User`s guide

Setting Up Pipeline Security
Connection security
7-12 Preliminary January 30, 1998 Pipeline User’s Guide
Authentication protocols
Password Authentication Protocol (PAP) and Challenge Handshake
Authentication Protocol (CHAP) require Point-to-Point Protocol (PPP)
encapsulation. These authentication protocols apply to PPP, Multilink PPP (MP),
and Multichannel PPP (MP+) connections to the Pipeline. Both sides of the
connection must support the same protocol.
PAP provides a simple way for a peer to establish its identity in a two-way
handshake when initially establishing a link. It sends passwords in the clear, so it
is not a very strong authentication method. PAP provides baseline security when
your system interoperates with equipment from other vendors.
CHAP is a stronger authentication method than PAP. During the establishing of
the initial link, CHAP verifies the identity of a peer through a three-way
handshake. It sends passwords encrypted by means of a one-way hash
function. This use of an incrementally changing identifier and a variable
challenge value protects against playback attack.
MS-CHAP is supported to work with DES and MD4 encryption in Windows NT
environments only. The Pipeline can authenticate a Windows NT system and a
Windows NT system can authenticate a Pipeline.
Note:
In addition to this type of authentication, there are other parameters, such
as Telco and Session options, that affect whether the Pipeline is able to build the
connection. For example, if the AnsOrig parameter is set to prevent incoming
calls, the Pipeline will never reach the stage of authenticating an incoming call
using that profile.
Name and password verification
During authentication, the calling device often requires the Pipeline unit’s name
and password as well. The Pipeline name is specified in the System profile. The
Send PW parameter is a password sent to the calling device.
If the Ethernet > Answer > Recv Auth parameter is set to Either, the Pipeline uses
PAP, CHAP, or MS-CHAP, depending on what the caller supports. If it is set just
to a specific authentication protocol, the Pipeline rejects any password not sent
with the assigned authentication protocol.