With PPP, each system may require its peer to authenticate itself using one of two authentication protocols. When a connection is established, each end can request the other to authenticate itself, regardless of whether it is the caller or the callee. A PPP daemon can ask its peer for authentication by sending yet another LCP configuration request identifying the desired authentication protocol.
PAP works basically the same way as the normal login procedure.
This technique is vulnerable to eavesdroppers who may try to obtain the password by listening in on the serial line, and to repeated trial and error attacks. CHAP does not have these deficiencies. The client uses the hostname to look up the appropriate secret, combines it with the challenge, and encrypts the string using a one-way hashing function. The result is returned to the server along with the client's hostname. The server now performs the same computation, and acknowledges the client if it arrives at the same result.