Password Authentication Protocol

Password Authentication Protocol (PAP) is a password-based authentication protocol used by Point to Point Protocol (PPP) to validate users. PAP is specified in RFC 1334.

Almost all network operating systems support PPP with PAP, as do most network access servers. PAP is also used in PPPoE, for authenticating DSL users.

As the Point to Point Protocol (PPP) sends data unencrypted and "in the clear", PAP is vulnerable to any attacker who can observe the PPP session. An attacker can see the users name, password, and any other information associated with the PPP session. Some additional security can be gained on the PPP link by using CHAP or EAP.

PAP by itself is therefore considered a weak authentication scheme. Weak schemes are simpler and have lighter computational overhead than more complex schemes such as Transport Layer Security (TLS), but they are much more vulnerable to attack. While weak schemes are used where the transport layer is expected to be physically secure, such as a home DSL link. Where the transport layer is not physically secure a system such as Transport Layer Security (TLS) or Internet Protocol Security (IPsec) is used instead.

Other Uses of PAP

PAP is also used to describe password authentication in other protocols such as RADIUS and Diameter. However, those protocols provide for transport or network layer security, and this do not have the security issues seen when PAP is used with PPP.

Working cycle

PAP authentication is only done at the time of the initial link establishment, and verifies the identity of the client using a two-way handshake.

1. Client sends username and password. This is sent repeatedly until a response is received from the server.
2. Server sends authentication-ack (if credentials are OK) or authentication-nak (otherwise)

PAP Packets

Description	1 byte	1 byte	2 bytes	1 byte	Variable	1 byte	Variable
Authentication-request	Code = 1	ID	Length	Username length	Username	Password length	Password
Authentication-ack	Code = 2	ID	Length	Message length	Message
Authentication-nak	Code = 3	ID	Length	Message length	Message

PAP packet embedded in a PPP frame. The protocol field has a value of C023 (hex).

Flag	Address	Control	Protocol (C023 (hex))	Payload (table above)	FCS	Flag

See also

• SAP - Service Access Point

References

• Lloyd, Brian; Simpson, William Allen (1992). "Password Authentication Protocol". PPP Authentication Protocols. IETF. p. 2. doi:10.17487/RFC1334. RFC 1334. Retrieved 16 July 2015.