PPP – How CHAP Authentication Works

ppp

Let's assume that pppd returns following message:

 rcvd [CHAP Challenge id=0x1 <12345>, name = ""] 

and password is "test". What string should I use to calculate MD5 hash for CHAP Response?
[https://www.cisco.com/c/en/us/support/docs/wan/point-to-point-protocol-ppp/25647-understanding-ppp-chap.html] – here there is general description. But I still miss the details… I know that I should concatenate challenge, ID and password, but what is the correct order of concatenating those strings? Should I convert password from ASCII to hex before calculating hash?

Best Answer

CHAP is defined in RFC 1994.

You concatenate the identifier, the password (secret), and the challenge, in ASCII, in that order. The response is hashMD5(identifier.secret.challenge), sent in binary (16 bytes for MD5).

For your example, that should be in hex 0x017465737412345 hashed.

Note that MD5 is not cryptographically safe any more due to advances in processing power and methods. On an unsafe channel, you'll need to provide additional password protection (like SSL/TLS or VPN).