User's Manual

7. Glossary

CHAP: Challenge Handshake Authentication Protocol. Security feature supported on

lines using PPP encapsulation that prevents unauthorized access. CHAP does

not itself prevent unauthorized access, but merely identifies the remote end.

The router or access server then determines whether that user is allowed

access.

EAP: Extensible Authentication Protocol. Framework that supports multiple,

optional authentication mechanisms for PPP, including cleartext passwords,

challenge-response, and arbitrary dialog sequences.

LEAP: Lightweight Extensible Authentication Protocol is a Cisco proprietary

EAP-Type. It is designed to overcome some basic wireless authentication

concerns through Mutual Authentication and the use of dynamic WEP

keys.

MD5: MD5 is an EAP-Type for authentication. It is analogous to the PPP CHAP

protocol. A challenge string is sent from the Authentication Server to the

Supplicant in the MD5-Challenge Request. The challenge string with the

user password is hashed using MD5 and the hash is returned in the

MD5-Challenge Response. The Authentication Server performs the same

hash and compares the result with that returned by the Supplicant to

determine whether the authentication is a Success.

PAP: Password Authentication Protocol. Authentication protocol that allows PPP

peers to authenticate one another. The remote router attempting to connect to

the local router is required to send an authentication request. Unlike CHAP,

PAP passes the password and the host name or username in the clear

(unencrypted). PAP does not itself prevent unauthorized access but merely

identifies the remote end. The router or access server then determines

whether that user is allowed access. PAP is supported only on PPP lines.

PEAP: Protected Extensible Authentication Protocol is a two-phase authentication

like TLS. In the first phase the Authentication Server is authenticated to the

Supplicant. Using TLS, a secure channel is established through which any

other EAP-Type can be used to authenticate the Supplicant to the