Implementations may use it to guide prompting and presentation of usernames, challenges, responses and text messages. Upon failure, the server must close the connection. Mutual Authentication Implementations MAY support mutual authentication of client and server. Note that both negotiations employ the same identifier. Security Considerations Challenge-response protocols are generally designed to provide protection from passive attacks such as sniffing passwords.
CHAP offers limited protection from real-time active attacks.
6 January 1998 research into the area of keyed hash construction. Their design is now considered weak. As in all challenge-response security mechanisms, it is important that challenges be produced in a fashion an adversary cannot predict or duplicate. As with all negotiation-based security, implementations may be vulnerable to downgrade attacks. In the context of a PPP connection, a CHAP challenge may be issued at any time to reconfirm the authentication.