A method for authenticating a user for access to a service provider network: receiving , at a network node on a customer premises different from a service provider premises, password data that indicates a password value secretly shared with an Authentication, Authorization and Accounting, AAA process executing on a first network node on the service provider premises; receiving , from a challenging process executing on a second network node, a Dynamic Host Configuration Protocol, DHCP, formatted challenge message that includes a current challenge value that can not be predicted by knowledge of any previous challenge value; in response to receiving the challenge message, determining a response value based on the password value and the challenge value using a secure process that renders impractical an attempt to derive the password value from the challenge value and the response value; sending to the challenging process a DHCP formatted response message that includes the response value, wherein the DHCP formatted response message includes authentication method data that indicates a method for determining the response value based on the password value and the challenge value; and receiving, from a DHCP server executing on a third network node, a DHCP offer message that includes configuration data that indicates configuration information sufficient for accessing the service provider network, only if the response value is determined to be correct; wherein at least one of the challenge message and the response message is formatted according to a DHCP message format using a unique value for a DHCP message type option. receiving , at a network node on a customer premises different from a service provider premises, password data that indicates a password value secretly shared with an Authentication, Authorization and Accounting, AAA process executing on a first network node on the service provider premises; receiving , from a challenging process executing on a second network node, a Dynamic Host Configuration Protocol, DHCP, formatted challenge message that includes a current challenge value that can not be predicted by knowledge of any previous challenge value; in response to receiving the challenge message, determining a response value based on the password value and the challenge value using a secure process that renders impractical an attempt to derive the password value from the challenge value and the response value; sending to the challenging process a DHCP formatted response message that includes the response value, wherein the DHCP formatted response message includes authentication method data that indicates a method for determining the response value based on the password value and the challenge value; and receiving, from a DHCP server executing on a third network node, a DHCP offer message that includes configuration data that indicates configuration information sufficient for accessing the service provider network, only if the response value is determined to be correct; wherein at least one of the challenge message and the response message is formatted according to a DHCP message format using a unique value for a DHCP message type option. <EOS>