From PPP Authentication Using the ppp chap hostname and ppp authentication chap
PAP authentication involves a two-way
handshake where the username and
password are sent across the link in
clear text; hence, PAP authentication
does not provide any protection
against playback and line sniffing.
CHAP authentication, on the other
hand, periodically verifies the
identity of the remote node using a
three-way handshake. After the PPP
link is established, the host sends a
"challenge" message to the remote
node. The remote node responds with a
value calculated using a one-way hash
function. The host checks the response
against its own calculation of the
expected hash value. If the values
match, the authentication is
acknowledged; otherwise, the
connection is terminated.
