Page 863 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

protocol associated with Voice over IP [VoIP].)

Authentication Protocols

After a connection is initially established between a remote system and
a server or a network, the first activity that should take place is to
verify the identity of the remote user. This activity is known as
authentication. There are several authentication protocols that control
how the logon credentials are exchanged and whether those

credentials are encrypted during transport:

Challenge Handshake Authentication Protocol (CHAP) This
is one of the authentication protocols used over Point-to-Point
Protocol (PPP) links. CHAP encrypts usernames and passwords. It
performs authentication using a challenge-response dialogue that
cannot be replayed. CHAP also periodically reauthenticates the remote
system throughout an established communication session to verify a

persistent identity of the remote client. This activity is transparent to
the user.

Password Authentication Protocol (PAP) This is a standardized
authentication protocol for PPP. PAP transmits usernames and
passwords in cleartext. It offers no form of encryption; it simply
provides a means to transport the logon credentials from the client to

the authentication server.
Extensible Authentication Protocol (EAP) This is a framework

for authentication instead of an actual protocol. EAP allows
customized authentication security solutions, such as supporting
smart cards, tokens, and biometrics. (See the sidebar “EAP, PEAP, and
LEAP” for information about other protocols based on EAP.)

These three authentication protocols were initially used over dial-up
PPP connections. Today, these and many other, newer authentication

protocols (such as openID, OAuth, and Shibboleth) and concepts (such
as authentication federation and SAML) are in use over a wide number
of distance connection technologies, including broadband and virtual
private networks (VPNs), as well as expanding support and using
traditional authentication services, such as Kerberos, Remote
Authentication Dial-in User Service (RADIUS), and even Terminal