Password Authentication Protocol

The Password Authentication Protocol, usually shortened to PAP, is a password-based method that the Point-to-Point Protocol uses to validate a user when a link starts. It is specified in RFC 1334, published in October 1992 by Brian Lloyd and William Simpson. The exchange is a two-way handshake done only once, when the link is first established: the client sends its username and password, repeating the request until it gets an answer, and the server replies with an authenticate-ack when the credentials are acceptable or an authenticate-nak when they are not. Because PPP carries data unencrypted, PAP sends the name and password in the clear, so anyone able to watch the session can read them, and it is regarded as a weak scheme; the Challenge-Handshake Authentication Protocol and the Extensible Authentication Protocol add some protection. Its simplicity keeps the computational cost low, so it is used where the transport is expected to be physically secure, such as a home DSL link. One benefit is that the server receives the plain password and can therefore keep it in a hashed form at rest. The name is also used for plain password checks in RADIUS and Diameter, where the transport supplies its own security.