1. RADIUS Server
PAP & CHAP Protocols

2. Computer Security
 In computer security, AAA protocol commonly stands for authentication, authorization and accounting.
 Authentication :
Refers to confirmation that a user who is requesting a service is a valid user.
Examples of credentials are passwords, one-time tokens, digital certificates, and phone numbers (calling/called).
 Authorization :
Refers to the granting of specific types of service (including "no service") to a user, based on their authentication.
Examples of services : IP address filtering, encryption, bandwidth control/traffic management.
 Accounting :
Refers to the tracking of the consumption of network resources by users.
May be used for management, planning, billing etc.
AAA server provides all the above services to its clients.

3. AAA Protocols
 Terminal Access Controller Access Control System (TACACS)
 TACACS+
 Remote Authentication Dial In User Service(RADIUS)
 DIAMETER :Diameter is a planned replacement of RADIUS.

4. RADIUS Server
 The Remote Authentication Dial-In User Service (RADIUS) protocol was
developed by Livingston Enterprises, Inc., as an access server
authentication and accounting protocol.
 RADIUS is a protocol for carrying authentication, authorization, and
configuration information between a Network Access Server which desires
to authenticate its links and a shared Authentication Server.
 Uses PAP, CHAP or EAP protocols to authenticate users.
 Look in text file, LDAP Servers, Database for authentication.
 After authentication services parameters passed back to NAS.

5. RADIUS infrastructure components

6. Functions..
 Communication between a network access server (NAS) and a RADIUS
server is based on the User Datagram Protocol (UDP).
 RADIUS server handles issues related to server availability, retransmission,
and timeouts.
 RADIUS is a client/server protocol
 A RADIUS server can act as a proxy client to other RADIUS servers or other
kinds of authentication servers.

7. Interaction between a user and the
RADIUS client and server

8. Authentication and Authorization
 The RADIUS server can support a variety of methods to authenticate a
user.

9. PAP
 The Password Authentication Protocol (PAP) provides a simple method for
a user to authenticate using a 2-way handshake.
 PAP is used by Point to Point Protocol to validate users before allowing
them access to server resources.
 PAP transmits unencrypted ASCII passwords over the network and is
therefore considered insecure.

10. Working of PAP

11. CHAP
 Challenge-Handshake Authentication Protocol is a more secure
procedure for connecting to a system than the Password Authentication
Procedure (PAP).
 It involves a three-way exchange of a shared secret. During link
establishment, CHAP conducts periodic challenges to make sure that the
remote host still has a valid password value.
 While PAP basically stops working once authentication is established, this
leaves the network vulnerable to attack.

12. Working of CHAP

13. Advantages
 CHAP provides protection against playback attack by using different
challenge value that is unique and comes in random. Because the
challenge is unique and unpredictable, the resulting hash value is also
unique and random. Which makes it difficult for ‘guessing’.
 The use of repeated and different challenges, limits the time of exposure
to any single attack.

14. PAP vs CHAP
 PAP is in clear text. It mostly refers to providing a password to an account.
The password gets thru the wire. It is vulnerable to sniffing cause whoever is
listening would know the password.
 CHAP, on the other hand, issues a challenge. The password never actually
makes it thru the wire but a question is asked.

15. References
 http://www.cisco.com/c/en/us/support/docs/security-vpn/remote-
authentication-dial-user-service-radius/12433-32.html
 http://www.orbit-computer-solutions.com/Challenge-Handshake-
Authentication-Protocol--CHAP-.php
 http://www.orbit-computer-solutions.com/Password-Authentication-
Protocol--PAP-.php

16. Contact : dhananjay5315@gmail.com