Subject: [Ips] CHAP_N not necessary for authentication?

From: "Dan Bar Dov" <[email-masked]>
Date: Wed, 27 Jul 2005 10:32:26 +0300

The spec does not specify whether CHAP_N need to match. 

Should and initiator with the proper CHAP_R response be allowed to proceed even if CHAP_N is incorrect?

Dan Bar Dov

_______________________________________________
Ips mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ips

---

From: Paul Koning <[email-masked]>
Date: Wed, 27 Jul 2005 09:03:00 -0400

>>>>> "Dan" == Dan Bar Dov <[email-masked]> writes:

 Dan> The spec does not specify whether CHAP_N need to match.

Match what?

 Dan> Should and initiator with the proper CHAP_R response be allowed
 Dan> to proceed even if CHAP_N is incorrect?

I'm not sure what you mean.  

CHAP authenticates a CHAP user name -- which is CHAP_N.  The response
proves that the sender knows the secret associated with that name.

That name has no relationship to the initiator name.  So if you're
doing access control with CHAP authentication, you'd put CHAP names
into your access control entries.

     paul