Password Authentication

• In PAP, the client sends an authentication request, containing a username and password. The server checks these and either sends back an authentication "ACK" to proceed or "NAK" if authentication failed.
  
  

Challenge Handshake

• CHAP authentication is initiated by the authenticator. It sends a challenge text to the client. The client then encrypts this text with an algorithm based on the password. The result of the encryption is sent to the server as a response. The server also encrypts the challenge text with the password it is holding for the client. If the result of this encryption turns out the same as the response sent by the client, a "Success" message is sent. If not, then a "Failure" message is sent.
  
  

Differences

• A great weakness of the PAP system is that both the user name and password are sent to the server as unencrypted text. This means they can easily be read if the message is intercepted. The CHAP system does not transmit the user password.