of the connecting host | ||
or router in the selection of options for network layer negotiations. | or router in the selection of options for network layer negotiations. | ||
| − | |||
This document defines the PPP authentication protocols. The Link | This document defines the PPP authentication protocols. The Link | ||
Establishment and Authentication phases, and the Authentication- | Establishment and Authentication phases, and the Authentication- | ||
Protocol Configuration Option, are defined in The Point-to-Point | Protocol Configuration Option, are defined in The Point-to-Point | ||
Protocol (PPP) [1]. | Protocol (PPP) [1]. | ||
| − | + | === Specification Requirements === | |
| − | === Specification Requirements === | ||
| − | |||
In this document, several words are used to signify the requirements | In this document, several words are used to signify the requirements | ||
of the specification. These words are often capitalized. | of the specification. These words are often capitalized. | ||
| − | |||
MUST | MUST | ||
This word, or the adjective "required", means that the definition | This word, or the adjective "required", means that the definition | ||
is an absolute requirement of the specification. | is an absolute requirement of the specification. | ||
| + | |||
| + | |||
| Line 88: | Line 97: | ||
This phrase means that the definition is an absolute prohibition | This phrase means that the definition is an absolute prohibition | ||
of the specification. | of the specification. | ||
| − | |||
SHOULD | SHOULD | ||
This word, or the adjective "recommended", means that there may | This word, or the adjective "recommended", means that there may | ||
| Line 94: | Line 102: | ||
item, but the full implications should be understood and carefully | item, but the full implications should be understood and carefully | ||
weighed before choosing a different course. | weighed before choosing a different course. | ||
| − | |||
MAY | MAY | ||
This word, or the adjective "optional", means that this item is | This word, or the adjective "optional", means that this item is | ||
| Line 100: | Line 107: | ||
does not include this option MUST be prepared to interoperate with | does not include this option MUST be prepared to interoperate with | ||
another implementation which does include the option. | another implementation which does include the option. | ||
| − | + | === Terminology === | |
| − | === Terminology === | ||
| − | |||
This document frequently uses the following terms: | This document frequently uses the following terms: | ||
| − | |||
authenticator | authenticator | ||
The end of the link requiring the authentication. The | The end of the link requiring the authentication. The | ||
authenticator specifies the authentication protocol to be used in | authenticator specifies the authentication protocol to be used in | ||
the Configure-Request during Link Establishment phase. | the Configure-Request during Link Establishment phase. | ||
| − | |||
peer | peer | ||
The other end of the point-to-point link; the end which is being | The other end of the point-to-point link; the end which is being | ||
authenticated by the authenticator. | authenticated by the authenticator. | ||
| − | |||
silently discard | silently discard | ||
This means the implementation discards the packet without further | This means the implementation discards the packet without further | ||
| Line 120: | Line 122: | ||
discarded packet, and SHOULD record the event in a statistics | discarded packet, and SHOULD record the event in a statistics | ||
counter. | counter. | ||
| − | + | == Password Authentication Protocol == | |
| − | == Password Authentication Protocol == | ||
| − | |||
The Password Authentication Protocol (PAP) provides a simple method | The Password Authentication Protocol (PAP) provides a simple method | ||
for the peer to establish its identity using a 2-way handshake. This | for the peer to establish its identity using a 2-way handshake. This | ||
is done only upon initial link establishment. | is done only upon initial link establishment. | ||
| − | |||
After the Link Establishment phase is complete, an Id/Password pair | After the Link Establishment phase is complete, an Id/Password pair | ||
is repeatedly sent by the peer to the authenticator until | is repeatedly sent by the peer to the authenticator until | ||
authentication is acknowledged or the connection is terminated. | authentication is acknowledged or the connection is terminated. | ||
| − | |||
PAP is not a strong authentication method. Passwords are sent over | PAP is not a strong authentication method. Passwords are sent over | ||
the circuit "in the clear", and there is no protection from playback | the circuit "in the clear", and there is no protection from playback | ||
| + | |||
| + | |||
| Line 140: | Line 140: | ||
or repeated trial and error attacks. The peer is in control of the | or repeated trial and error attacks. The peer is in control of the | ||
frequency and timing of the attempts. | frequency and timing of the attempts. | ||
| − | |||
Any implementations which include a stronger authentication method | Any implementations which include a stronger authentication method | ||
(such as CHAP, described below) MUST offer to negotiate that method | (such as CHAP, described below) MUST offer to negotiate that method | ||
prior to PAP. | prior to PAP. | ||
| − | |||
This authentication method is most appropriately used where a | This authentication method is most appropriately used where a | ||
plaintext password must be available to simulate a login at a remote | plaintext password must be available to simulate a login at a remote | ||
host. In such use, this method provides a similar level of security | host. In such use, this method provides a similar level of security | ||
to the usual user login at the remote host. | to the usual user login at the remote host. | ||
| − | |||
Implementation Note: It is possible to limit the exposure of the | Implementation Note: It is possible to limit the exposure of the | ||
plaintext password to transmission over the PPP link, and avoid | plaintext password to transmission over the PPP link, and avoid | ||
| Line 158: | Line 155: | ||
before comparison with the transformed password from the remote | before comparison with the transformed password from the remote | ||
host. | host. | ||
| − | + | === Configuration Option Format === | |
| − | === Configuration Option Format === | ||
| − | |||
A summary of the Authentication-Protocol Configuration Option format | A summary of the Authentication-Protocol Configuration Option format | ||
to negotiate the Password Authentication Protocol is shown below. | to negotiate the Password Authentication Protocol is shown below. | ||
The fields are transmitted from left to right. | The fields are transmitted from left to right. | ||
| − | |||
0 1 2 3 | 0 1 2 3 | ||
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | ||
| Line 170: | Line 164: | ||
| Type | Length | Authentication-Protocol | | | Type | Length | Authentication-Protocol | | ||
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ||
| − | |||
Type | Type | ||
| − | |||
3 | 3 | ||
| − | |||
Length | Length | ||
| − | |||
4 | 4 | ||
| − | |||
Authentication-Protocol | Authentication-Protocol | ||
| − | |||
c023 (hex) for Password Authentication Protocol. | c023 (hex) for Password Authentication Protocol. | ||
| − | |||
Data | Data | ||
| + | There is no Data field. | ||
| − | |||
| Line 191: | Line 178: | ||
| − | |||
| + | === Packet Format === | ||
Exactly one Password Authentication Protocol packet is encapsulated | Exactly one Password Authentication Protocol packet is encapsulated | ||
in the Information field of a PPP Data Link Layer frame where the | in the Information field of a PPP Data Link Layer frame where the | ||
| Line 198: | Line 185: | ||
Protocol). A summary of the PAP packet format is shown below. The | Protocol). A summary of the PAP packet format is shown below. The | ||
fields are transmitted from left to right. | fields are transmitted from left to right. | ||
| − | |||
0 1 2 3 | 0 1 2 3 | ||
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | ||
| Line 206: | Line 192: | ||
| Data ... | | Data ... | ||
+-+-+-+-+ | +-+-+-+-+ | ||
| − | |||
Code | Code | ||
| − | |||
The Code field is one octet and identifies the type of PAP packet. | The Code field is one octet and identifies the type of PAP packet. | ||
PAP Codes are assigned as follows: | PAP Codes are assigned as follows: | ||
| − | |||
1 Authenticate-Request | 1 Authenticate-Request | ||
2 Authenticate-Ack | 2 Authenticate-Ack | ||
3 Authenticate-Nak | 3 Authenticate-Nak | ||
| − | |||
Identifier | Identifier | ||
| − | |||
The Identifier field is one octet and aids in matching requests | The Identifier field is one octet and aids in matching requests | ||
and replies. | and replies. | ||
| − | |||
Length | Length | ||
| − | |||
The Length field is two octets and indicates the length of the PAP | The Length field is two octets and indicates the length of the PAP | ||
packet including the Code, Identifier, Length and Data fields. | packet including the Code, Identifier, Length and Data fields. | ||
Octets outside the range of the Length field should be treated as | Octets outside the range of the Length field should be treated as | ||
Data Link Layer padding and should be ignored on reception. | Data Link Layer padding and should be ignored on reception. | ||
| − | |||
Data | Data | ||
| − | |||
The Data field is zero or more octets. The format of the Data | The Data field is zero or more octets. The format of the Data | ||
field is determined by the Code field. | field is determined by the Code field. | ||
| − | + | ==== Authenticate-Request ==== | |
| − | ==== Authenticate-Request ==== | ||
| − | |||
Description | Description | ||
| − | |||
The Authenticate-Request packet is used to begin the Password | The Authenticate-Request packet is used to begin the Password | ||
Authentication Protocol. The link peer MUST transmit a PAP packet | Authentication Protocol. The link peer MUST transmit a PAP packet | ||
| + | |||
| + | |||
| Line 248: | Line 224: | ||
repeated until a valid reply packet is received, or an optional | repeated until a valid reply packet is received, or an optional | ||
retry counter expires. | retry counter expires. | ||
| − | |||
The authenticator SHOULD expect the peer to send an Authenticate- | The authenticator SHOULD expect the peer to send an Authenticate- | ||
Request packet. Upon reception of an Authenticate-Request packet, | Request packet. Upon reception of an Authenticate-Request packet, | ||
some type of Authenticate reply (described below) MUST be | some type of Authenticate reply (described below) MUST be | ||
returned. | returned. | ||
| − | |||
Implementation Note: Because the Authenticate-Ack might be | Implementation Note: Because the Authenticate-Ack might be | ||
lost, the authenticator MUST allow repeated Authenticate- | lost, the authenticator MUST allow repeated Authenticate- | ||
| Line 261: | Line 235: | ||
different). Any Authenticate-Request packets received during | different). Any Authenticate-Request packets received during | ||
any other phase MUST be silently discarded. | any other phase MUST be silently discarded. | ||
| − | |||
When the Authenticate-Nak is lost, and the authenticator | When the Authenticate-Nak is lost, and the authenticator | ||
terminates the link, the LCP Terminate-Request and Terminate- | terminates the link, the LCP Terminate-Request and Terminate- | ||
Ack provide an alternative indication that authentication | Ack provide an alternative indication that authentication | ||
failed. | failed. | ||
| − | |||
A summary of the Authenticate-Request packet format is shown below. | A summary of the Authenticate-Request packet format is shown below. | ||
The fields are transmitted from left to right. | The fields are transmitted from left to right. | ||
| − | |||
0 1 2 3 | 0 1 2 3 | ||
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | ||
| Line 279: | Line 250: | ||
| Passwd-Length | Password ... | | Passwd-Length | Password ... | ||
+-+-+-+-+-+-+-+-+-+-+-+-+-+ | +-+-+-+-+-+-+-+-+-+-+-+-+-+ | ||
| − | |||
Code | Code | ||
| − | |||
1 for Authenticate-Request. | 1 for Authenticate-Request. | ||
| − | |||
Identifier | Identifier | ||
| − | |||
The Identifier field is one octet and aids in matching requests | The Identifier field is one octet and aids in matching requests | ||
and replies. The Identifier field MUST be changed each time an | and replies. The Identifier field MUST be changed each time an | ||
Authenticate-Request packet is issued. | Authenticate-Request packet is issued. | ||
| + | |||
| + | |||
| Line 298: | Line 267: | ||
Peer-ID-Length | Peer-ID-Length | ||
| − | |||
The Peer-ID-Length field is one octet and indicates the length of | The Peer-ID-Length field is one octet and indicates the length of | ||
the Peer-ID field. | the Peer-ID field. | ||
| − | |||
Peer-ID | Peer-ID | ||
| − | |||
The Peer-ID field is zero or more octets and indicates the name of | The Peer-ID field is zero or more octets and indicates the name of | ||
the peer to be authenticated. | the peer to be authenticated. | ||
| − | |||
Passwd-Length | Passwd-Length | ||
| − | |||
The Passwd-Length field is one octet and indicates the length of | The Passwd-Length field is one octet and indicates the length of | ||
the Password field. | the Password field. | ||
| − | |||
Password | Password | ||
| − | |||
The Password field is zero or more octets and indicates the | The Password field is zero or more octets and indicates the | ||
password to be used for authentication. | password to be used for authentication. | ||
| − | + | ==== Authenticate-Ack and Authenticate-Nak ==== | |
| − | ==== Authenticate-Ack and Authenticate-Nak ==== | ||
| − | |||
Description | Description | ||
| − | |||
If the Peer-ID/Password pair received in an Authenticate-Request | If the Peer-ID/Password pair received in an Authenticate-Request | ||
is both recognizable and acceptable, then the authenticator MUST | is both recognizable and acceptable, then the authenticator MUST | ||
transmit a PAP packet with the Code field set to 2 (Authenticate- | transmit a PAP packet with the Code field set to 2 (Authenticate- | ||
Ack). | Ack). | ||
| − | |||
If the Peer-ID/Password pair received in a Authenticate-Request is | If the Peer-ID/Password pair received in a Authenticate-Request is | ||
not recognizable or acceptable, then the authenticator MUST | not recognizable or acceptable, then the authenticator MUST | ||
transmit a PAP packet with the Code field set to 3 (Authenticate- | transmit a PAP packet with the Code field set to 3 (Authenticate- | ||
Nak), and SHOULD take action to terminate the link. | Nak), and SHOULD take action to terminate the link. | ||
| − | |||
A summary of the Authenticate-Ack and Authenticate-Nak packet format | A summary of the Authenticate-Ack and Authenticate-Nak packet format | ||
is shown below. The fields are transmitted from left to right. | is shown below. The fields are transmitted from left to right. | ||
| − | |||
0 1 2 3 | 0 1 2 3 | ||
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | ||
| Line 341: | Line 297: | ||
| Msg-Length | Message ... | | Msg-Length | Message ... | ||
+-+-+-+-+-+-+-+-+-+-+-+-+- | +-+-+-+-+-+-+-+-+-+-+-+-+- | ||
| + | Code | ||
| + | 2 for Authenticate-Ack; | ||
| − | |||
| − | |||
| Line 351: | Line 307: | ||
3 for Authenticate-Nak. | 3 for Authenticate-Nak. | ||
| − | |||
Identifier | Identifier | ||
| − | |||
The Identifier field is one octet and aids in matching requests | The Identifier field is one octet and aids in matching requests | ||
and replies. The Identifier field MUST be copied from the | and replies. The Identifier field MUST be copied from the | ||
Identifier field of the Authenticate-Request which caused this | Identifier field of the Authenticate-Request which caused this | ||
reply. | reply. | ||
| − | |||
Msg-Length | Msg-Length | ||
| − | |||
The Msg-Length field is one octet and indicates the length of the | The Msg-Length field is one octet and indicates the length of the | ||
Message field. | Message field. | ||
| − | |||
Message | Message | ||
| − | |||
The Message field is zero or more octets, and its contents are | The Message field is zero or more octets, and its contents are | ||
implementation dependent. It is intended to be human readable, | implementation dependent. It is intended to be human readable, | ||
| Line 372: | Line 322: | ||
126 decimal. Mechanisms for extension to other character sets are | 126 decimal. Mechanisms for extension to other character sets are | ||
the topic of future research. | the topic of future research. | ||
| − | + | == Challenge-Handshake Authentication Protocol == | |
| − | == Challenge-Handshake Authentication Protocol == | ||
| − | |||
The Challenge-Handshake Authentication Protocol (CHAP) is used to | The Challenge-Handshake Authentication Protocol (CHAP) is used to | ||
periodically verify the identity of the peer using a 3-way handshake. | periodically verify the identity of the peer using a 3-way handshake. | ||
This is done upon initial link establishment, and MAY be repeated | This is done upon initial link establishment, and MAY be repeated | ||
anytime after the link has been established. | anytime after the link has been established. | ||
| − | |||
After the Link Establishment phase is complete, the authenticator | After the Link Establishment phase is complete, the authenticator | ||
sends a "challenge" message to the peer. The peer responds with a | sends a "challenge" message to the peer. The peer responds with a | ||
| Line 386: | Line 333: | ||
value. If the values match, the authentication is acknowledged; | value. If the values match, the authentication is acknowledged; | ||
otherwise the connection SHOULD be terminated. | otherwise the connection SHOULD be terminated. | ||
| − | |||
CHAP provides protection against playback attack through the use of | CHAP provides protection against playback attack through the use of | ||
an incrementally changing identifier and a variable challenge value. | an incrementally changing identifier and a variable challenge value. | ||
| Line 392: | Line 338: | ||
exposure to any single attack. The authenticator is in control of | exposure to any single attack. The authenticator is in control of | ||
the frequency and timing of the challenges. | the frequency and timing of the challenges. | ||
| − | |||
This authentication method depends upon a "secret" known only to the | This authentication method depends upon a "secret" known only to the | ||
authenticator and that peer. The secret is not sent over the link. | authenticator and that peer. The secret is not sent over the link. | ||
This method is most likely used where the same secret is easily | This method is most likely used where the same secret is easily | ||
accessed from both ends of the link. | accessed from both ends of the link. | ||
| + | |||
| + | |||
| Line 409: | Line 356: | ||
access server. Otherwise, the secret SHOULD be sent to such | access server. Otherwise, the secret SHOULD be sent to such | ||
servers in a reversably encrypted form. | servers in a reversably encrypted form. | ||
| − | |||
The CHAP algorithm requires that the length of the secret MUST be at | The CHAP algorithm requires that the length of the secret MUST be at | ||
least 1 octet. The secret SHOULD be at least as large and | least 1 octet. The secret SHOULD be at least as large and | ||
| Line 417: | Line 363: | ||
sufficiently large range for the secret to provide protection against | sufficiently large range for the secret to provide protection against | ||
exhaustive search attacks. | exhaustive search attacks. | ||
| − | |||
The one-way hash algorithm is chosen such that it is computationally | The one-way hash algorithm is chosen such that it is computationally | ||
infeasible to determine the secret from the known challenge and | infeasible to determine the secret from the known challenge and | ||
response values. | response values. | ||
| − | |||
The challenge value SHOULD satisfy two criteria: uniqueness and | The challenge value SHOULD satisfy two criteria: uniqueness and | ||
unpredictability. Each challenge value SHOULD be unique, since | unpredictability. Each challenge value SHOULD be unique, since | ||
| Line 436: | Line 380: | ||
unpredictable challenges can protect against a wide range of active | unpredictable challenges can protect against a wide range of active | ||
attacks. | attacks. | ||
| − | |||
A discussion of sources of uniqueness and probability of divergence | A discussion of sources of uniqueness and probability of divergence | ||
is included in the Magic-Number Configuration Option [1]. | is included in the Magic-Number Configuration Option [1]. | ||
| − | + | === Configuration Option Format === | |
| − | === Configuration Option Format === | ||
| − | |||
A summary of the Authentication-Protocol Configuration Option format | A summary of the Authentication-Protocol Configuration Option format | ||
to negotiate the Challenge-Handshake Authentication Protocol is shown | to negotiate the Challenge-Handshake Authentication Protocol is shown | ||
below. The fields are transmitted from left to right. | below. The fields are transmitted from left to right. | ||
| + | |||
| + | |||
| Line 463: | Line 406: | ||
| Algorithm | | | Algorithm | | ||
+-+-+-+-+-+-+-+-+ | +-+-+-+-+-+-+-+-+ | ||
| − | |||
Type | Type | ||
| − | |||
3 | 3 | ||
| − | |||
Length | Length | ||
| − | |||
5 | 5 | ||
| − | |||
Authentication-Protocol | Authentication-Protocol | ||
| − | |||
c223 (hex) for Challenge-Handshake Authentication Protocol. | c223 (hex) for Challenge-Handshake Authentication Protocol. | ||
| − | |||
Algorithm | Algorithm | ||
| − | |||
The Algorithm field is one octet and indicates the one-way hash | The Algorithm field is one octet and indicates the one-way hash | ||
method to be used. The most up-to-date values of the CHAP | method to be used. The most up-to-date values of the CHAP | ||
Algorithm field are specified in the most recent "Assigned | Algorithm field are specified in the most recent "Assigned | ||
Numbers" RFC [2]. Current values are assigned as follows: | Numbers" RFC [2]. Current values are assigned as follows: | ||
| − | |||
0-4 unused (reserved) | 0-4 unused (reserved) | ||
5 MD5 [3] | 5 MD5 [3] | ||
| − | + | === Packet Format === | |
| − | === Packet Format === | ||
| − | |||
Exactly one Challenge-Handshake Authentication Protocol packet is | Exactly one Challenge-Handshake Authentication Protocol packet is | ||
encapsulated in the Information field of a PPP Data Link Layer frame | encapsulated in the Information field of a PPP Data Link Layer frame | ||
| Line 493: | Line 425: | ||
Authentication Protocol). A summary of the CHAP packet format is | Authentication Protocol). A summary of the CHAP packet format is | ||
shown below. The fields are transmitted from left to right. | shown below. The fields are transmitted from left to right. | ||
| − | |||
0 1 2 3 | 0 1 2 3 | ||
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | ||
| Line 501: | Line 432: | ||
| Data ... | | Data ... | ||
+-+-+-+-+ | +-+-+-+-+ | ||
| + | |||
| + | |||
| Line 510: | Line 443: | ||
Code | Code | ||
| − | |||
The Code field is one octet and identifies the type of CHAP | The Code field is one octet and identifies the type of CHAP | ||
packet. CHAP Codes are assigned as follows: | packet. CHAP Codes are assigned as follows: | ||
| − | |||
1 Challenge | 1 Challenge | ||
2 Response | 2 Response | ||
3 Success | 3 Success | ||
4 Failure | 4 Failure | ||
| − | |||
Identifier | Identifier | ||
| − | |||
The Identifier field is one octet and aids in matching challenges, | The Identifier field is one octet and aids in matching challenges, | ||
responses and replies. | responses and replies. | ||
| − | |||
Length | Length | ||
| − | |||
The Length field is two octets and indicates the length of the | The Length field is two octets and indicates the length of the | ||
CHAP packet including the Code, Identifier, Length and Data | CHAP packet including the Code, Identifier, Length and Data | ||
| Line 531: | Line 458: | ||
treated as Data Link Layer padding and should be ignored on | treated as Data Link Layer padding and should be ignored on | ||
reception. | reception. | ||
| − | |||
Data | Data | ||
| − | |||
The Data field is zero or more octets. The format of the Data | The Data field is zero or more octets. The format of the Data | ||
field is determined by the Code field. | field is determined by the Code field. | ||
| − | + | ==== Challenge and Response ==== | |
| − | ==== Challenge and Response ==== | ||
| − | |||
Description | Description | ||
| − | |||
The Challenge packet is used to begin the Challenge-Handshake | The Challenge packet is used to begin the Challenge-Handshake | ||
Authentication Protocol. The authenticator MUST transmit a CHAP | Authentication Protocol. The authenticator MUST transmit a CHAP | ||
| Line 546: | Line 468: | ||
Challenge packets MUST be sent until a valid Response packet is | Challenge packets MUST be sent until a valid Response packet is | ||
received, or an optional retry counter expires. | received, or an optional retry counter expires. | ||
| − | |||
A Challenge packet MAY also be transmitted at any time during the | A Challenge packet MAY also be transmitted at any time during the | ||
Network-Layer Protocol phase to ensure that the connection has not | Network-Layer Protocol phase to ensure that the connection has not | ||
been altered. | been altered. | ||
| − | |||
The peer SHOULD expect Challenge packets during the Authentication | The peer SHOULD expect Challenge packets during the Authentication | ||
phase and the Network-Layer Protocol phase. Whenever a Challenge | phase and the Network-Layer Protocol phase. Whenever a Challenge | ||
packet is received, the peer MUST transmit a CHAP packet with the | packet is received, the peer MUST transmit a CHAP packet with the | ||
Code field set to 2 (Response). | Code field set to 2 (Response). | ||
| + | Whenever a Response packet is received, the authenticator compares | ||
| + | |||
| − | |||
| Line 565: | Line 486: | ||
Based on this comparison, the authenticator MUST send a Success or | Based on this comparison, the authenticator MUST send a Success or | ||
Failure packet (described below). | Failure packet (described below). | ||
| − | |||
Implementation Note: Because the Success might be lost, the | Implementation Note: Because the Success might be lost, the | ||
authenticator MUST allow repeated Response packets after | authenticator MUST allow repeated Response packets after | ||
| Line 574: | Line 494: | ||
(the message portion MAY be different). Any Response packets | (the message portion MAY be different). Any Response packets | ||
received during any other phase MUST be silently discarded. | received during any other phase MUST be silently discarded. | ||
| − | |||
When the Failure is lost, and the authenticator terminates the | When the Failure is lost, and the authenticator terminates the | ||
link, the LCP Terminate-Request and Terminate-Ack provide an | link, the LCP Terminate-Request and Terminate-Ack provide an | ||
alternative indication that authentication failed. | alternative indication that authentication failed. | ||
| − | |||
A summary of the Challenge and Response packet format is shown below. | A summary of the Challenge and Response packet format is shown below. | ||
The fields are transmitted from left to right. | The fields are transmitted from left to right. | ||
| − | |||
0 1 2 3 | 0 1 2 3 | ||
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 | ||
| Line 591: | Line 508: | ||
| Name ... | | Name ... | ||
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | ||
| − | |||
Code | Code | ||
| − | |||
1 for Challenge; | 1 for Challenge; | ||
| − | |||
2 for Response. | 2 for Response. | ||
| − | |||
Identifier | Identifier | ||
| − | |||
The Identifier field is one octet. The Identifier field MUST be | The Identifier field is one octet. The Identifier field MUST be | ||
changed each time a Challenge is sent. | changed each time a Challenge is sent. | ||
| − | |||
The Response Identifier MUST be copied from the Identifier field | The Response Identifier MUST be copied from the Identifier field | ||
of the Challenge which caused the Response. | of the Challenge which caused the Response. | ||
| − | |||
Value-Size | Value-Size | ||
| − | |||
This field is one octet and indicates the length of the Value | This field is one octet and indicates the length of the Value | ||
field. | field. | ||
| + | |||
| + | |||
| Line 616: | Line 527: | ||
Value | Value | ||
| − | |||
The Value field is one or more octets. The most significant octet | The Value field is one or more octets. The most significant octet | ||
is transmitted first. | is transmitted first. | ||
| − | |||
The Challenge Value is a variable stream of octets. The | The Challenge Value is a variable stream of octets. The | ||
importance of the uniqueness of the Challenge Value and its | importance of the uniqueness of the Challenge Value and its | ||
| Line 626: | Line 535: | ||
of the Challenge Value depends upon the method used to generate | of the Challenge Value depends upon the method used to generate | ||
the octets, and is independent of the hash algorithm used. | the octets, and is independent of the hash algorithm used. | ||
| − | |||
The Response Value is the one-way hash calculated over a stream of | The Response Value is the one-way hash calculated over a stream of | ||
octets consisting of the Identifier, followed by (concatenated | octets consisting of the Identifier, followed by (concatenated | ||
| Line 632: | Line 540: | ||
Value. The length of the Response Value depends upon the hash | Value. The length of the Response Value depends upon the hash | ||
algorithm used (16 octets for MD5). | algorithm used (16 octets for MD5). | ||
| − | |||
Name | Name | ||
| − | |||
The Name field is one or more octets representing the | The Name field is one or more octets representing the | ||
identification of the system transmitting the packet. There are | identification of the system transmitting the packet. There are | ||
| Line 641: | Line 547: | ||
ASN.1 syntax. The Name should not be NUL or CR/LF terminated. | ASN.1 syntax. The Name should not be NUL or CR/LF terminated. | ||
The size is determined from the Length field. | The size is determined from the Length field. | ||
| − | |||
Since CHAP may be used to authenticate many different systems, the | Since CHAP may be used to authenticate many different systems, the | ||
content of the name field(s) may be used as a key to locate the | content of the name field(s) may be used as a key to locate the | ||
proper secret in a database of secrets. This also makes it | proper secret in a database of secrets. This also makes it | ||
possible to support more than one name/secret pair per system. | possible to support more than one name/secret pair per system. | ||
| − | + | ==== Success and Failure ==== | |
| − | ==== Success and Failure ==== | ||
| − | |||
Description | Description | ||
| − | |||
If the Value received in a Response is equal to the expected | If the Value received in a Response is equal to the expected | ||
value, then the implementation MUST transmit a CHAP packet with | value, then the implementation MUST transmit a CHAP packet with | ||
the Code field set to 3 (Success). | the Code field set to 3 (Success). | ||
| − | |||
If the Value received in a Response is not equal to the expected | If the Value received in a Response is not equal to the expected | ||
value, then the implementation MUST transmit a CHAP packet with | value, then the implementation MUST transmit a CHAP packet with | ||
the Code field set to 4 (Failure), and SHOULD take action to | the Code field set to 4 (Failure), and SHOULD take action to | ||
terminate the link. | terminate the link. | ||
| − | |||
A summary of the Success and Failure packet format is shown below. | A summary of the Success and Failure packet format is shown below. | ||
The fields are transmitted from left to right. | The fields are transmitted from left to right. | ||
| + | |||
| + | |||
| Line 675: | Line 577: | ||
| Message ... | | Message ... | ||
+-+-+-+-+-+-+-+-+-+-+-+-+- | +-+-+-+-+-+-+-+-+-+-+-+-+- | ||
| − | |||
Code | Code | ||
| − | |||
3 for Success; | 3 for Success; | ||
| − | |||
4 for Failure. | 4 for Failure. | ||
| − | |||
Identifier | Identifier | ||
| − | |||
The Identifier field is one octet and aids in matching requests | The Identifier field is one octet and aids in matching requests | ||
and replies. The Identifier field MUST be copied from the | and replies. The Identifier field MUST be copied from the | ||
Identifier field of the Response which caused this reply. | Identifier field of the Response which caused this reply. | ||
| − | |||
Message | Message | ||
| − | |||
The Message field is zero or more octets, and its contents are | The Message field is zero or more octets, and its contents are | ||
implementation dependent. It is intended to be human readable, | implementation dependent. It is intended to be human readable, | ||
| Line 697: | Line 592: | ||
the topic of future research. The size is determined from the | the topic of future research. The size is determined from the | ||
Length field. | Length field. | ||
| − | |||
Security Considerations | Security Considerations | ||
| − | |||
Security issues are the primary topic of this RFC. | Security issues are the primary topic of this RFC. | ||
| − | |||
The interaction of the authentication protocols within PPP are | The interaction of the authentication protocols within PPP are | ||
highly implementation dependent. This is indicated by the use of | highly implementation dependent. This is indicated by the use of | ||
SHOULD throughout the document. | SHOULD throughout the document. | ||
| − | |||
For example, upon failure of authentication, some implementations | For example, upon failure of authentication, some implementations | ||
do not terminate the link. Instead, the implementation limits the | do not terminate the link. Instead, the implementation limits the | ||
| Line 712: | Line 603: | ||
secrets or send mail to the network administrator indicating a | secrets or send mail to the network administrator indicating a | ||
problem. | problem. | ||
| − | |||
There is no provision for re-tries of failed authentication. | There is no provision for re-tries of failed authentication. | ||
However, the LCP state machine can renegotiate the authentication | However, the LCP state machine can renegotiate the authentication | ||
protocol at any time, thus allowing a new attempt. It is | protocol at any time, thus allowing a new attempt. It is | ||
| + | |||
| + | |||
| Line 724: | Line 616: | ||
be reset until after successful authentication, or subsequent | be reset until after successful authentication, or subsequent | ||
termination of the failed link. | termination of the failed link. | ||
| − | |||
There is no requirement that authentication be full duplex or that | There is no requirement that authentication be full duplex or that | ||
the same protocol be used in both directions. It is perfectly | the same protocol be used in both directions. It is perfectly | ||
acceptable for different protocols to be used in each direction. | acceptable for different protocols to be used in each direction. | ||
This will, of course, depend on the specific protocols negotiated. | This will, of course, depend on the specific protocols negotiated. | ||
| − | |||
In practice, within or associated with each PPP server, there is a | In practice, within or associated with each PPP server, there is a | ||
database which associates "user" names with authentication | database which associates "user" names with authentication | ||
| Line 742: | Line 632: | ||
employed, each of which identifies exactly one authentication | employed, each of which identifies exactly one authentication | ||
method. | method. | ||
| − | |||
Passwords and other secrets should be stored at the respective | Passwords and other secrets should be stored at the respective | ||
ends such that access to them is as limited as possible. Ideally, | ends such that access to them is as limited as possible. Ideally, | ||
the secrets should only be accessible to the process requiring | the secrets should only be accessible to the process requiring | ||
access in order to perform the authentication. | access in order to perform the authentication. | ||
| − | |||
The secrets should be distributed with a mechanism that limits the | The secrets should be distributed with a mechanism that limits the | ||
number of entities that handle (and thus gain knowledge of) the | number of entities that handle (and thus gain knowledge of) the | ||
| Line 754: | Line 642: | ||
SNMP Security Protocols [4], but such a mechanism is outside the | SNMP Security Protocols [4], but such a mechanism is outside the | ||
scope of this specification. | scope of this specification. | ||
| − | |||
Other distribution methods are currently undergoing research and | Other distribution methods are currently undergoing research and | ||
experimentation. The SNMP Security document also has an excellent | experimentation. The SNMP Security document also has an excellent | ||
overview of threats to network protocols. | overview of threats to network protocols. | ||
| − | |||
References | References | ||
| + | [1] Simpson, W., "The Point-to-Point Protocol (PPP)", RFC 1331, | ||
| + | Daydreamer, May 1992. | ||
| + | [2] Reynolds, J., and J. Postel, "Assigned Numbers", RFC 1340, | ||
| + | USC/Information Sciences Institute, July 1992. | ||
| − | |||
| − | |||
| − | |||
| − | |||
| Line 777: | Line 663: | ||
Laboratory for Computer Science and RSA Data Security, Inc. RFC | Laboratory for Computer Science and RSA Data Security, Inc. RFC | ||
1321, April 1992. | 1321, April 1992. | ||
| − | |||
[4] Galvin, J., McCloghrie, K., and J. Davin, "SNMP Security | [4] Galvin, J., McCloghrie, K., and J. Davin, "SNMP Security | ||
Protocols", Trusted Information Systems, Inc., Hughes LAN | Protocols", Trusted Information Systems, Inc., Hughes LAN | ||
| − | Systems, Inc., MIT Laboratory for Computer Science, | + | Systems, Inc., MIT Laboratory for Computer Science, RFC 1352, |
July 1992. | July 1992. | ||
| − | |||
Acknowledgments | Acknowledgments | ||
| − | + | Some of the text in this document is taken from RFC 1172, by Drew | |
| − | Some of the text in this document is taken from | ||
Perkins of Carnegie Mellon University, and by Russ Hobby of the | Perkins of Carnegie Mellon University, and by Russ Hobby of the | ||
University of California at Davis. | University of California at Davis. | ||
| − | |||
Special thanks to Dave Balenson, Steve Crocker, James Galvin, and | Special thanks to Dave Balenson, Steve Crocker, James Galvin, and | ||
Steve Kent, for their extensive explanations and suggestions. Now, | Steve Kent, for their extensive explanations and suggestions. Now, | ||
if only we could get them to agree with each other. | if only we could get them to agree with each other. | ||
| − | |||
Chair's Address | Chair's Address | ||
| − | |||
The working group can be contacted via the current chair: | The working group can be contacted via the current chair: | ||
| − | |||
Brian Lloyd | Brian Lloyd | ||
Lloyd & Associates | Lloyd & Associates | ||
3420 Sudbury Road | 3420 Sudbury Road | ||
Cameron Park, California 95682 | Cameron Park, California 95682 | ||
| − | |||
Phone: (916) 676-1147 | Phone: (916) 676-1147 | ||
| − | |||
EMail: [email protected] | EMail: [email protected] | ||
| − | |||
Author's Address | Author's Address | ||
| − | |||
Questions about this memo can also be directed to: | Questions about this memo can also be directed to: | ||
| − | |||
William Allen Simpson | William Allen Simpson | ||
Daydreamer | Daydreamer | ||
| Line 815: | Line 689: | ||
P O Box 6205 | P O Box 6205 | ||
East Lansing, MI 48826-6205 | East Lansing, MI 48826-6205 | ||
| − | |||
EMail: [email protected] | EMail: [email protected] | ||
Revision as of 06:54, 23 September 2020
Network Working Group B. Lloyd Request for Comments: 1334 L&A
W. Simpson
Daydreamer
October 1992
PPP Authentication Protocols
Status of this Memo This RFC specifies an IAB standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "IAB Official Protocol Standards" for the standardization state and status of this protocol. Distribution of this memo is unlimited. Abstract The Point-to-Point Protocol (PPP) [1] provides a standard method of encapsulating Network Layer protocol information over point-to-point links. PPP also defines an extensible Link Control Protocol, which allows negotiation of an Authentication Protocol for authenticating its peer before allowing Network Layer protocols to transmit over the link. This document defines two protocols for Authentication: the Password Authentication Protocol and the Challenge-Handshake Authentication Protocol. This memo is the product of the Point-to-Point Protocol Working Group of the Internet Engineering Task Force (IETF). Comments on this memo should be submitted to the [email protected] mailing list. Table of Contents 1. Introduction ............................................... 2 1.1 Specification Requirements ................................. 2 1.2 Terminology ................................................ 3 2. Password Authentication Protocol ............................ 3 2.1 Configuration Option Format ................................ 4 2.2 Packet Format .............................................. 5 2.2.1 Authenticate-Request ..................................... 5 2.2.2 Authenticate-Ack and Authenticate-Nak .................... 7 3. Challenge-Handshake Authentication Protocol.................. 8 3.1 Configuration Option Format ................................ 9 3.2 Packet Format .............................................. 10 3.2.1 Challenge and Response ................................... 11 3.2.2 Success and Failure ...................................... 13
SECURITY CONSIDERATIONS ........................................ 14 REFERENCES ..................................................... 15 ACKNOWLEDGEMENTS ............................................... 16 CHAIR'S ADDRESS ................................................ 16 AUTHOR'S ADDRESS ............................................... 16
Contents
Introduction
PPP has three main components:
1. A method for encapsulating datagrams over serial links.
2. A Link Control Protocol (LCP) for establishing, configuring,
and testing the data-link connection.
3. A family of Network Control Protocols (NCPs) for establishing
and configuring different network-layer protocols.
In order to establish communications over a point-to-point link, each end of the PPP link must first send LCP packets to configure the data link during Link Establishment phase. After the link has been established, PPP provides for an optional Authentication phase before proceeding to the Network-Layer Protocol phase. By default, authentication is not mandatory. If authentication of the link is desired, an implementation MUST specify the Authentication-Protocol Configuration Option during Link Establishment phase. These authentication protocols are intended for use primarily by hosts and routers that connect to a PPP network server via switched circuits or dial-up lines, but might be applied to dedicated links as well. The server can use the identification of the connecting host or router in the selection of options for network layer negotiations. This document defines the PPP authentication protocols. The Link Establishment and Authentication phases, and the Authentication- Protocol Configuration Option, are defined in The Point-to-Point Protocol (PPP) [1].
Specification Requirements
In this document, several words are used to signify the requirements of the specification. These words are often capitalized. MUST
This word, or the adjective "required", means that the definition is an absolute requirement of the specification.
MUST NOT
This phrase means that the definition is an absolute prohibition of the specification.
SHOULD
This word, or the adjective "recommended", means that there may exist valid reasons in particular circumstances to ignore this item, but the full implications should be understood and carefully weighed before choosing a different course.
MAY
This word, or the adjective "optional", means that this item is one of an allowed set of alternatives. An implementation which does not include this option MUST be prepared to interoperate with another implementation which does include the option.
Terminology
This document frequently uses the following terms: authenticator
The end of the link requiring the authentication. The authenticator specifies the authentication protocol to be used in the Configure-Request during Link Establishment phase.
peer
The other end of the point-to-point link; the end which is being authenticated by the authenticator.
silently discard
This means the implementation discards the packet without further processing. The implementation SHOULD provide the capability of logging the error, including the contents of the silently discarded packet, and SHOULD record the event in a statistics counter.
Password Authentication Protocol
The Password Authentication Protocol (PAP) provides a simple method for the peer to establish its identity using a 2-way handshake. This is done only upon initial link establishment. After the Link Establishment phase is complete, an Id/Password pair is repeatedly sent by the peer to the authenticator until authentication is acknowledged or the connection is terminated. PAP is not a strong authentication method. Passwords are sent over the circuit "in the clear", and there is no protection from playback
or repeated trial and error attacks. The peer is in control of the frequency and timing of the attempts. Any implementations which include a stronger authentication method (such as CHAP, described below) MUST offer to negotiate that method prior to PAP. This authentication method is most appropriately used where a plaintext password must be available to simulate a login at a remote host. In such use, this method provides a similar level of security to the usual user login at the remote host.
Implementation Note: It is possible to limit the exposure of the plaintext password to transmission over the PPP link, and avoid sending the plaintext password over the entire network. When the remote host password is kept as a one-way transformed value, and the algorithm for the transform function is implemented in the local server, the plaintext password SHOULD be locally transformed before comparison with the transformed password from the remote host.
Configuration Option Format
A summary of the Authentication-Protocol Configuration Option format to negotiate the Password Authentication Protocol is shown below. The fields are transmitted from left to right.
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Length | Authentication-Protocol | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Type
3
Length
4
Authentication-Protocol
c023 (hex) for Password Authentication Protocol.
Data
There is no Data field.
Packet Format
Exactly one Password Authentication Protocol packet is encapsulated in the Information field of a PPP Data Link Layer frame where the protocol field indicates type hex c023 (Password Authentication Protocol). A summary of the PAP packet format is shown below. The fields are transmitted from left to right.
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Code | Identifier | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Data ... +-+-+-+-+ Code
The Code field is one octet and identifies the type of PAP packet.
PAP Codes are assigned as follows:
1 Authenticate-Request
2 Authenticate-Ack
3 Authenticate-Nak
Identifier
The Identifier field is one octet and aids in matching requests and replies.
Length
The Length field is two octets and indicates the length of the PAP packet including the Code, Identifier, Length and Data fields. Octets outside the range of the Length field should be treated as Data Link Layer padding and should be ignored on reception.
Data
The Data field is zero or more octets. The format of the Data field is determined by the Code field.
Authenticate-Request
Description
The Authenticate-Request packet is used to begin the Password Authentication Protocol. The link peer MUST transmit a PAP packet
with the Code field set to 1 (Authenticate-Request) during the
Authentication phase. The Authenticate-Request packet MUST be
repeated until a valid reply packet is received, or an optional
retry counter expires.
The authenticator SHOULD expect the peer to send an Authenticate-
Request packet. Upon reception of an Authenticate-Request packet,
some type of Authenticate reply (described below) MUST be
returned.
Implementation Note: Because the Authenticate-Ack might be
lost, the authenticator MUST allow repeated Authenticate-
Request packets after completing the Authentication phase.
Protocol phase MUST return the same reply Code returned when
the Authentication phase completed (the message portion MAY be
different). Any Authenticate-Request packets received during
any other phase MUST be silently discarded.
When the Authenticate-Nak is lost, and the authenticator
terminates the link, the LCP Terminate-Request and Terminate-
Ack provide an alternative indication that authentication
failed.
A summary of the Authenticate-Request packet format is shown below. The fields are transmitted from left to right.
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Code | Identifier | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Peer-ID Length| Peer-Id ... +-+-+-+-+-+-+-+-+-+-+-+-+ | Passwd-Length | Password ... +-+-+-+-+-+-+-+-+-+-+-+-+-+ Code
1 for Authenticate-Request.
Identifier
The Identifier field is one octet and aids in matching requests and replies. The Identifier field MUST be changed each time an Authenticate-Request packet is issued.
Peer-ID-Length
The Peer-ID-Length field is one octet and indicates the length of the Peer-ID field.
Peer-ID
The Peer-ID field is zero or more octets and indicates the name of the peer to be authenticated.
Passwd-Length
The Passwd-Length field is one octet and indicates the length of the Password field.
Password
The Password field is zero or more octets and indicates the password to be used for authentication.
Authenticate-Ack and Authenticate-Nak
Description
If the Peer-ID/Password pair received in an Authenticate-Request is both recognizable and acceptable, then the authenticator MUST transmit a PAP packet with the Code field set to 2 (Authenticate- Ack). If the Peer-ID/Password pair received in a Authenticate-Request is not recognizable or acceptable, then the authenticator MUST transmit a PAP packet with the Code field set to 3 (Authenticate- Nak), and SHOULD take action to terminate the link.
A summary of the Authenticate-Ack and Authenticate-Nak packet format is shown below. The fields are transmitted from left to right.
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Code | Identifier | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Msg-Length | Message ... +-+-+-+-+-+-+-+-+-+-+-+-+- Code
2 for Authenticate-Ack;
3 for Authenticate-Nak.
Identifier
The Identifier field is one octet and aids in matching requests and replies. The Identifier field MUST be copied from the Identifier field of the Authenticate-Request which caused this reply.
Msg-Length
The Msg-Length field is one octet and indicates the length of the Message field.
Message
The Message field is zero or more octets, and its contents are implementation dependent. It is intended to be human readable, and MUST NOT affect operation of the protocol. It is recommended that the message contain displayable ASCII characters 32 through 126 decimal. Mechanisms for extension to other character sets are the topic of future research.
Challenge-Handshake Authentication Protocol
The Challenge-Handshake Authentication Protocol (CHAP) is used to periodically verify the identity of the peer using a 3-way handshake. This is done upon initial link establishment, and MAY be repeated anytime after the link has been established. After the Link Establishment phase is complete, the authenticator sends a "challenge" message to the peer. The peer responds with a value calculated using a "one-way hash" function. The authenticator checks the response against its own calculation of the expected hash value. If the values match, the authentication is acknowledged; otherwise the connection SHOULD be terminated. CHAP provides protection against playback attack through the use of an incrementally changing identifier and a variable challenge value. The use of repeated challenges is intended to limit the time of exposure to any single attack. The authenticator is in control of the frequency and timing of the challenges. This authentication method depends upon a "secret" known only to the authenticator and that peer. The secret is not sent over the link. This method is most likely used where the same secret is easily accessed from both ends of the link.
Implementation Note: CHAP requires that the secret be available in plaintext form. To avoid sending the secret over other links in the network, it is recommended that the challenge and response values be examined at a central server, rather than each network access server. Otherwise, the secret SHOULD be sent to such servers in a reversably encrypted form.
The CHAP algorithm requires that the length of the secret MUST be at least 1 octet. The secret SHOULD be at least as large and unguessable as a well-chosen password. It is preferred that the secret be at least the length of the hash value for the hashing algorithm chosen (16 octets for MD5). This is to ensure a sufficiently large range for the secret to provide protection against exhaustive search attacks. The one-way hash algorithm is chosen such that it is computationally infeasible to determine the secret from the known challenge and response values. The challenge value SHOULD satisfy two criteria: uniqueness and unpredictability. Each challenge value SHOULD be unique, since repetition of a challenge value in conjunction with the same secret would permit an attacker to reply with a previously intercepted response. Since it is expected that the same secret MAY be used to authenticate with servers in disparate geographic regions, the challenge SHOULD exhibit global and temporal uniqueness. Each challenge value SHOULD also be unpredictable, least an attacker trick a peer into responding to a predicted future challenge, and then use the response to masquerade as that peer to an authenticator. Although protocols such as CHAP are incapable of protecting against realtime active wiretapping attacks, generation of unique unpredictable challenges can protect against a wide range of active attacks. A discussion of sources of uniqueness and probability of divergence is included in the Magic-Number Configuration Option [1].
Configuration Option Format
A summary of the Authentication-Protocol Configuration Option format to negotiate the Challenge-Handshake Authentication Protocol is shown below. The fields are transmitted from left to right.
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Length | Authentication-Protocol | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Algorithm | +-+-+-+-+-+-+-+-+ Type
3
Length
5
Authentication-Protocol
c223 (hex) for Challenge-Handshake Authentication Protocol.
Algorithm
The Algorithm field is one octet and indicates the one-way hash
method to be used. The most up-to-date values of the CHAP
Algorithm field are specified in the most recent "Assigned
Numbers" RFC [2]. Current values are assigned as follows:
0-4 unused (reserved)
5 MD5 [3]
Packet Format
Exactly one Challenge-Handshake Authentication Protocol packet is encapsulated in the Information field of a PPP Data Link Layer frame where the protocol field indicates type hex c223 (Challenge-Handshake Authentication Protocol). A summary of the CHAP packet format is shown below. The fields are transmitted from left to right.
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Code | Identifier | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Data ... +-+-+-+-+
Code
The Code field is one octet and identifies the type of CHAP
packet. CHAP Codes are assigned as follows:
1 Challenge
2 Response
3 Success
4 Failure
Identifier
The Identifier field is one octet and aids in matching challenges, responses and replies.
Length
The Length field is two octets and indicates the length of the CHAP packet including the Code, Identifier, Length and Data fields. Octets outside the range of the Length field should be treated as Data Link Layer padding and should be ignored on reception.
Data
The Data field is zero or more octets. The format of the Data field is determined by the Code field.
Challenge and Response
Description
The Challenge packet is used to begin the Challenge-Handshake Authentication Protocol. The authenticator MUST transmit a CHAP packet with the Code field set to 1 (Challenge). Additional Challenge packets MUST be sent until a valid Response packet is received, or an optional retry counter expires. A Challenge packet MAY also be transmitted at any time during the Network-Layer Protocol phase to ensure that the connection has not been altered. The peer SHOULD expect Challenge packets during the Authentication phase and the Network-Layer Protocol phase. Whenever a Challenge packet is received, the peer MUST transmit a CHAP packet with the Code field set to 2 (Response). Whenever a Response packet is received, the authenticator compares
the Response Value with its own calculation of the expected value.
Based on this comparison, the authenticator MUST send a Success or
Failure packet (described below).
Implementation Note: Because the Success might be lost, the
authenticator MUST allow repeated Response packets after
completing the Authentication phase. To prevent discovery of
alternative Names and Secrets, any Response packets received
having the current Challenge Identifier MUST return the same
reply Code returned when the Authentication phase completed
(the message portion MAY be different). Any Response packets
received during any other phase MUST be silently discarded.
When the Failure is lost, and the authenticator terminates the
link, the LCP Terminate-Request and Terminate-Ack provide an
alternative indication that authentication failed.
A summary of the Challenge and Response packet format is shown below. The fields are transmitted from left to right.
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Code | Identifier | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Value-Size | Value ... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Name ... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Code
1 for Challenge; 2 for Response.
Identifier
The Identifier field is one octet. The Identifier field MUST be changed each time a Challenge is sent. The Response Identifier MUST be copied from the Identifier field of the Challenge which caused the Response.
Value-Size
This field is one octet and indicates the length of the Value field.
Value
The Value field is one or more octets. The most significant octet is transmitted first. The Challenge Value is a variable stream of octets. The importance of the uniqueness of the Challenge Value and its relationship to the secret is described above. The Challenge Value MUST be changed each time a Challenge is sent. The length of the Challenge Value depends upon the method used to generate the octets, and is independent of the hash algorithm used. The Response Value is the one-way hash calculated over a stream of octets consisting of the Identifier, followed by (concatenated with) the "secret", followed by (concatenated with) the Challenge Value. The length of the Response Value depends upon the hash algorithm used (16 octets for MD5).
Name
The Name field is one or more octets representing the identification of the system transmitting the packet. There are no limitations on the content of this field. For example, it MAY contain ASCII character strings or globally unique identifiers in ASN.1 syntax. The Name should not be NUL or CR/LF terminated. The size is determined from the Length field. Since CHAP may be used to authenticate many different systems, the content of the name field(s) may be used as a key to locate the proper secret in a database of secrets. This also makes it possible to support more than one name/secret pair per system.
Success and Failure
Description
If the Value received in a Response is equal to the expected value, then the implementation MUST transmit a CHAP packet with the Code field set to 3 (Success). If the Value received in a Response is not equal to the expected value, then the implementation MUST transmit a CHAP packet with the Code field set to 4 (Failure), and SHOULD take action to terminate the link.
A summary of the Success and Failure packet format is shown below. The fields are transmitted from left to right.
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Code | Identifier | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Message ... +-+-+-+-+-+-+-+-+-+-+-+-+- Code
3 for Success; 4 for Failure.
Identifier
The Identifier field is one octet and aids in matching requests and replies. The Identifier field MUST be copied from the Identifier field of the Response which caused this reply.
Message
The Message field is zero or more octets, and its contents are implementation dependent. It is intended to be human readable, and MUST NOT affect operation of the protocol. It is recommended that the message contain displayable ASCII characters 32 through 126 decimal. Mechanisms for extension to other character sets are the topic of future research. The size is determined from the Length field.
Security Considerations
Security issues are the primary topic of this RFC. The interaction of the authentication protocols within PPP are highly implementation dependent. This is indicated by the use of SHOULD throughout the document. For example, upon failure of authentication, some implementations do not terminate the link. Instead, the implementation limits the kind of traffic in the Network-Layer Protocols to a filtered subset, which in turn allows the user opportunity to update secrets or send mail to the network administrator indicating a problem. There is no provision for re-tries of failed authentication. However, the LCP state machine can renegotiate the authentication protocol at any time, thus allowing a new attempt. It is
recommended that any counters used for authentication failure not
be reset until after successful authentication, or subsequent
termination of the failed link.
There is no requirement that authentication be full duplex or that
the same protocol be used in both directions. It is perfectly
acceptable for different protocols to be used in each direction.
This will, of course, depend on the specific protocols negotiated.
In practice, within or associated with each PPP server, there is a
database which associates "user" names with authentication
information ("secrets"). It is not anticipated that a particular
named user would be authenticated by multiple methods. This would
make the user vulnerable to attacks which negotiate the least
secure method from among a set (such as PAP rather than CHAP).
Instead, for each named user there should be an indication of
exactly one method used to authenticate that user name. If a user
needs to make use of different authentication method under
different circumstances, then distinct user names SHOULD be
employed, each of which identifies exactly one authentication
method.
Passwords and other secrets should be stored at the respective
ends such that access to them is as limited as possible. Ideally,
the secrets should only be accessible to the process requiring
access in order to perform the authentication.
The secrets should be distributed with a mechanism that limits the
number of entities that handle (and thus gain knowledge of) the
secret. Ideally, no unauthorized person should ever gain
knowledge of the secrets. It is possible to achieve this with
SNMP Security Protocols [4], but such a mechanism is outside the
scope of this specification.
Other distribution methods are currently undergoing research and
experimentation. The SNMP Security document also has an excellent
overview of threats to network protocols.
References [1] Simpson, W., "The Point-to-Point Protocol (PPP)", RFC 1331,
Daydreamer, May 1992.
[2] Reynolds, J., and J. Postel, "Assigned Numbers", RFC 1340,
USC/Information Sciences Institute, July 1992.
[3] Rivest, R., and S. Dusse, "The MD5 Message-Digest Algorithm", MIT
Laboratory for Computer Science and RSA Data Security, Inc. RFC 1321, April 1992.
[4] Galvin, J., McCloghrie, K., and J. Davin, "SNMP Security
Protocols", Trusted Information Systems, Inc., Hughes LAN Systems, Inc., MIT Laboratory for Computer Science, RFC 1352, July 1992.
Acknowledgments Some of the text in this document is taken from RFC 1172, by Drew Perkins of Carnegie Mellon University, and by Russ Hobby of the University of California at Davis. Special thanks to Dave Balenson, Steve Crocker, James Galvin, and Steve Kent, for their extensive explanations and suggestions. Now, if only we could get them to agree with each other. Chair's Address The working group can be contacted via the current chair:
Brian Lloyd Lloyd & Associates 3420 Sudbury Road Cameron Park, California 95682 Phone: (916) 676-1147 EMail: [email protected]
Author's Address Questions about this memo can also be directed to:
William Allen Simpson Daydreamer Computer Systems Consulting Services P O Box 6205 East Lansing, MI 48826-6205 EMail: [email protected]
