Network Working Group                                           B. Lloyd
Request for Comments: 1334                                           L&A
							      W. Simpson
							      Daydreamer
							    October 1992


		      PPP Authentication Protocols

Status of this Memo

   This RFC specifies an IAB standards track protocol for the Internet
   community, and requests discussion and suggestions for improvements.
   Please refer to the current edition of the "IAB Official Protocol
   Standards" for the standardization state and status of this protocol.
   Distribution of this memo is unlimited.

Abstract

   The Point-to-Point Protocol (PPP) [1] provides a standard method of
   encapsulating Network Layer protocol information over point-to-point
   links.  PPP also defines an extensible Link Control Protocol, which
   allows negotiation of an Authentication Protocol for authenticating
   its peer before allowing Network Layer protocols to transmit over the
   link.

   This document defines two protocols for Authentication: the Password
   Authentication Protocol and the Challenge-Handshake Authentication
   Protocol.  This memo is the product of the Point-to-Point Protocol
   Working Group of the Internet Engineering Task Force (IETF).
   Comments on this memo should be submitted to the ietf-ppp@ucdavis.edu
   mailing list.

Table of Contents

   1.  Introduction ...............................................    2
   1.1 Specification Requirements .................................    2
   1.2 Terminology ................................................    3
   2. Password Authentication Protocol ............................    3
   2.1 Configuration Option Format ................................    4
   2.2 Packet Format ..............................................    5
   2.2.1 Authenticate-Request .....................................    5
   2.2.2 Authenticate-Ack and Authenticate-Nak ....................    7
   3. Challenge-Handshake Authentication Protocol..................    8
   3.1 Configuration Option Format ................................    9
   3.2 Packet Format ..............................................   10
   3.2.1 Challenge and Response ...................................   11
   3.2.2 Success and Failure ......................................   13



Lloyd & Simpson                                                 [Page 1]

RFC 1334                   PPP Authentication               October 1992


   SECURITY CONSIDERATIONS ........................................   14
   REFERENCES .....................................................   15
   ACKNOWLEDGEMENTS ...............................................   16
   CHAIR'S ADDRESS ................................................   16
   AUTHOR'S ADDRESS ...............................................   16

1.  Introduction

   PPP has three main components:

      1. A method for encapsulating datagrams over serial links.

      2. A Link Control Protocol (LCP) for establishing, configuring,
	 and testing the data-link connection.

      3. A family of Network Control Protocols (NCPs) for establishing
	 and configuring different network-layer protocols.

   In order to establish communications over a point-to-point link, each
   end of the PPP link must first send LCP packets to configure the data
   link during Link Establishment phase.  After the link has been
   established, PPP provides for an optional Authentication phase before
   proceeding to the Network-Layer Protocol phase.

   By default, authentication is not mandatory.  If authentication of
   the link is desired, an implementation MUST specify the
   Authentication-Protocol Configuration Option during Link
   Establishment phase.

   These authentication protocols are intended for use primarily by
   hosts and routers that connect to a PPP network server via switched
   circuits or dial-up lines, but might be applied to dedicated links as
   well.  The server can use the identification of the connecting host
   or router in the selection of options for network layer negotiations.

   This document defines the PPP authentication protocols.  The Link
   Establishment and Authentication phases, and the Authentication-
   Protocol Configuration Option, are defined in The Point-to-Point
   Protocol (PPP) [1].

1.1.  Specification Requirements

   In this document, several words are used to signify the requirements
   of the specification.  These words are often capitalized.

   MUST
      This word, or the adjective "required", means that the definition
      is an absolute requirement of the specification.



Lloyd & Simpson                                                 [Page 2]

RFC 1334                   PPP Authentication               October 1992


   MUST NOT
      This phrase means that the definition is an absolute prohibition
      of the specification.

   SHOULD
      This word, or the adjective "recommended", means that there may
      exist valid reasons in particular circumstances to ignore this
      item, but the full implications should be understood and carefully
      weighed before choosing a different course.

   MAY
      This word, or the adjective "optional", means that this item is
      one of an allowed set of alternatives.  An implementation which
      does not include this option MUST be prepared to interoperate with
      another implementation which does include the option.

1.2.  Terminology

   This document frequently uses the following terms:

   authenticator
      The end of the link requiring the authentication.  The
      authenticator specifies the authentication protocol to be used in
      the Configure-Request during Link Establishment phase.

   peer
      The other end of the point-to-point link; the end which is being