Read the abstract, see who wrote it and who cites it, and get the citation in APA, MLA, Chicago or Harvard.
About 37 papers for “Challenge-Handshake Authentication Protocol”
W. Simpson · 1996
This document defines a method for Authentication using PPP, which uses a random Challenge, with a cryptographically hashed Response which depends upon the Challenge and a secret key. [STANDARDS-TRACK]
Cited by 194
Guy Leduc · Annals of Telecommunications · 2000
Cited by 8
Bill Lloyd, W A Simpson · 1992
The Point-to-Point Protocol (PPP) [1] provides a standard method of encapsulating Network Layer protocol information over point-to-point links.PPP also defines an extensible Link Control Protocol, which allows negotiation of an Authentication Protocol for authenticating its peer before allowing Network Layer protocols to transmit over the link.This document defines two protocols for Authentication: the Password Authentication Protocol and the Challenge-Handshake Authentication Protocol.
Cited by 84
Li Zhu, Huaqing Mao, Dongsong Zheng · 2011
Identity authentication is one of the key problems to be solved in cognitive radio networks. Current authentication mechanisms for cognitive radio networks are based on PPP Extensible Authentication Protocols. Future cognitive radio network can fusion current wireless standards. However, security requirements of various wireless standards are different which leads to current authentication mechanisms are not suitable for cognitive radio networks. Therefore, an identity authentication mechanism based on Certification Authority (CA) is proposed in this paper. The mechanism adopts SIM authentication for terminal users and secure tunnel +certificates for servers. CA can resolve identity authentication problem of base station, assure security of base station and CA by secure tunnel in core networks. And current Challenge Handshake Protocol is also improved; challenge handshake exists in whole communication process which resolves connection robbing problem.
Cited by 0
Yang LY(杨路瑶), Shang WL(尚文利), Chen CY(陈春雨) et al. · SIA OpenIR (Chinese Academy of Sciences) · 2020
Aiming at the current lack of certification capability in domestic industrial control systems, an industrial control system authentication scheme based on identity cryptography algorithm is proposed. When authenticating between control system devices, the scheme integrates the identity-based digital signature algorithm into the SSL/TLS handshake protocol to complete identity authentication between the engineering station and the trusted PLC. At the same time, when the connection is established for the first time between devices, the connection authentication is selected by the challenge/response based method. The authentication technology based on the identity cryptographic algorithm no longer requires the existence of a public key certificate. This eliminates the need to revoke, store, and issue certificates, simplifies the certification process and reduces the amount of computation required by the authentication process. At the same time, the improved handshake protocol is universal in industrial control systems. The authentication technology based on the identity and password algorithm no longer requires the existence of a public key certificate, eliminating the need for certificate revocation, storage, and issuance, simplifying authentication steps, and reducing system maintenance. Finally, by establishing a test environment, the improved handshake protocol is implemented, and the feasibility of the authentication scheme is verified and analyzed.
Cited by 0
Jeonghyeon Park, Yeong-Jin Kim, Yun‐Ju Lee et al. · The KIPS Transactions PartC · 2002
원격 이동 가입자가 방문망에서 자신의 홈망 인증 서버를 접속하여 인증을 득하고 이를 통해 IP를 할당받아 무선 인터넷 서비스를 받게 되는데 이 경우 보편적으로 PPP CHAP 인증 기능을 적용한다. 그러나 기존의 PPP CHAP 인증 기능을 GPRS 망으로 이동한 원격 이동 ISP 가입자에게 직접 적용할 수는 없다. 이에 본 논문에서는 GPRS 망으로 이동한 원격 이동 ISP 가입자에게 PPP CHAP 인증 기능을 통해 홈망의 인증 서버를 접속하여 인증을 득하고 IP를 할당받아 이동 ISP 가입자가 GPRS 망에서 무선 인터넷 서비스를 받을 수 있는 방법을 제시한다. 이를 위해 본 논문에서는 GPRS 망으로 이동한 이동 ISP 가입자가 PPP CHAP 인증 기능을 통해 홈망의 인증서버로부터 인증을 득할 수 있도록 기존의 PPP CHAP 메시지 변경 구조와 MT에서의 PCO 메시지 구조, 그리고 GGSN과 ISP RADIUS 연동 메시지 구조 등을 제시한다. 또 제안된 PPP CHAP 방식을 통해 GPRS 망 GGSN에서 ISP망 내 RADIUS 서버 접속시 진행된 인증 시험 결과를 제시한다. We usually applied PPP CHAP when the visited ISP subscriber accesses to authentication server in own home ISP network and IP Assignment for remote Internet service. But PPP CHAP doesn't support in case of visited ISP subscriber in GPRS network accesses to authentication sorrel in own home ISP network for wireless Internet service. We suggest solution for this problem with PPP CHAP improvement. For this we propose the modified PPP CHAP message format, PCO Message format at MT, and interworking message and format between GGSN and RADIUS in home ISP network for wireless internet service of mobile ISP subscriber at GPRS network in this paper. We also show authentication results when visited mobile ISP subscriber via PPP CHAP at GPRS network accesses the RADIUS server in home ISP network.
Cited by 1Open access
B. Lloyd, W. Simpson · 1992
Status of this Memo This RFC specifies an IAB standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "IAB Official Protocol Standards " for the standardization state and status of this protocol. Distribution of this memo is unlimited. The Point-to-Point Protocol (PPP) [1] provides a standard method of encapsulating Network Layer protocol information over point-to-point links. PPP also defines an extensible Link Control Protocol, which allows negotiation of an Authentication Protocol for authenticating its peer before allowing Network Layer protocols to transmit over the link. This document defines two protocols for Authentication: the Password Authentication Protocol and the Challenge-Handshake Authentication Protocol. This memo is the product of the Point-to-Point Protocol
Cited by 0
Masaki Inamura · 2015
I propose new authentication protocols using/unmodifying the structures of packet and data exchange on CHAP (Challenge Handshake Authentication Protocol). CHAP is one of the most popular authentication protocols because of very simple scheme and no vulnerability of its structures of packet and data exchange. Therefore, this protocol is used a lot of services over the Internet as de facto standard. However, unlawful access often happens caused by usersâ mistakes of password setting, e.g. password-list-attacks, and proposing/ implementation of other authentication methods without using password are urgent. To solve the problem, I propose new scheme which can send many type of authentication codes using intact CHAP. By using my proposal, other authentication method using password authentication together can be realized with a minimum cost burden.
Cited by 0Open access
Sebastian Krahmer · 2002
The Challenge Handshake Authentication Protocol (CHAP) is used to verify the identity of a peer in a 3-way handshake and is usually embedded in other protocols, commonly PPP. Several extensions (MS-CHAP) exist to allow the encryption of link layer packets via CHAP authenticated connections. In this paper I will describe how CHAP may be attacked, gaining unauthorized access to CHAP protected dialins or VPN’s and show that CHAP is not the right protocol to authenticate clients in IP networks. Disclaimer This material 1 is for educational purposes only. It demonstrates weaknesses within authentication schemes often used in wireless networks for example. All described tests and captures have been done in my own private LAN. It is strongly recommended that you do not test these programs without prior written permission of the local authorities. 1
Cited by 0
Gopikishan Thawre, Nitin Bahekar, B. R. Chandavarkar · 2020
In the digital payment system, the transactions and their data about clients are very sensitive, so the security and privacy of personal information of the client is a big concern. The confirmation towards security necessities prevents the data from a stolen and unauthorized person over the digital transactions, So the stronger authentication methods required, which must be based on cryptography. Initially, in the payment ecosystem, they were using the Kerberos protocol, but now different approaches such as Challenge-Handshake Authentication Protocol (CHAP), Tokenization, Two-Factor Authentication(PIN, MPIN, OTP), etc. such protocols are being used in the payment system. This paper presents the use cases of different authentication protocols. Further, the use of these protocols in online payment systems to verify each individual are explained.
Cited by 0
Gopikishan Thawre, Nitin Bahekar, B. R. Chandavarkar · 2020
In the digital payment system, the transactions and their data about clients are very sensitive, so the security and privacy of personal information of the client is a big concern. The confirmation towards security necessities prevents the data from a stolen and unauthorized person over the digital transactions, So the stronger authentication methods required, which must be based on cryptography. Initially, in the payment ecosystem, they were using the Kerberos protocol, but now different approaches such as Challenge-Handshake Authentication Protocol (CHAP), Tokenization, Two-Factor Authentication(PIN, MPIN, OTP), etc. such protocols are being used in the payment system. This paper presents the use cases of different authentication protocols. Further, the use of these protocols in online payment systems to verify each individual are explained.
Cited by 6Retracted
C. Perkins, P. Calhoun, Jayshree Bharatia · 2007
Mobile IP, as originally specified, defines an authentication extension (the Mobile-Foreign Authentication extension) by which a mobile node can authenticate itself to a foreign agent. Unfortunately, that extension does not provide the foreign agent any direct guarantee that the protocol is protected from replays and does not allow for the use of existing techniques (such as Challenge Handshake Authentication Protocol (CHAP)) for authenticating portable computer devices. In this specification, we define extensions for the Mobile IP Agent Advertisements and the Registration Request that allow a foreign agent to use a challenge/response mechanism to authenticate the mobile node. Furthermore, this document updates RFC 3344 by including a new authentication extension called the Mobile-Authentication, Authorization, and Accounting (AAA) Authentication extension. This new extension is provided so that a mobile node can supply credentials for authorization, using commonly available AAA infrastructure elements. This authorization-enabling extension MAY co-exist in the same Registration Request with authentication extensions defined for Mobile IP Registration by RFC 3344. This document obsoletes RFC 3012. [STANDARDS-TRACK]
Cited by 39
Asst. Lec. Ghassan Sabeeh Mahmood · Kirkuk University Journal-Scientific Studies · 2017
Cloud computing is a paradigm for offer information technology services on the Internet, such as hardware, software, networking and also the storage can be accessed anywhere at any time on a pay-per-use basis. However, storing private data onto servers of the cloud is a challenging matter. Therefore, cryptography technique and authentication are used in this model to ensure confidentiality and proper access control of sensitive data. Therefore, in this paper I proposed a model to protect data in cloud computing. In this model the algorithm of the Rivest-Shamir- Adleman (RSA) is applied to the private data. Furthermore, the protocol of Challenge-Handshake -Authentication-Protocol (CHAP) is used to improve the security of the authentication as well. The results show this model is secure and practical.
Cited by 10Open access
Kukuh Bagas Permadi, Henki Bayu Seta, Ria Astriratma · Informatik Jurnal Ilmu Komputer · 2020
Penggunaan pada protokol WPA memiliki dua proses, antara lain adalah otentikasi serta enkripsi. Pada tingkat network dengan infrastuktur yang besar serta dengan lalu lintas network yang tinggi sama halnya dengan universitas, kantor perusahaan atau tempat umum lainnya yang menggunakan wireless LAN, proses otentikasi merupakan proses yang pertama kali yang dilakukan agar pengguna jaringan wireless LAN dapat mengakses jaringan internet. Maka dari itu, tidak hanya aman namun proses otentikasi bias beroperasi dengan cepat. Solusi dari penelitian ini adalah dengan menerapkan Protokol IEEE 802.1x EAP dengan Extensible Authentication Protocol – Tunneled Transport Layer Security (EAP-TTLS) untuk membuat secure tunnel (terowongan keamanan) dalam pertukaran kunci pada jaringan wireless, serta dengan inner authentication Microsoft Challenge Handshake Authentication Protocol Version 2 (MSCHAPv2). Luaran yang dihasilkan pada penelitian ini adalah membangun suatu keamanan pada jaringan wireless terpusat pada Fakultas Ilmu Komputer UPN Veteran Jakarta.
Cited by 0Open access
Fanbao Liu, Tao Xie, Yumeng Feng et al. · Security and Communication Networks · 2012
ABSTRACT Point‐to‐Point Protocol over Ethernet (PPPoE) is a network protocol for encapsulating PPP frames inside Ethernet frames. It is widely used by commercial Internet service providers to provide Internet surfing for customers who pay bills. In this paper, we analyze the security of PPPoE network. We find that we can easily collect information about both the peers and the PPPoE authentication servers. We can use such information to recover the peer's authentication password by silently impersonating the server, which is undetectable in the network. We impersonate the server in the peers' LAN and get their passwords by hijacking the peers' PPPoE connections and negotiating for using the Password Authentication Protocol (PAP). We further propose an efficient password recovery attack against the Challenge‐Handshake Authentication Protocol (CHAP). We first recover the length of the used password through on‐line queries, based on the weakness of MD5 input pre‐processing. Then, we crack the known‐length password off‐line, using the probabilistic context‐free grammars. We point out that PPPoE cannot be used anymore until all of the weak authentication protocols including PAP, CHAP, and Microsoft CHAP are abolished right now and replaced with more secure Extensible Authentication Protocols. Copyright © 2012 John Wiley & Sons, Ltd.
Cited by 9
Omar S. Saleh, Osman Ghazali, Norbik Bashah Idris · International Journal of Advanced Computer Science and Applications · 2023
Academic certificate authentication is crucial in safeguarding the rights and opportunities of individuals who have earned academic credentials. This authentication helps prevent fraud and forgery, ensuring that only those who have genuinely earned certificates can use them for education and career opportunities. With the increased use of online education and digital credentials in the digital age, the importance of academic certificate authentication has significantly grown. However, traditional techniques for authentication, such as QR code, barcode, and watermarking, have limitations regarding security and privacy. Therefore, proposing a privacy-centred protocol to enhance the security and authentication of academic certificates is vital to improve the trust and credibility of digital academic certificates, ensuring that individuals' rights and opportunities are protected. In this context, we adopted the Challenge Handshake Authentication (CHA) protocol to propose the Certificate Verification Privacy Control Protocol (CVPC). We implemented it using Python and Flask with a Postgres database and an MVT structure for the application. The results of the implementation demonstrate that the proposed protocol effectively preserves privacy during the academic certificate issuance and verification process. Additionally, we developed a proof of concept to evaluate the proposed protocol, demonstrating its functionality and performance. The PoC provided insights into the strengths and weaknesses of the proposed protocol and highlighted its potential to prevent forgery and unauthorised access to academic certificates. Overall, the proposed protocol has the potential to significantly enhance the security and authenticity of academic certificates, improving the overall trust and credibility of the academic credentialing system.
Cited by 1Open access
M. Long, Chengjun Wu, J. David Irwin · IEE Proceedings - Communications · 2004
Authentication for inter-network roaming across wireless LANs is an important issue for achieving the goal of pervasive access and computing. The technical challenge lies in the fact that a visited network does not initially have the authentication credentials of a roaming user. Previous proposals have suggested that a visited network obtain the credentials of a roaming user and then forward them to the user's home network for authentication. A public key certificate structure is proposed, tailored to the business model of wireless Internet service providers (ISPs). In this manner, the mutual authentication between a visited network and a roaming user can be performed locally without any contact with user's home network. As a result, the time overhead incurred by communication between the ISPs' authentication, authorisation and accounting (AAA) servers can be avoided. A concrete protocol is proposed for the initial roaming authentication, which modifies the secure socket layer (SSL) v3.0 handshake protocol in order to encrypt a roaming user's identity, thus preventing any leaks in the wireless medium. A visited network can a posteriori use a portion of the protocol execution transcript as evidence to obtain revenue from a roaming user's home network. As demonstrated, the proposed solution provides a high level of security and is computationally efficient.
Cited by 30
Dana Hasan, R. Amin, Masnida Hussin · Kurdistan Journal of Applied Research · 2020
Domain Name System (DNS) is one of few services on the Internet which is allowed through every security barrier. It mostly depends on the User Datagram Protocol (UDP) as the transport protocol, which is a connectionless protocol with no built-in authentication mechanism. On top of that, DNS responses are substantially larger than their corresponding requests. These two key features made DNS a fabulous attacking tool for cybercriminals to reflect and amplify a huge volume of requests to consume their victim's resources. Recent incidents revealed how harsh DNS could be when it is abused with great complexity by attackers. Moreover, these events had proven that any defense mechanism with single point deployment couldn’t accurately and efficiently overcome an attack volume with high dynamicity. In this paper, we proposed the Efficient Distributed-based Defense Scheme (EDDS) to overcome the shortcomings of a centralized-based defense mechanism. By using an authentication message exchange, which is a Challenge-Handshake Authentication Protocol (CHAP)-based authentication mechanism. It is deployed on multiple nodes to determine the legitimacy of the DNS request. Moreover, it significantly reduces the impact of the amplification factor for the fake DNS requests without having any side effects on legitimate ones. Then, a Stateful Packet Inspection (SPI)-based packet filtering is proposed to distinguish legitimate requests from fake ones by considering the results of the authentication procedure. Both authentication-message exchange and SPI-based filtering are introduced to provide detection accuracy without reducing the quality of service for legitimate users. As the simulation results show, the proposed mechanism can efficiently and accurately detect, isolate, and discard the bogus traffic with minimal overhead on the system.
Cited by 2Open access
M. M. Gevorgyan · 2025
In the rapidly evolving field of Internet of Things (IoT) technologies, secure data exchange has become a significant challenge for devices with limited resources.This paper examines the implementation of the Transport Layer Security (TLS) protocol for IoT devices utilizing the MQTT and CoAP communication standards.It presents a system designed to ensure data confidentiality, integrity, and authentication through the use of Datagram TLS (DTLS) 1.2, a specific handshake model, and Pre-Shared Key (PSK) authentication.The approach leverages the nRF9160 DK and Thingy devices, which are powered by Arm Cortex-M33 processors and equipped with integrated CryptoCell310 security subsystems.MQTT facilitates a publish/subscribe message exchange model through Mutual TLS, while CoAP enables RESTful requests secured by DTLS.Sensor data are encrypted and transmitted over Bluetooth Low Energy (BLE), with handshake validation conducted through traffic analysis using Wireshark and PSK decryption.This research highlights that lightweight TLS modules, configured with CoAP and MQTT protocols and incorporating ARM's TrustZone technology, can afford secure and efficient communication in constrained environments without sacrificing performance.
Cited by 0Open access
Dana Hasan · Universiti Putra Malaysia Institutional Repository (Universiti Putra Malaysia) · 2017
Domain Name System (DNS) is based-on distributed, hierarchical, client-server architecture that translates domain names into Internet Protocol (IP) addresses and vice versa. It relies on User Datagram Protocol (UDP) to transport its data and uses IP in the network layer protocol. Normally, DNS receives requests from its source and sends back the substantially larger responses without inspecting the source address. Lack of source inspection is due to the fact that UDP is a connectionless protocol and IP address does not provide authentication mechanism. Furthermore, DNS is designed for naming efficiency, not security. Such scenarios make DNS a tempting target for cybercriminals to perform massive Distributed Reflection Denial of Service (DRDoS) attacks which are called Reflection/Amplification and hassles the communication traffic towards connected network nodes. There are several defense mechanisms that proposed to tackle DNS Reflection/Amplification attack. They depend on centralized-based approaches where their functionalities degrade against large and complex traffic. In this research, Distributed-based Defense Scheme (DDS) is proposed to monitor incoming DNS requests for handling DNS Reflection/Amplification attacks and a filtration mechanism to distinguish legitimate requests from fake ones. It utilizes an authentication mechanism called DNS Checkpoint which is based on Challenge-Handshake Authentication Protocol (CHAP) to provide authentication for detecting any Reflection/Amplification attacks. The DNS Disinfector is used for filtering mechanism that based-on Stateful Packet Inspection (SPI). It is used to distinguish legitimate requests and discard the fake ones. The experiment results show that DDS remarkably overcome the singlepoint deployment defense mechanism in terms of defense strength, minimizing amplification factor and less bandwidth usage. The results analysis also shows that DDS able to better protect upstream networks from depletion than other defense mechanisms with minimum overhead.
Cited by 0Open access