Cisco Systems Servers Manuale Utente

PAP, CHAP, and ARAP are authentication protocols used to encrypt passwords. 
However, each protocol provides a different level of security.

PAP—Uses clear-text passwords (that is, unencrypted passwords) and is the 
least sophisticated authentication protocol. If you are using the 
Windows NT/2000 user database to authenticate users, you must use PAP 
password encryption or MS-CHAP.

CHAP—Uses a challenge-response mechanism with one-way encryption on 
the response. CHAP enables Cisco Secure ACS to negotiate downward from 
the most secure to the least secure encryption mechanism, and it protects 
passwords transmitted in the process. CHAP passwords are reusable. If you 
are using the CiscoSecure user database for authentication, you can use either 
PAP or CHAP. CHAP does not work with the Windows NT/2000 user 
database.

ARAP—Uses a two-way challenge-response mechanism. The AAA client 
challenges the end-user client to authenticate itself, and the end-user client 
challenges the AAA client to authenticate itself.

Cisco Secure ACS supports Microsoft Challenge-Handshake Authentication 
Protocol (MS-CHAP) for user authentication. Differences between MS-CHAP 
and standard CHAP are the following:

The MS-CHAP Response packet is in a format compatible with Microsoft 
Windows NT/2000, Windows 95/98/ME, and LAN Manager 2.x. The 
MS-CHAP format does not require the authenticator to store a clear-text or 
reversibly encrypted password.

MS-CHAP provides an authentication-retry mechanism controlled by the 
authenticator.

MS-CHAP provides additional failure codes in the Failure packet Message 
field.

For more information on MS-CHAP, refer to RFC 
draft-ietf-pppext-mschap-00.txt, RADIUS Attributes for MS-CHAP Support.